Content creator Cera Imani, whose official name is Waithera Imani, has been ordered to pay Sh50,000 in compensation following a ruling by the Office of the Data Protection Commissioner (ODPC) over a violation of Kenya’s data protection laws.
The decision, issued by the ODPC, found that the influencer unlawfully processed and published personal data belonging to a complainant without obtaining proper consent, contrary to the provisions of the Data Protection Act.
According to publicly available details of the determination, the complaint was lodged by Ian Itolondo Mutoro, who argued that Cera Imani had posted a video on her social media platforms, including TikTok and Instagram, that contained his name and image without his knowledge or permission.
The complainant maintained that his personal data had been processed and shared publicly without lawful justification or consent. Under Kenya’s Data Protection Act, personal data includes information that can identify an individual, such as names, photographs, and other identifiable details.
The ODPC reviewed the complaint and the content in question before making its determination.
In its ruling, the Office of the Data Protection Commissioner concluded that Cera Imani did not demonstrate that she had obtained consent from the complainant before posting the material online.
The regulator further found that there was no other lawful basis presented to justify the processing and publication of the individual’s personal data.
As a result, the ODPC directed the influencer to pay Sh50,000 to the complainant as compensation for the violation of his data protection rights.
The ruling reinforces the legal requirement that individuals and organisations must have a lawful basis — including consent — before processing or publishing another person’s personal data.
The Data Protection Act, 2019 establishes a legal framework for the collection, processing, storage and sharing of personal data in Kenya.
It applies to both corporate entities and private individuals who process personal information.
The law requires data controllers and processors to: Obtain informed consent from data subjects before collecting or publishing personal data, ensure personal data is processed lawfully and transparently, and protect the rights and freedoms of individuals whose data is being handled.
The ODPC has consistently stated in previous communications that consent must be clear, specific and demonstrable.
Where consent cannot be proven, individuals who publish personal data risk regulatory action.
The Sh50,000 compensation order issued against Cera Imani is payable directly to the complainant.
The ODPC did not indicate any additional administrative fines in the publicly reported details of the case.
Compensation awards under the Data Protection Act are intended to remedy harm resulting from unlawful processing of personal data.
The amount varies depending on the circumstances of each case and the extent of the violation.