Law Commentaries

ODPC Cracks Down: Solar Panda Kenya Fined Kshs. 500,000 for Data Privacy Violation

In a landmark ruling, the Office of the Data Protection Commissioner (ODPC) has ordered Solar Panda Kenya Ltd to pay Kshs. 500,000 for breaching Kenya’s Data Protection Act, 2019. The case, Lawrence M’impwi Kirima v. Solar Panda Company Kenya Ltd, centered on the unauthorized use of a former employee’s image for commercial marketing, underscoring the ODPC’s growing enforcement muscle.

This decision is a stark reminder for businesses to prioritize data protection compliance. Here are five critical takeaways:

1.     Consent is Non-Negotiable

Under Kenyan law, using personal data, such as an individual’s image, for commercial purposes without explicit consent is illegal. Past employment does not grant automatic rights to use personal data.

2.     Businesses Bear the Burden of Proof

The Data Protection Act requires companies to provide verifiable evidence of valid consent. Assumptions won’t hold up in court, and failure to prove consent can lead to costly penalties.

3.     Clear Agreements Are Essential

Contracts with employees and customers must:

  • Specify how personal data, including photos, will be used.
  • Include updated consent clauses aligned with data protection laws.
  • Be regularly reviewed to meet evolving legal standards.

4.     Non-Compliance Hits Hard

The Kshs. 500,000 fine highlights the financial and reputational risks of ignoring data protection laws. With the ODPC ramping up enforcement, businesses must act swiftly to avoid similar consequences.

5.     Proactive Compliance is Key

To stay compliant, businesses should:

  • Audit data collection, storage, and usage policies.
  • Implement robust consent mechanisms.
  • Train staff on data protection obligations.
  • Consult legal experts to ensure adherence to the Data Protection Act.

Act Now to Protect Your Business
Kenya’s data protection landscape is evolving rapidly. Don’t let non-compliance expose your organization to lawsuits, fines, or reputational harm. Contact our experienced legal team today for a comprehensive data protection audit and tailored compliance solutions.

Adapted from: Lilian M.