Goodtimes Africa, the company behind the popular Blankets & Wine festival, has been ordered to pay a woman Sh300,000 after the Office of the Data Protection Commissioner (ODPC) found that it unlawfully used her image in promotional materials without proper consent.
The ruling marks a major moment in Kenya’s growing enforcement of privacy and personal data laws, especially around the commercial use of photographs and likenesses by brands, event organisers, and entertainment companies.
According to the decision dated April 8, 2026, the ODPC determined that Goodtimes Africa violated the woman’s rights under the Data Protection Act, 2019, after using her photo to market Blankets & Wine events.
The commissioner ruled that the company failed to obtain explicit, informed, and specific consent before using the image for commercial purposes.
The complainant moved to the Data Commissioner after discovering that her photograph had been used in advertisements linked to Blankets & Wine.
She argued that she had never agreed to have her image featured in promotional campaigns and that the use of her likeness caused distress.
Her complaint centered on the fact that while she may have attended a public event, that did not automatically grant organisers permission to turn her image into marketing material.
The ODPC agreed with that argument, stating that attending an event does not erase a person’s rights over how their personal data, including photos, is collected, processed, and published for profit.
Goodtimes Africa defended itself by arguing that attendees accepted general terms and conditions linked to the event, which they said covered photography and promotional use.
However, the Data Commissioner rejected that defence.
The ruling found that broad or generic clauses in event terms do not amount to specific consent for the commercial use of someone’s image. The commissioner emphasized that consent must be clear, informed, and tied to the exact purpose for which the image will be used.
That meant the organisers could not rely on standard event conditions to justify placing the woman’s face in advertisements.
The ODPC ordered Goodtimes Africa to compensate the complainant with Sh300,000 for the unlawful use of her likeness and the emotional distress caused by the incident.
The ruling also gives both parties 30 days to challenge the decision in the High Court if they wish to appeal.
Kenya’s Data Protection Act, 2019, regulates how organisations collect, store, and use personal data. Personal data includes names, identification numbers, contact information, and photographs that can identify a person.
Under the law, organisations must obtain lawful grounds before processing such data. In many cases involving commercial advertising, clear consent is the safest legal basis.
The Act also requires that consent be voluntary, specific, informed, and unambiguous. Silence, vague notices, or hidden clauses often fail to meet that threshold.
This means companies can no longer assume that taking photos at events automatically gives them unlimited rights to use those images in campaigns, posters, websites, or social media ads.
As Kenya’s privacy regime matures, more complaints involving unauthorized photography, online posting, and image exploitation are expected.
