Consent under data protection law is purpose-specific and time-sensitive: The Case of Moja Expressway Company v Ndung’u (Civil Appeal E673 of 2024) [2025]

 

Case Brief: Moja Expressway Company v Ndung’u (Civil Appeal E673 of 2024) [2025]

Procedural History

The Respondent lodged a complaint before the Office of the Data Protection Commissioner (ODPC) alleging unlawful use of his personal data after termination of employment. The ODPC found that a data breach had occurred and awarded Kshs. 500,000 in compensation.

The Appellant appealed to the High Court, challenging both the finding of breach and the award of damages.

 

Material Facts

• The parties were in an employer–employee relationship.
• During his employment, the Respondent consented to the use of his image for the Appellant’s promotional content on social media platforms.
• The Respondent resigned in November 2022, thereby terminating the employment relationship.
• In October 2023, the Appellant published promotional content featuring the Respondent’s image.
• The Respondent filed a complaint before the ODPC alleging unlawful processing of personal data.
• The Appellant argued that the Respondent had orally consented to the use of his image and had not withdrawn such consent.

The ODPC held that the post-employment use of the Respondent’s image constituted a data breach and awarded Kshs. 500,000 in compensation.

 

Issues

1. Whether valid consent existed for the continued use of the Respondent’s image after termination of employment.
2. Whether the ODPC’s award of Kshs. 500,000 in damages was justified.

 

Holding

1. The Court held that valid consent did not exist for the post-employment use of the Respondent’s image.
2. The Court upheld the ODPC’s award of Kshs. 500,000 as reasonable and warranted.

 

Court’s Reasoning

1. On Consent

The Court emphasized that consent under data protection law is context-specific and not perpetual.

While the Respondent had consented to the use of his image during employment, such consent was intrinsically linked to the employment relationship. During employment, the commercial use of an employee’s image may be compensated through salary or other employment benefits.

Upon termination, however, continued commercial use of the Respondent’s image constituted exploitation outside the employment framework. The Court held that such use required fresh consent or a separate contractual arrangement.

The absence of renewed consent rendered the continued use unlawful.

 

2. On Damages

The Court noted that compensation for data breaches often involves intangible harm, including emotional distress, reputational injury, or frustration, which cannot be precisely quantified.

Relying on precedent, including:

• MWK & Another v Attorney General & 3 Others; and
• Kamande v Nation Media Group,

the Court affirmed that where harm is established but difficult to measure, courts are entitled to award reasonable compensation.

The Court found no error in the ODPC’s assessment and upheld the award of Kshs. 500,000.

 

Ratio Decidendi

Consent to process personal data is not indefinite and must align with the specific context and purpose for which it was granted. Where the underlying circumstances materially change — such as termination of employment — fresh consent is required for continued processing, particularly where such processing amounts to commercial exploitation.

 

Obiter Dicta

The judgment underscores the evolving recognition of personal data as an economic and proprietary interest capable of commercial exploitation. Organizations must treat consent as dynamic and purpose-bound rather than static.

 

Significance

This decision reinforces the principle that:

• Consent under data protection law is purpose-specific and time-sensitive.
• Post-employment use of personal data may constitute unlawful processing absent renewed consent.
• The ODPC has authority to award compensatory damages for data breaches.

The case is instructive for employers, data controllers, and legal practitioners on the scope of lawful processing and the risks associated with continued use of personal data beyond the original contractual framework.