Bonventure & Associate Advocate

27/04/2026

Your Name, Your Photo, Your Results: Can a School or Company Use Them for Ads Without Asking?

Have you ever seen your photo or personal information used in an ad without permission? You’re not alone. Know your rights – and don’t be afraid to speak up.

Imagine flipping through a newspaper and seeing your child’s name and exam scores printed inside an advertisement – without your permission. Or walking past a shop and spotting your own face on a flyer, promoting a product you never agreed to endorse.

Sounds shocking, right? But these things actually happened in Kenya.

Two recent rulings by the Office of the Data Protection Commissioner (ODPC) have made it clear: your personal information is not free advertising material. Let’s break down what happened, what the law says, and how you can protect yourself.

Case 1: A School Uses a Student’s Results in a Newspaper Ad

In Complaint Number 1597 of 2025, a parent complained that Nairobi Academy had published their child’s name and examination results in a newspaper’s advertisement section. The school was using the student’s success to promote itself – without asking the parents first.

The ruling: The Data Protection Commissioner found that the school had unlawfully processed a minor’s personal information for commercial purposes. Because the school didn’t get consent from the parents, it broke the law.

Case 2: A Solar Company Uses Someone’s Photo on a Flyer

In another case (Complaint No. 1618 of 2024), a person discovered that a solar power company had put their image on marketing flyers – again, without permission. The company couldn’t prove that they had obtained the person’s consent.

The ruling: The company violated the law. Consent must be express, freely given, and informed – a silent nod or a lack of objection doesn’t count.

What Is “Private Data” Anyway?

In everyday language, private data is any information that can identify you. That includes:

Your name
Phone number
Email address
National ID number
Photographs
Location data
There’s also sensitive personal data – things like health records, fingerprints, and bank details. These get even stronger protection.

Under Kenyan law, your private data is protected by the Constitution, the Data Protection Act (2019), and related regulations.

When Can a Business Use Your Data for Advertising?

The law is very clear. A company or school can only use your personal information for commercial purposes (like advertising or marketing) if ALL of these are true:

You gave clear consent – not a hidden checkbox or a mumbled “I guess so”.
You were told upfront that your data would be used for marketing.
You have an easy way to opt out – and you haven’t opted out.
Your data is anonymised if possible (so people can’t tell it’s you).
If a business uses your name, photo, or results in an ad without following these rules? That’s unlawful processing – and you can complain.

Know Your Rights

Under Section 27 of the Data Protection Act, you have the right to:

Know how your data is being used.
Access any personal data a company holds about you.
Object to them using your data for marketing.
Correct false or misleading information.
Delete data that is wrong or no longer needed.
And remember: the burden of proof is on the business, not you. If a company claims you gave consent, they have to prove it – not the other way around.

Why This Matters to You

We live in a digital age. Schools, shops, banks, and even small businesses collect your data every day. Most of them mean well. But some see your personal information as a free asset to boost their sales.

That’s not okay.

The recent ODPC rulings send a strong message:

Your name, your child’s exam results, and your photo belong to you – not to any advertiser.

If a business uses them for commercial gain without your permission, they are breaking the law. And you can seek justice.

What You Can Do to Protect Yourself

Read consent forms carefully. Don’t just tick “I agree” without knowing what you’re agreeing to.
Ask questions. If a school or company asks to use your or your child’s image, ask: “For what purpose? For how long? Can I say no later?”
Keep records. Save screenshots, emails, or copies of ads that use your data without permission.
Complain. If you believe your data has been misused, file a complaint with the Office of the Data Protection Commissioner (ODPC). It’s free and you can do it online.
Spread the word. Share this article with other parents, friends, and colleagues. Many people don’t know they have these rights.
The Bottom Line

Personal data is not a public resource. It is part of your identity, your family’s privacy, and your dignity.

Whether it’s a school printing your child’s results in a newspaper, or a company sticking your face on a flyer – they must ask first. And you have the right to say No.

Kenya’s Data Protection Commissioner has shown that they are ready to enforce these rights. Now it’s up to us to know them, use them, and expect better from the organisations we trust.

Let us summarize together;

✅ A school cannot publish your child’s name and results in an ad without parental consent.

✅ A business cannot use your photo on a flyer unless you clearly agreed.

✅ Consent must be freely given, informed, and proven by the business.

✅ You have the right to object, access, correct, and delete your data.

✅ You can complain to the ODPC – and you might win compensation.

