Why Event "Terms & Conditions" Are Not Valid Consent for Commercial Image Use in Kenya

You cannot take a photograph of someone who attended your event and use it to promote your next event. You cannot repurpose their image as free advertising for your commercial gain without asking them first. And you certainly cannot hide behind a clause in your event terms and conditions and call that consent.

That is exactly what Goodtimes Africa, trading as Blankets & Wine, was accused of doing in ODPC Complaint No. 2175 of 2025.

Antonate Rombo Aiko attended the “Blankets and Wine Tupatane OnjaOnja Summer Events 2025.” She was a paying attendee, there to enjoy the experience. Her image was used by the organisers in advertisements for the event, without her knowledge, without her permission, and without any lawful basis.

When she complained, Goodtimes Africa argued that her consent was obtained through the terms and conditions shared with attendees. They claimed that the alleged infringement was not subsisting and that they had not used her image for any improper commercial purpose beyond what was contemplated in those terms.

The Office of the Data Protection Commissioner examined the complaint and held that Goodtimes Africa had used the Complainant’s image for commercial purposes within the meaning of Section 37(1)(a) of the Data Protection Act, as read with Regulation 14 of the Data Protection (General) Regulations, 2021. Promotional material designed to attract attendance at a revenue-generating event is commercial use. Full stop.

The ODPC then examined whether express consent had been obtained. They found that it had not.

Here is why this matters for every event organiser, brand manager, and marketer:

1. Commercial use triggers the requirement for express consent.

Section 37(1)(a) of the Act provides that a person shall not use personal data for commercial purposes unless such person has sought and obtained the express consent of the data subject. Regulation 14(1) of the General Regulations defines commercial use as including using data to advance commercial or economic interests, including inducing a person to buy, subscribe to, or otherwise obtain products, services, or information. The Respondent’s use of Aiko’s image in promotional material for a revenue-generating event fell squarely within this definition.

2. A general clause in event terms and conditions does not constitute consent.

The Respondent argued that consent was obtained through the terms and conditions shared with attendees. The ODPC rejected this. Consent under Section 2 of the Act must be express, unequivocal, free, specific, and informed. It must be given by a clear affirmative action. A buried clause in event terms and conditions that attendees may not have read, understood, or actively agreed to does not meet this standard.

3. The data subject must be specifically informed.

There was no evidence that Aiko was informed that her image would be used in promotional materials. There was no evidence that she was told how her image would be used, for how long, or for what specific purposes. The law requires that consent be purpose-specific. A general clause that does not explicitly state that images may be used for commercial advertising cannot constitute informed consent.

4. Consent requires a clear affirmative action.

There was no evidence that Aiko took any action to signify agreement to the use of her image for commercial purposes. Simply attending an event does not constitute affirmative action. Simply being present in a venue does not constitute consent. The law requires a deliberate, unambiguous indication of agreement.

5. The burden of proof rests with the data controller.

Section 32 of the Act places the burden on the data controller or processor to demonstrate that valid consent was obtained. Goodtimes Africa failed to discharge this burden. They could not produce any evidence that Aiko had been adequately informed or that she had taken any affirmative action to indicate her agreement.

6. “Legitimate interest” does not apply to commercial use.

Goodtimes Africa attempted to argue that the use of the image was not improper. The ODPC was not persuaded. Where personal data is used for commercial purposes, the lawful basis must be express consent. You cannot rely on legitimate interest, contractual necessity, or any other basis when the processing is for commercial gain.

7. Administrative convenience is not a defence.

Goodtimes Africa’s argument that the infringement was not subsisting did not absolve them of liability. The fact that they may have stopped using the image does not undo the unlawful processing that had already occurred. The law requires that processing be lawful from the outset.

The Outcome

Goodtimes Africa was ordered to pay the Complainant KES 300,000 in compensation.

What You Need to Do

If you run an event, manage a brand, or handle marketing in any capacity, this determination is worth reading carefully because it draws a line that many people may not know exists.

Review your event terms and conditions. Ensure they explicitly state that images may be used for promotional purposes. But more importantly, ensure that you obtain separate, specific, informed consent from attendees before using their images for commercial advertising. Do not rely on buried clauses. Do not assume attendance equals consent. Do not treat people’s images as free advertising.

Implement clear consent mechanisms. Use photography consent forms. Allow attendees to opt in or opt out. Keep records of consent obtained. Train your marketing teams on data protection obligations.

These liabilities are real. Your contracts and consent processes must anticipate them or they may devour your business. Review your data protection practices with me to scan for compliance, consent frameworks, and risk allocation.

By: Benson Odiwuor

Advocate of The High Court of Kenya

Should you have any questions regarding the subject, reach out at insights@bensonodiwuor.com