Nairobi Hotel Ordered to Pay Groom Ksh 750K After Using Wedding Photos Without Consent!
A newlywed couple’s big day has turned into a major legal victory after the Office of the Data Protection Commissioner (ODPC) ruled that a Nairobi hotel unlawfully used images and videos captured during their wedding for commercial promotion—without their consent.
Richard Wafula, the complainant, held his wedding at Hotel Tobriana, a popular venue known for hosting social events. However, what should have remained a joyous memory soon escalated into a legal dispute when the hotel began using the couple’s wedding photos and videos in branded advertisements and social media campaigns—without notifying or obtaining permission from the couple.
According to the determination issued by the ODPC, Wafula lodged a complaint on 25th October 2024 after the hotel ignored a demand letter requesting the removal of the content. The ODPC found Hotel Tobriana in violation of Kenya’s Data Protection Act, 2019, specifically breaching the right to privacy protected under Article 31(c) and (d) of the Constitution of Kenya.
What the Law Says
Kenya’s Data Protection Act, enacted in 2019, strengthens individuals’ rights over their personal data. This includes images and videos in which a person can be identified.
The ODPC emphasized that any organization collecting and using personal data must do so lawfully and with explicit consent from the data subject. In this case, the hotel obtained images and videos during the wedding and later used them in promotional materials without the couple’s prior authorization.
The Data Protection Commissioner noted that personal data must only be processed under one of the lawful bases listed in the Act—including informed consent, which Hotel Tobriana failed to secure.
The ODPC’s Final Orders
After reviewing the case and establishing that Wafula’s privacy rights had been violated, the Data Commissioner issued the following orders:
- Hotel Tobriana must delete all images and videos of Wafula, his wife, and their guests from its social media platforms—including Facebook and Instagram—within 14 days.
- The hotel is ordered to compensate Wafula with Ksh 750,000 for misuse of personal data and violation of privacy.
- An enforcement notice will be issued to ensure compliance.
- Either party has 30 days to appeal the decision before the High Court of Kenya.
The directive was signed on 22nd January 2025 by Immaculate Kassait, MBS, the Data Commissioner.
A Big Win for Privacy Rights in Kenya
This ruling marks another crucial milestone in Kenya’s growing enforcement of data protection laws. In recent years, the ODPC has been actively addressing cases where companies misuse personal data, especially for marketing purposes.
Legal experts say the determination sends a clear message: businesses must respect privacy or pay the price. Photos taken during private events remain the property of the individuals featured in them—unless they formally consent to commercial use.
Privacy advocates have applauded Wafula for challenging the misuse, saying his determination will empower other Kenyans to speak up when their personal data is exploited without permission.
Hotels and Event Venues Put on Notice
Many event venues and photographers often use clients’ images to market their services online. However, this case now serves as a strong reminder that consent is not optional—it is a legal requirement.
Before sharing any client’s images, especially of intimate events like weddings, businesses must:
✔ Request consent in writing
✔ Disclose where and how the content will be used
✔ Allow clients to withdraw consent at any time
Failure to follow these steps could lead to costly penalties—just as Hotel Tobriana has now experienced.
Wafula’s Response
While Wafula has not publicly commented on the ruling, it is clear that taking legal action has protected not just his personal privacy but that of his wife and all their wedding guests whose images were shared without permission.
The case highlights the growing awareness among Kenyans of their digital rights—and their willingness to defend them through legal channels.
As enforcement of data protection laws intensifies in Kenya, companies nationwide are expected to tighten their data handling practices or face hefty consequences.
