In a recent development, the office of the Data Protection Commissioner in Kenya made a significant press release in September 2023, announcing the issuance of three penalty notices, collectively totaling KES 9,375,000. These penalties reflect the growing importance of data protection in today’s digital age. In particular, a penalty notice of KES 2,975,000 was served to a digital credit provider for accessing customer data through third-party applications. Another notice was directed at Casa Vera Lounge, a nightclub, that shared reveler’s photos, and it incurred a fine of KES 1,850,000. The most significant penalty, totaling KES 4,550,000, was imposed on a school for sharing images of a minor without obtaining parental consent. These penalties not only emphasize the seriousness of data protection but also shed light on the evolving landscape of consent and privacy in various contexts, including social places like clubs and restaurants.
THE LAW AND CONSENT
The foundation of this issue lies in the unequivocal stance of the law regarding consent in data protection. Section 2 of the Data Protection Act 2019 defines consent as “any manifestation of express, unequivocal, free, specific, and informed indication of the data subject’s wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject.”
THE KEY ELEMENTS OF CONSENT
The law sets a high bar for consent, necessitating that it encompass several key elements:
- Express: Consent must be unmistakably and explicitly given, with no room for ambiguity.
- Unequivocal: There should be no doubt about the individual’s intent to consent.
- Free: Consent must be voluntary, devoid of any coercion or pressure.
- Specific: It must specify the exact purposes for which the data, including photographs, will be used.
- Informed: Individuals must have full awareness of how their data will be processed before granting consent.
THE RIGHT TO KNOW
In line with section 26 of the data protection act, an individual’s foremost right is to be informed about how their personal data will be utilized. A data controller or processor must, to the extent practicable, provide this information before collecting personal data. This encompasses crucial details such as the fact that personal data is being collected, its intended use, any recipients of the information that may be transmitted, and the protective measures in place.
Moreover, data controllers and processors should supply contact information for themselves and any other potential recipients of the data, describe the security measures in place, clarify if the data collection is mandated by law, and explain the consequences if the data subject chooses not to provide certain requested information.
THE LIMITATIONS OF A NOTICE
Given these legal requirements, it becomes evident that a simple notice posted at the entrance of a business establishment, such as a club, cannot suffice as valid consent for data processing, including photography. Such notices, while informative, fall short of the stringent standards set by data protection laws. They do not provide the explicit, unequivocal, and informed consent demanded by the law.
CONCLUSION
The incident involving Casa Vera Lounge serves as a poignant reminder of the imperative of securing explicit consent for data processing activities like photography, especially in social places. Relying on notices at the entrance of a venue falls short of the rigorous legal standards outlined in data protection laws. Businesses must ensure that they acquire clear and informed consent from individuals before engaging in data processing activities, respecting both the law and the privacy rights of patrons. It is crucial for establishments to navigate this legal landscape meticulously to maintain compliance with data protection regulations while upholding individual privacy rights.