When an employee leaves, what rights does an employer retain over photographs and other personal information collected during employment?
For former Java House steward Gidraf Gatira, the question became a legal battle after he discovered his photograph and name on an online recruitment platform months after leaving the company.
Mr Gatira sued the restaurant chain for Sh10 million, arguing that the continued use of his image without his consent violated his privacy, dignity, and publicity rights.
However, the High Court struck out the petition filed in March 2022, ruling that the complaint should first have been taken to the Office of the Data Protection Commissioner.
“The Petitioner has not demonstrated that he has exhausted the remedies provided under the Data Protection Act, or that the statutory mechanism is ineffective or inadequate,” the court said, declining the petitioner's call “to establish clear constitutional standards for employees’ privacy and publicity rights.”
The dispute began with a workplace photograph taken while Mr Gatira was employed as a steward at Java House, a job he held from January 2015 until his summary dismissal in July 2021.
In December that year, months after leaving the company, Mr Gatira discovered that a photograph of him wearing Java House-branded clothing during his employment was being used on Shortlist, an online recruitment platform.
He said a friend alerted him about the photograph and, upon checking, found his image and name published globally.
Mr Gatira demanded compensation, but Java House rejected liability. He filed a constitutional petition dated March 21, 2022, seeking declarations that his rights had been breached, damages and costs.
His lawyers sought Sh10 million in damages, arguing that employment did not surrender his privacy and image rights. They argued that Java using his image to represent staff on an online portal constituted a marketing benefit.
Java House, through its legal and compliance officer, Daisy Ogola, said the photographs were taken with Mr Gatira’s knowledge and voluntary consent during employment.
It relied on a clause in his employment contract document, saying he assigned intellectual-property rights in works made for hire across media platforms and waived moral rights.
The company said the image appeared on Shortlist only as a staff profile, not advertising.
It added that the petitioner was dismissed after a disciplinary hearing concerning allegations of theft and lack of integrity.
Java House also said it responded to Mr Gatira's demand letter denying liability. It nevertheless removed his photograph from Shortlist after receiving his complaint.
The company maintained that the image was used solely as a profile image to provide an accurate representation of on-duty staff, rather than for commercial marketing or monetary gain.
Mr Gatira argued that Java House had confused ownership of copyright with his separate privacy and publicity rights. He said any waiver or assignment required supporting paperwork, which Java House had not produced to the court itself.
Rejecting allegations that his petition was a vindictive retaliation for his termination from employment, the petitioner maintained that the suit was a legitimate pursuit of justice regarding constitutional privacy violations.
The High Court did not decide which side was right on the photograph. Justice Roseline Aburili instead struck out the petition after finding that Mr Gatira should first have taken his complaint to the Office of the Data Protection Commissioner.
“The Petitioner’s complaint falls under the Data Protection Act, No. 24 of 2019,” Justice Aburili said in the judgment delivered virtually in Nairobi on August 18.
The court said the Act empowers the Commissioner to investigate complaints, facilitate resolution and impose administrative fines. Mr Gatira had not filed a complaint with the Commissioner or shown that the statutory remedies were ineffective.
“Simply presenting an image rights claim as a constitutional issue does not give this court automatic jurisdiction,” Justice Aburili said, adding, “the Petitioner is at liberty to invoke the provisions of the Data Protection Act for redress.”
