You Cannot Use Someone's Name on Your Website Without Their Consent
2 August 2026
You cannot take the name of a professional who has never worked for you and publish it on your website as though they are part of your team. You cannot use their professional titles and accolades to prop up your licence application without their knowledge. And you certainly cannot claim it was all just an "unintentional error" by your web developer and expect that to absolve you of liability.
That is exactly what Brainstorm Insurance Brokers Limited was accused of doing in ODPC Complaint No. 1500 of 2025.
Arthur, John and Maurice were professionals working with Nile Capital Insurance Brokers. Despite having no association with another company called Brainstorm Insurance Brokers, their names, professional titles & hard-earned accolades were displayed on Brainstormโs website and used in a licence application to regulators. Brainstorm presented itself as them. It falsely created the impression that these professionals were part of their organisation. The three sued.
The Office of the Data Protection Commissioner examined the complaint and held that Brainstorm had violated the Complainants' rights under the Data Protection Act (DPA).
Brainstorm argued that the publication was due to an unintentional error by their web developer, who incorrectly uploaded the names and professional details during a routine update. They stated that upon becoming aware, they took corrective action and removed the information.
But the law does not recognise an โunintentional errorโ as a defence. Brainstorm failed to establish a lawful basis for processing the Complainants' personal data under Section 30 of the Data Protection Act.
And perhaps most importantly, Brainstorm failed to implement the technical and organisational measures required under Section 41 of the DPA. The fact that a web developer could mistakenly upload a draft containing third-party professional details before it had been finalised demonstrates a systemic failure. There were no safeguards to limit processing to necessary purposes. There were no controls to prevent unauthorised use. There was no identification or mitigation of foreseeable risks.
Brainstorm was ordered to pay the Complainants ๐๐๐ 1,012,500 in compensation, ๐๐๐ 337,500 to ๐๐๐๐ก of the three professionals whose names and reputations were used without permission. If you run a business, manage a website or oversee marketing, this determination is worth reading carefully because it draws a line that many people may not know exists.
These liabilities are real. Your contracts must anticipate them or they may devour your business. You should always review your contracts to scan data compliance, indemnity and risk allocation.
By: - Benson Odiwuor
Advocate of The High Court of Kenya
Should you have any questions regarding the subject, reach out at insights@bensonodiwuor.com