What Every Employer Must Know About Former Employee Image Rights Under Kenya's Data Protection Act

What Every Employer Must Know About Former Employee Image Rights

You cannot continue using a former employee’s photograph to promote your business after they have left. You cannot profit from their likeness for free simply because they said “yes” while they were on your payroll. And you certainly cannot argue that their failure to withdraw consent amounts to ongoing permission to use their image for commercial gain.

That is exactly what Moja Expressway Company was accused of doing in ODPC Complaint No. 0264 of 2024, a decision upheld by the High Court in Moja Expressway Company v Ndung’u [2025] KEHC 16790 (KLR).

Cyrus Mwaniki Ndung’u worked as a salesperson for Moja Expressway from July 2022 until his resignation on 17th November 2022. During his employment, he participated in promotional videos explaining the company’s Electronic Toll Collection system. He gave oral consent for the use of his image in these materials.

Nearly a year after he left, on 5th October 2023, Ndung’u discovered that Moja Expressway was still using his image on its social media platforms to promote its services. He had never signed a consent form. He had never been asked for fresh permission after resigning. And he was receiving absolutely nothing while the company continued to profit from his face.

When he complained, Moja Expressway argued that Ndung’u had given oral consent during employment, that he had not withdrawn it upon resignation, and that the employment contract formed a lawful basis for continued processing. They also claimed the video was “operational” rather than commercial.

The Office of the Data Protection Commissioner examined the complaint and held that Moja Expressway had violated Ndung’u’s rights under the Data Protection Act. The company appealed to the High Court. Justice W. Musyoka dismissed the appeal, affirming the Data Commissioner’s decision.

The High Court held that once the employment relationship terminated, the basis for using Ndung’u’s data was lost. Fresh consent was required. Continued use without consent constituted unlawful processing and unjust enrichment.

Here is why this matters for every employer, HR professional, and marketing manager:

1. Employment-based consent expires upon termination.

The High Court stated: “The data had been captured within the context of employment, and once the employment relationship terminated, which had been the basis for the use of the data, there was need to obtain a fresh consent, for the continued exploitation of the data, and the use of that material, without the fresh consent, amounted to a violation.”

The purpose of processing Ndung’u’s image was tied to his employment. When he left, the purpose changed. The company was no longer using his image as part of his job duties; they were using it to promote their business without compensating him. That is a different purpose, requiring fresh consent.

2. Oral consent is not enough.

Moja Expressway argued that Ndung’u had given oral consent. The ODPC rejected this. Consent under Section 2 of the Act must be express, unequivocal, free, specific, and informed. It must be given by a clear affirmative action and must be capable of proof. The company could not produce any signed consent form. They could not produce any record of Ndung’u’s agreement. Verbal consent, without more, is insufficient, especially after the employment relationship has ended.

3. A terminated employment contract cannot form a lawful basis for processing.

Moja Expressway argued that the employment contract formed a lawful basis for processing Ndung’u’s personal data, even after termination. The ODPC rejected this argument. A terminated contract cannot form a basis for any necessity for the processing of a former employee’s personal data. The lawful basis for processing during employment is tied to the employment relationship itself. When that relationship ends, the lawful basis ends with it.

4. Commercial exploitation without remuneration is unjust.

The High Court found that the compensation award was justified because there was commercial exploitation of Ndung’u’s image after he stopped working. The court’s reasoning was clear: during employment, the exploitation would have been remunerated by salary or commission as part of the employment terms. After termination, Ndung’u was not being remunerated for the continued exploitation of his data for commercial purposes. He was being exploited for free. That is unjust.

5. Compensation covers intangible harms.

Moja Expressway argued that Ndung’u had not pleaded nor proved damage or loss. The court rejected this, citing established case law: “In cases of violation of personal data, the injury or loss is neither physical nor financial... The award made, in compensation, would cover feelings of upset, frustration, worry, anxiety, mental distress, fear, guilt, anguish, humiliation, unhappiness, stress, depression, etc., which are not capable of objective proof or measurement in monetary terms.”

6. The burden of proof rests with the data controller.

Section 32 of the Act places the burden on the data controller to demonstrate that valid consent was obtained. Moja Expressway failed to discharge this burden. They could not produce any evidence that Ndung’u had been adequately informed or that he had taken any affirmative action to indicate his agreement to continued use after resignation.

**7. Retention policies do not justify commercial use. ** Moja Expressway argued that its data retention schedule required retaining employee records for six years. However, the retention of records for administrative purposes is different from the continued use of images for commercial purposes. An employer cannot hide behind a retention policy to justify continued commercial exploitation of a former employee’s image.

**8. “Operational” does not mean “non-commercial.” ** Moja Expressway claimed the video was “operational” rather than commercial. The ODPC was not persuaded. The video was used to promote the company’s Electronic Toll Collection system. It was designed to attract customers. That is commercial use, regardless of whether the company calls it “operational.”

Moja Expressway was ordered to pay Ndung’u KES 500,000 in compensation. The High Court dismissed the company’s appeal and awarded costs to the respondent.

What You Need to Do

If you run a business, manage a marketing team, or oversee HR, this determination is worth reading carefully because it draws a line that many people may not know exists.

i. Review your employment contracts. Ensure they contain clear provisions on the use of employee images for promotional purposes. Be specific about how images will be used and for what purposes.

ii. Obtain documented, written consent. Do not rely on oral consent. Use consent forms that are specific, informed, and purpose-limited. Keep records of consent obtained.

iii. Obtain fresh consent upon termination. If you wish to continue using a former employee’s image for commercial purposes, obtain fresh consent specifically addressing post-employment use. Do not assume that consent given during employment continues indefinitely.

iv. Provide consideration for image rights. If the employee is giving up rights they would not otherwise have to give up, provide separate, identifiable compensation—a signing bonus, a specific payment, or additional remuneration—for that right. A conscionable contract with real consideration prevents the employee from later claiming injustice.

v. Implement technical and organisational measures. Maintain an inventory of all employee images used for promotional purposes. Track when consent was obtained, what it covered, and when it expires. Set up automated alerts when employment terminates or when consent is about to expire. Conduct regular audits of promotional materials.

vi. Distinguish between retention and commercial use. Retaining employee records for administrative purposes is permitted. Using images for commercial purposes after employment ends requires fresh consent. These liabilities are real. Your employment contracts, consent forms, and data protection practices must anticipate them or they may devour your business. Review your contracts and data protection practices with me to scan for compliance, consent frameworks, indemnity and risk allocation.

By: Benson Odiwuor

Advocate of The High Court of Kenya

Should you have any questions regarding the subject, reach out at insights@bensonodiwuor.com