Moja Expressway Company, the firm that operates the 27-kilometre Nairobi Expressway, has been ordered to pay a former employee Sh500,000 for using his image to promote the use of electronic toll collection (ETC) without his consent.
The Office of the Data Protection Commissioner ruled that the company used Mr Cyrus Mwaniki Ndung’u’s image, explaining to customers how to subscribe and install the ETC and on-board unit (OBU) for use of the toll road, without his permission.
Data Commissioner Immaculate Kassait noted that the company posted the video containing Mr Ndung’u’s image for commercial use.
“In this regard, this office finds that the respondent did not seek consent from the complainant to further process his personal data after he resigned from employment,” Ms Kassait said.
Mr Ndung’u sued the company accusing it of continued use of his image for commercial purposes almost one year after he left the organisation.
He submitted that the use of his image to promote the usage of ETC was unlawful.
He filed the complaint with the Data Commissioner on February 16, 2024, stating that the company made it appear that he was still working for Moja Expressway.
He said he had served the company with a demand notice on December 7, 2023, but the company ignored his letter at first, only to delete the video from its social media platforms three days later.
The company said Mr Ndung’u was working as a toll attendant in their sales team from July 5, 2022, to November 28, 2022, when he resigned.
The firm said it did not require his consent to process his personal data as they relied on the employee contract, which they had obtained lawfully.
As part of the sales team, the company said, his job entailed explaining to customers how to subscribe to ETC and upon request, he voluntarily chose to make the video.
The firm said it was he who agreed to make the video and was required to sign a consent form and return it. He never returned the consent, despite giving permission verbally.
On limitation of retention of personal data, pursuant to Section 39 of the Data Protection Act, the company stated that it has developed a robust data retention schedule for employees in which they retain data for purposes of employees, and unless there is a hold of employee records for court cases, they retain employees’ record for six years.
The commissioner stated that although it obtained consent while he was still an employee of the company, Moja Expressway did not obtain further consent to publish the video containing his image.
Ms Kassait said verbal consent must be corroborated by other evidence especially because he had already resigned from his employment.
“The principles of personal data under Section 25 (c) of the Act provide that every data controller or data processor shall ensure that personal data is collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes,” she said.
The 27km elevated road cuts across Mlolongo, through Mombasa Road, the upper side of Nairobi Central Business District atop Uhuru Highway, up to Westlands to end at James Gichuru Road.
The road was launched in October 2020 as part of the government’s ambitious plans to reduce heavy traffic on Mombasa Road, which usually starts from Mlolongo to the city centre.
Nairobi Expressway was privately-funded and Moja Expressway— a subsidiary of China Road and Bridge Construction (CRBC) will operate it for 27 years to recover its money before ceding the road to the State.
