In today’s digital marketplace, images travel faster than contracts. A photograph taken at an event, a clip from a TikTok video, or a smiling face on a brand poster can reach thousands, sometimes millions, in seconds. Yet, behind every image or video used commercially lies an important legal and ethical question: was consent obtained?
Your image is personal data
Under Kenya’s Data Protection Act, 2019 (DPA), personal data is defined as any information that can identify a natural person, directly or indirectly. That includes photographs, videos, and any visual likeness capable of distinguishing one person from another. When an image or video of someone is used for commercial gain, say, in advertising, influencer marketing, or brand endorsements, that act constitutes processing personal data.
This means the principles of data protection apply fully: lawfulness, fairness, transparency, purpose limitation, and data minimization. In simpler terms, no one should use your image to make money or promote a product without your clear, informed consent.
Consent: the cornerstone of legality
Consent is one of the strongest grounds for processing personal data under the DPA. For consent to be valid, it must be freely given, specific, informed, and unambiguous. A casual handshake or a verbal “it’s fine” at a photoshoot doesn’t suffice. The individual must understand how their image will be used, for what purpose, by whom, and for how long.
If a company intends to post your picture on a billboard or use your video testimonial on social media, you should have signed a release form or given written consent that clearly states:
- The scope of use (e.g., online, print, television).
- The duration of use.
- Whether the image will be shared with third parties or partners.
- The right to withdraw consent at any time.
Without this, any commercial use could amount to unlawful processing and expose the organization to penalties or reputational damage.
Children and vulnerable persons: extra care required
When the image involves a child, the law becomes even stricter. The DPA requires explicit consent from a parent or guardian before a child’s image can be processed. Schools, NGOs, and brands that feature minors in promotional content must therefore obtain and keep clear records of such consent. Ethical use of children’s images also demands caution in context, avoiding any portrayal that could exploit, endanger, or misrepresent them.
The cost of getting it wrong
Unauthorized commercial use of someone’s image can trigger multiple liabilities. The affected person may file a complaint with the Office of the Data Protection Commissioner (ODPC) or even pursue civil remedies for infringement of privacy or personality rights.
Beyond legal exposure, there is the cost of public backlash. In a time when digital consumers are increasingly privacy conscious, one misused image can erode public trust faster than any marketing campaign can rebuild it.
Best practices for businesses and creators
- Obtain written consent: always use a signed consent or image release form before publishing any person’s likeness.
- Be transparent: explain how the image will be used, where it will appear, and for how long.
- Respect withdrawal of consent: if a person changes their mind, stop using their image immediately.
- Limit use: don’t repurpose images beyond what was agreed (e.g., don’t turn an event photo into a billboard ad).
- Secure storage: treat images and videos like any other sensitive data, protect them from unauthorized access or leaks.
A culture of respect and accountability
At its core, data protection is about respect: respecting people’s autonomy over their personal information, including their image and likeness. For businesses, it’s an opportunity to demonstrate accountability and integrity in brand communication. For individuals, it’s empowerment: the right to decide how your identity is used in the public space.
As Kenya’s digital economy continues to expand, one thing remains constant: consent is not a courtesy; it’s a legal requirement. Whether behind the camera or in front of it, everyone plays a role in protecting privacy.
