Your marketing photos need consent: lessons from Kenya’s data protection fines

Posting a photo of a happy customer, a student or a project participant feels harmless. In Kenya it can now be expensive. Under the Data Protection Act 2019, a person’s image is personal data, and using it for marketing without consent can lead to a penalty from the Office of the Data Protection Commissioner (ODPC).

The cases that made headlines

• In early 2023 the ODPC issued its first penalty notice, against Oppo Kenya, for posting a complainant’s photo on social media without consent. The fine was KES 5 million, the maximum available under the Act and its regulations. Oppo had also failed to respond to an earlier enforcement notice.
• In September 2023 the ODPC announced fines totalling about KES 9.4 million against three businesses. A private school was fined KES 4.5 million for posting pictures of a minor on its social media without the parents’ consent. A Nairobi nightclub was fined KES 1.9 million for posting a patron’s image without consent.

The message is clear: event photos, customer testimonials and programme pictures all need a lawful basis, and for marketing that usually means consent.

Why this matters for design and communications teams

Most of the images in a brand’s social feed, annual report or proposal come from events, field visits and customer stories. Designers and communications officers are often the last people to handle those images before they are published, so they are in the best position to ask: do we have consent for this?

A practical consent checklist

• Ask before you shoot. Explain who you are, what the photos are for and where they will appear, in a language the person understands.
• Get it in writing. A short consent form, or a recorded verbal consent for people who cannot write, is far stronger than a nod.
• Be specific. Consent for an internal report is not consent for a billboard or a paid social campaign.
• Take extra care with children. Get consent from a parent or guardian, avoid showing names, schools or locations that identify them, and question whether a face is needed at all.
• Give people a real choice. Make it easy to say no, and respect it without pressure.
• Use signs at events. A clear notice at the entrance, with a way to opt out such as a coloured lanyard, helps at conferences and launches.
• Keep records. Store consent forms with the images, labelled so anyone can check later.
• Honour withdrawal. If someone asks for their photo to be removed, take it down promptly.
• Answer the regulator. If you receive an ODPC notice, respond. Ignoring one made the Oppo case worse.

Design choices that reduce risk

Not every story needs a recognisable face. Hands at work, people photographed from behind, wide shots, silhouettes and close ups of tools or products can all carry a story while protecting privacy. For sensitive programmes, such as health, child protection or gender based violence, these choices should be the default.

Good practice is good branding

Brands and NGOs that treat people’s images with respect build trust with the communities they serve. Clear consent also protects your designers, your partners and your reputation.

This article is general information, not legal advice. For your organisation’s specific obligations, consult a data protection professional.

Sources: Bowmans, Kenya: the ODPC issues decisions in the determination of complaints (January 2023); Kenyans.co.ke, ODPC fines three businesses Ksh9M over data privacy infringement (September 2023); Kenya Data Protection Act, 2019.