Nairobi Hotel Ordered to Pay Sh750,000 for Unauthorized Use of Man’s Photos

In a landmark ruling, a Nairobi hotel has been ordered to pay Sh750,000 in compensation to a man whose photographs were used without his consent for commercial purposes.

The Office of the Data Protection Commissioner (ODPC) found Hotel Tobriana liable for violating Richard Wafula’s right of erasure, a decision that underscores the growing importance of data privacy in Kenya.

The case stems from an incident during Wafula’s wedding at Hotel Tobriana, located in the upscale Jacaranda Close Ridgeways area of Nairobi.

Wafula and his wife, along with their wedding guests, had their photographs taken at the hotel, which were later uploaded to the hotel’s social media platforms, including Facebook and Instagram, for advertisement purposes.

The hotel used the images to promote its services without obtaining express consent from Wafula or his guests, a move that the ODPC deemed a breach of the Data Protection Act.

According to the ODPC, the hotel was required to seek explicit consent before using the photographs for commercial purposes.

“The hotel ought to have sought and obtained consent from the complainant before uploading his image and videos on its Facebook, Instagram, and other platforms,” the ODPC stated in its ruling.

The office further directed the hotel to erase the images within 14 days, failing which it would face additional penalties.

Wafula lodged a complaint with the ODPC, alleging that the hotel’s actions not only violated his privacy but also caused him significant emotional distress.

He argued that the unauthorized use of his images exposed him to unwarranted public attention, particularly given the personal nature of the event.

The ODPC agreed, noting that the hotel’s failure to notify Wafula of its intent to use the images for advertising purposes constituted a clear violation of his rights under Section 20 of the Data Protection Act.

In its defense, Hotel Tobriana claimed that the images were used to showcase its services and that Wafula had not explicitly objected to their use at the time of the wedding.

However, the ODPC rejected this argument, emphasizing that the onus was on the hotel to obtain express consent for commercial use of personal data.

The ruling also highlighted the hotel’s failure to comply with earlier directives to erase the images, further compounding the violation.

The ODPC’s decision to award Wafula Sh750,000 in compensation is seen as a significant step in enforcing data protection laws in Kenya.

It also serves as a warning to businesses that handle personal data, particularly in the hospitality and events sectors, to adhere to strict privacy regulations.

The ruling comes at a time when concerns over data privacy are on the rise, with many Kenyans becoming increasingly aware of their rights under the Data Protection Act.

Wafula expressed relief at the outcome, stating that the ruling was a victory not only for him but for others whose personal data may be misused by businesses.

“It’s a matter of principle,” he said. “My family and I were deeply hurt by the hotel’s actions. This decision sends a message that our privacy matters.”

As Kenya continues to strengthen its data protection framework, the ODPC’s ruling against Hotel Tobriana sets a precedent for how violations of privacy rights will be addressed, ensuring that individuals’ personal data is handled with the respect and care it deserves.