Case: Republic v Data Protection Commissioner; Hotel Waterbuck Limited (Ex Parte Applicant); Siele (Interested Party)
Citation: Judicial Review E011 of 2024; [2025] KEHC 5801 (KLR)
Court: High Court of Kenya at Nakuru
Judge: Hon. Justice J. M. Nang’ea
Date: 5 May 2025
Background
Every business that puts a staff photo on its website, brochure, or social media page is processing personal data, and Kenya’s data protection framework treats that with the same seriousness as it does financial or medical information. This case is a reminder of exactly how seriously.
Hotel Waterbuck Limited, a Nakuru based hospitality establishment, used an image of one of its employees, Victor Siele, on its website for commercial purposes. Siele objected to the continued use of his image and lodged a complaint with the Office of the Data Protection Commissioner (ODPC).
The ODPC investigated (Complaint No. 0478 of 2024) and, in a determination dated 18 June 2024, found that Hotel Waterbuck had not obtained valid consent before using Siele’s image commercially. The hotel argued that Siele had given verbal consent and had even posed voluntarily for the photograph. The ODPC was not persuaded: verbal or implied consent, without more, did not meet the statutory threshold. The Commissioner ordered the hotel to compensate Siele KES 500,000.
Hotel Waterbuck did not appeal this determination through the statutory route. Instead, it went to the High Court seeking judicial review, asking the court to quash the ODPC’s decision as unfair, irrational, and procedurally improper, and to declare the compensation award punitive and unlawful.
Issues
- Was judicial review the correct legal avenue for challenging an ODPC determination?
- Did Hotel Waterbuck’s evidence of verbal or implied consent satisfy the consent requirements under the Data Protection Act, 2019?
Holding
The High Court struck out the application in its entirety, for want of jurisdiction, with costs awarded against Hotel Waterbuck.
Reasoning
On the procedural question, the Court held that the Data Protection Act sets out its own dedicated appeal mechanism. Section 64 of the Act gives any person aggrieved by an ODPC determination (including enforcement and penalty notices) the right to appeal directly to the High Court, within 30 days of receiving the notice. Because this statutory appeal pathway existed and was adequate, the Court held that judicial review was not available; a party cannot bypass a specific statutory remedy in favour of the more general judicial review jurisdiction. The Court drew on earlier authority on the same point, including Swara Acacia Lodge v Office of the Data Protection Commissioner, where a similarly structured application had also been struck out for the same reason.
On the substance, although the matter was disposed of on jurisdictional grounds, the Court’s discussion affirmed the ODPC’s underlying finding: consent under the Data Protection Act must be demonstrable against specific statutory conditions (including Sections 2, 30(1), 32 and 37), and a data controller carries the burden of proving it. Posing for a photograph, or giving informal verbal agreement in the moment, does not by itself establish the kind of free, specific, informed, and unambiguous consent the law requires, particularly where the image is later put to ongoing commercial use.
Practical Takeaways
This decision is a useful reference point for any business (hotels, real estate developers, retailers, professional firms) that uses images, testimonials, or other personal data of staff, clients, or the public in its marketing:
- Document consent properly. A verbal “yes” or a person simply agreeing to be photographed is not, on its own, reliable proof of consent. Written consent forms, clearly describing how an image or data will be used, are the safer standard.
- Consent can be time bound. Where consent is given for a specific purpose or period, continuing to use the image afterward can itself become a fresh infringement.
- Know the right forum. Businesses unhappy with an ODPC determination must use the statutory appeal process under Section 64 of the Data Protection Act within 30 days, not judicial review. Choosing the wrong remedy, as this case shows, can mean losing the chance to argue the merits at all.
- Compliance failures carry real financial exposure. A single unconsented use of one person’s image resulted in a KES 500,000 compensation order, before the additional cost of contesting the matter in court.
This article is for general information only and does not constitute legal advice on any specific matter.