Cera Imani forced to pay man 50,000/- by Office of the Data Protection Commissioner (ODPC)

The Office of the Data Protection Commissioner (ODPC) has ordered digital entrepreneur Waithera Imani — popularly known as Cera Imani and trading as ESHE Community — to pay KSh50,000 in compensation for unlawfully using a man’s personal data in promotional social media content without valid consent.

Use of Personal Data in Promotional Video

In a determination obtained by BRK, the Data Commissioner found that Ian Itolondo Mutoro’s full name and photograph were featured in a promotional video shared on Instagram and TikTok to market the ESHE platform.

The complainant argued that he had not authorised the use of his image or personal details for advertising purposes. He further stated that the publication caused him distress.

Defence and Regulatory Findings

In her defence, Cera Imani maintained that the complainant had previously consented to be featured on the ESHE platform as a medical professional seeking visibility. She also argued that he was aware of the promotional material before it was published and that some of his professional information was already publicly accessible.

However, the ODPC determined that there was no documentary evidence demonstrating that the complainant had given express, informed, and specific consent for his name and image to be used in commercial social media advertisements.

The regulator emphasised that under the Data Protection Act, consent must be clear, purpose-specific, and verifiable. It further noted that being listed on a digital platform does not automatically amount to consent for separate marketing or advertising campaigns.

Compensation and Compliance Order

The Commissioner concluded that the use of the complainant’s personal data for promotional purposes without explicit consent constituted unlawful processing under the Act.

While acknowledging the Respondent’s arguments, the ODPC held that the failure to prove valid consent was sufficient to establish liability.

As a result, Cera Imani has been ordered to:

• Pay KSh50,000 in compensation to the complainant

• Remove his personal data from all social media platforms within 14 days

• Provide proof of compliance to the regulator

The ruling underscores the regulator’s continued enforcement of Kenya’s data protection laws and serves as a reminder that digital platforms and content creators must obtain clear, documented consent before using personal data for commercial promotion.