Esther Kanza Mbuvu v Grain Industries Limited

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, 3 June 2024.

Record ID

ke-odpc-2024-0058

Case reference

ODPC Complaint No. 387 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Esther Kanza Mbuvu

Date decided

3 June 2024

Respondent type

private

Sector

general

Violations

unauthorised image/photo use, lack of consent, commercial use of personal data, failure to respond to erasure request, unlawful processing, failure to implement security measures

Provisions cited

s.25 DPA 2019, s.26(a) DPA 2019, s.26 DPA 2019, s.28(2) DPA 2019, s.28(2)(c) DPA 2019, s.28(1) DPA 2019, s.29 DPA 2019, s.30 DPA 2019, s.30(1)(b) DPA 2019, s.32(1) DPA 2019, s.37(1) DPA 2019, s.40(1)(b) DPA 2019, s.41(1) DPA 2019, s.42(2) DPA 2019, s.56(1) DPA 2019, s.65(4) DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered; enforcement notice issued

Compensation

KES 1,000,000 (≈ USD 7,580 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 9edce5630a02e085…

Record verified

30 July 2026

The facts

The complainant alleged Grain Industries Limited used her image in its marketing billboard, YouTube promotions and social media platforms without obtaining her consent. The ODPC found the respondent, intentionally or negligently, violated her right to be informed and denied her right of erasure by failing to take the images down across the platforms when she notified it.

Orders and outcome

The respondent was found liable, ordered to pay the complainant KES 1,000,000 as compensation, and an enforcement notice was issued against it. Dated June 2024.

CONSENT · DATA-SECURITY · GENERAL · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.