Kenya’s data protection framework: consent is not static or permanent - The case of Moja Expressway Company v Ndung’u (Civil Appeal E673 of 2024) [2025]

High Court Upholds Kshs. 500,000 Award in Data Privacy Dispute

In a significant decision on data protection and employee rights, the High Court has upheld a Kshs. 500,000 award against Moja Expressway Company for unlawfully using a former employee’s image in promotional material after the end of his employment.

The case, Moja Expressway Company v Ndung’u (Civil Appeal E673 of 2024) [2025], arose from a dispute between the company and its former employee, Ndung’u, over the use of his image on the company’s social media platforms.

Background of the Dispute

During his employment, Ndung’u had consented to the company’s use of his image for promotional purposes. However, after resigning in November 2022, the employment relationship came to an end.

Nearly a year later, in October 2023, the company published a promotional post featuring Ndung’u’s image. He subsequently lodged a complaint with the Office of the Data Protection Commissioner (ODPC), alleging unlawful use of his personal data.

The company maintained that there was no breach, arguing that Ndung’u had previously given oral consent and had never formally withdrawn it. The ODPC disagreed, finding that a data breach had occurred and awarding Ndung’u Kshs. 500,000 in compensation.

The Appeal

Moja Expressway Company challenged the ODPC’s decision before the High Court, arguing that the damages awarded were not justified and had not been proven.

The Court was asked to determine two key issues:

• Whether valid consent had been obtained for the continued use of the image; and
• Whether the ODPC’s award of compensation was warranted.

Court’s Findings

On the issue of consent, the Court held that consent to use personal data is not indefinite or automatic. It observed that the continued use of Ndung’u’s image after termination of employment amounted to commercial exploitation.

While such use during employment may be compensated through salary or commission, the Court found that once the employment relationship ended, any further commercial use required fresh consent or a separate contractual arrangement. The company’s failure to obtain renewed consent rendered the use unlawful.

Regarding compensation, the Court acknowledged that emotional distress and related harm are difficult to quantify. Relying on previous judicial decisions, including MWK & Another v Attorney General & 3 Others and Kamande v Nation Media Group, the Court affirmed that reasonable compensation may be awarded even where harm cannot be precisely measured.

The High Court ultimately found no fault in the ODPC’s decision and upheld the award of Kshs. 500,000 to Ndung’u.

Key Takeaway for the Public

The ruling reinforces a critical principle under Kenya’s data protection framework: consent is not static or permanent. Where the circumstances under which personal data was originally provided change — such as the termination of employment — fresh consent may be required.

The decision serves as a caution to employers and organisations that personal data, including images, cannot be commercially exploited beyond the scope of the original consent. Failure to comply with data protection obligations may result in legal and financial consequences.