It is against this backdrop that we explore the issues around the processing of personal data of ex-employees, drawing insights from the recent decision by the Office of the Data Protection Commissioner (ODPC) in Cyrus Mwaniki Ndungu (Complainant) v Moja Expressway Company (Respondent) (ODPC Complaint Number 0264 of 2024) (the Expressway case). 

Background

In the Expressway case, the complainant lodged a complaint with the ODPC alleging that almost a year after his resignation, the respondent posted a promotional video on social media depicting him engaging in the delivery of the respondent’s services to its customers as an employee. He argued that this amounted to commercial usage of his personal data (his image) without his consent.

In reply, the respondent stated that the video was of an operational rather than commercial nature and that it had been created with the complainant’s verbal consent during his employment. The respondent argued that the employment contract (being in force when the video was created) formed a lawful basis for the processing of the complainant’s personal data.

Main issues for determination

In determining the Expressway case, the ODPC considered whether the respondent had any legal grounds that justified its post-employment processing of the complainant’s personal data in this case. It noted the following key matters:

• fresh consent must always be obtained whenever personal data is processed for any purpose that is not compatible with the purpose for which it was collected;
• the respondent’s post-employment use of the complainant’s personal data amounted to a new purpose that was separate and incompatible with the initial purpose for which the complainant’s personal data had been collected;
• where consent is relied upon for using an employee’s personal data (particularly after their departure from employment), then it is the controller’s obligation to ensure that the consent:
  • is corroborated by further evidence (such as a signed record of the consent) if it was given orally; and
  • sought afresh upon the resignation of the employee where the consent relates to the use of the personal data for commercial purposes.

The ODPC also observed that a terminated contract of employment cannot form a basis for any necessity for the processing of a former employee’s personal data.

The ODPC’s finding

After analysing the facts, the ODPC found that the respondent had infringed the complainant’s rights under the Data Protection Act in processing his personal data without valid consent from him and went on to award the complainant compensation in the sum of KES 500,000 (approximately USD 4,000).

Key takeaway: Deemed change of purpose

The ODPC offered an interesting take on the purpose limitation principle of data protection. This principle (which is alluded to above) requires data controllers to ensure that personal data is collected for explicit, specified and legitimate purposes and not further processed in any manner that incompatible with such purposes.

From its decision, it appears that the ODPC deemed the purpose of the processing or collection of the complainant’s personal data to be the promotion of the respondent’s business but only during the complainant’s tenure of employment. As such, even though the ultimate aim of attracting customers remained the same when the respondent processed the claimant’s personal data following his departure from employment, the change in the circumstances in which this aim was sought was deemed:

to result in a degree of change of purpose for the processing that yielded a new and incompatible purpose; and

to have consequently triggered a requirement for fresh consent.

The point to note here is that any post-employment commercial use of employee related personal data must be carried out only after fresh consent has been secured from that ex-employee, even where the aim sought to be achieved through use of that personal data has not changed. In other words, the circumstances in which any processing is carried out can be relevant in determining the deemed purpose for such processing.

In view of this decision, and given the practical and logistical challenges that securing this post employment consent could present, it may be advisable:

• to ensure that an employee’s consent to the processing of their personal data for commercial purposes is obtained in non-transient forms and with suitable wording that covers the entire duration of any intended commercial use; or
• out of an abundance of caution to consider limiting the use of employee personal data or images:
• for commercial purposes at all times; and/or
• for any other purposes generally after their departure from employment, save where it is reasonably necessary or expressly permitted or required under the law.