The Office of the Data Protection Commissioner (ODPC) has ordered an employer to pay a former employee Ksh500,000 after finding the company continued to display his photograph on its website and social media for commercial purposes after his contract ended.

The ODPC concluded the continued use violated Section 37 of the Data Protection Act, which requires explicit consent for commercial use of personal data unless a legal exemption applies.

The former employee reported that his image appeared in marketing material promoting VIP protection services, despite his departure from the firm, and that he had not given permission for such use.

The employer acknowledged the photograph remained on its site, describing it as an oversight, and said it had suspended the website in December 2024 after a complaint about former staff images.

How employee photographs are handled under Kenyan law

When employees join a company, they often submit a passport‑size photograph for ID cards, staff records, security or other administrative purposes, as noted by the regulator.

The Data Protection Act mandates that personal data be retained only as long as reasonably necessary for its original purpose, and the Data Protection (General) Regulations require organisations to erase, delete, anonymise or pseudonymise data once that purpose lapses.

Implications for employers and next steps

The ruling highlights the need for companies to review their data retention policies, obtain explicit consent for any commercial use of employee images, and promptly remove such data when employment ends.

Employers are advised to implement procedures for deleting or anonymising photographs after staff departures to avoid similar penalties from the ODPC.