Casa Vera Lounge Fined KES 1.8 Million for Violating Customer’s Data Privacy

The office of the Data Commissioner has fined popular city restaurant, Casa Vera Lounge Sh1,850,000 for using a reveller’s image without consent.

According to the Data Commissioner, the popular club based along Ngong Road shared the reveler’s image on its social media pages.

The Commissioner said the heavy penalty will ensure that going forward, social joints will seek consent before using customer’s photos.

“The establishment was fined Sh1,850,000 for posting a reveller’s image on their social media platform without the Data Subject’s consent. This penalty seeks to ensure that other lounges, clubs seek consent from their customers prior to posting,” the Data Commissioner said.

The Commission did not give any further details on the nature of the image and when it was shared on the club’s social media.

ADVERTISEMENT

Casa Vera Lounge is among three organisations penalised for using images without consent.

The Commissioner said two other companies are under probe for the same offenses.

The Star spoke to a manager from the facility who said he could not say much on the particular that the Data Commissioner was referencing.

He, however, said that there is always a disclaimer at the restaurant’s entrance alerting people that images and videos taken inside can be used by the club.

“At the entrance, we have a disclaimer that all images and videos taken inside the club can be used for commercial purposes… I cannot comment any further than that,” the manager said.

According to the Office of the Data Commissioner, the penalty notices have been issued pursuant to Sections 62 and 63 of the Data Protection Act, 2019 (Act) and Regulation 20 and 21 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

Data Commissioner Immaculate Kassait urged entities to comply with the Data Protection Act by implementing data protection principles and safeguards.

She also called upon data controllers and Data Processors to ensure that the processing of personal data is in accordance with the provision of the Act.

“Failure to comply with the Act will result in instituting enforcement procedures,” Kassait said.

—Courtesy of the Star