16/04/2026

_*Can Your Boss Read Your WhatsApp Messages on a Work Laptop?*_ *
A Kenyan Court Just Gave the Answer
Have you ever wondered if your boss is reading your work chats? Share this article with a colleague – knowledge is the best privacy tool.
You’re sitting at your desk, typing a quick WhatsApp message to a colleague about the weekend. Maybe it’s harmless. Maybe it’s a complaint about your boss. Either way, you’re on a work laptop – so can your employer see what you wrote?
A recent Kenyan court case gives a clear (and surprising) answer.
The case – Musa & another v Makini Schools Limited – has become a landmark decision about workplace privacy. It asks a question we all want answered: Where do we draw the line between company monitoring and personal privacy?
Let’s break down what happened, what the court said, and what it means for you – whether you’re an employee or an employer.
________________________________________
The Story: 18 Years of Service, Then Dismissed Over WhatsApp Chats
Mr. Musa worked for Makini Schools Limited for 18 years. He was also a union representative (a shop steward). In 2022, the school accused him of serious misconduct – including sharing confidential information with a blogger.
The main evidence? Private WhatsApp conversations that were found on his company issued laptop.
Musa was fired before his appeal was even heard. He and his union took the case to court, arguing that the school had violated his right to privacy.
________________________________________
What the Court Decided
The Employment and Labour Relations Court had two big questions to answer.
1. Did the school violate Musa’s privacy by reading his WhatsApp messages?
The court said: No.
Why? Because the messages were not stored on Musa’s personal phone. They were on the company’s laptop. The court explained that privacy is protected under Kenya’s Constitution, but it’s not an absolute right – especially when it clashes with an employer’s right to protect its property and interests.
In plain language: If you use a work device for personal chats, you can’t expect the same privacy as on your own phone.
2. Was the firing process fair?
The court said: No – this part was a problem.
Even though the school could access the WhatsApp messages, they didn’t follow proper procedure before firing Musa. He wasn’t given enough notice or a real chance to defend himself. The court ruled that the termination was unlawful because the process was unfair.
So the school won on the privacy question but lost on fairness.
________________________________________
What This Means for Employees (That’s You)
Here are three hard truths from this case – written in plain language.
1. A work laptop is NOT a private space
Think of your company laptop like a shared notebook. Don’t type, save, or discuss anything you wouldn’t want your boss – or a judge – to read.
Lesson: Assume your employer can see everything you do on their device. Yes, even your WhatsApp web.
2. WhatsApp isn’t as secret as you think
Yes, WhatsApp has end to end encryption. But that encryption doesn’t help you if the messages are sitting open on a work laptop that belongs to your employer.
Lesson: Don’t complain about your boss or share company gossip on any platform if you’re using a work device.
3. Being a union rep doesn’t protect you from the rules
Musa was a union leader. The court made it clear: that role doesn’t give you a free pass. You can still be held accountable for what you do on work property.
Lesson: You can stand up for workers’ rights – but you also have to follow workplace policies like everyone else.
________________________________________
What This Means for Employers
This case isn’t just a warning for employees. Employers also learned something important.
The court said: Yes, you can monitor work devices. But you must do it fairly.
Here’s what every employer should do:
• Create clear policies – Tell employees exactly what monitoring happens and on which devices.
• Communicate those rules – Don’t hide them in a 50 page handbook. Make sure everyone understands.
• Respect privacy where possible – Just because you can look doesn’t mean you should snoop without reason.
• Always follow fair procedure – Even if you find evidence of misconduct, you still need to give the employee a chance to respond before firing them.
________________________________________
The Bottom Line: Trust, Not Surveillance
In the end, the Musa case reminds us that the modern workplace is a digital space – but it’s still a human space.
Employers may hold the keys to the company laptop, but that doesn’t mean they should turn every keystroke into a courtroom exhibit. And employees should remember: a work device is a tool, not a diary.
If you’re using a company laptop or phone, act like your boss could read everything. Because now, a Kenyan court has confirmed – they probably can.
________________________________________
Your Quick Takeaways
✅ Your work laptop is not private – the company owns it and can monitor it.
✅ WhatsApp on a work device can be used as evidence – encryption doesn’t protect you there.
✅ Employers must still follow fair process – spying is allowed, but firing without a hearing is not.
✅ Union reps aren’t above the rules – advocacy and accountability go together.

BONVENTURE OTIENO
BONVENTURE & ASSOCIATE ADVOCATES
0701431084

fans.

14/04/2026

*CJ’s Restaurant Ordered to Pay* Customer for Sending Unwanted Texts – What You Need
to Know
Have you ever received unwanted texts from a business in Kenya? You’re not alone – and now
you know exactly what to do about it.
Imagine you’re enjoying a quiet evening, then your phone buzzes with a promotional message
from a restaurant you visited once. Then another. And another. Annoying, right? But in Kenya,
that might be more than just a nuisance – it could be a violation of your privacy rights.
That’s exactly what happened to a customer of CJ’s Restaurant – and the outcome made
headlines.
In a landmark ruling, the Office of the Data Protection Commissioner ordered CJ’s to
compensate a customer for sending three unsolicited marketing messages without proper
consent. Let’s break down what happened, why it matters, and how it affects you.
Three Texts That Cost a Restaurant
Between 15th and 25th September 2025, CJ’s Restaurant sent three promotional SMS
messages to a customer. The messages advertised free delivery services – something many
businesses do every day.
But there was a problem: the customer hadn’t agreed to receive those texts.
After getting the messages, the customer emailed CJ’s to point out the breach and ask for an
explanation. The restaurant apologised and even offered a Kshs 10,000 dining voucher as a goodwill gesture. They argued that the messages were sent “in good faith” as part of a
customer outreach campaign.
However, the Data Protection Commissioner saw things differently.
The Ruling: Why CJ’s Got Into Trouble
The Commissioner ruled that CJ’s had no legal basis to process the customer’s phone number.
In simple terms:
Consent was missing. Kenyan law requires that businesses get your free, clear, and
unambiguous permission before using your personal data for marketing.
• No opt-out option. The promotional texts didn’t give the customer an easy way to say
“stop sending me these messages.”
• Transparency failure. The restaurant didn’t handle the customer’s data in a fair or
lawful way.
As a result, CJ’s was ordered to pay compensation to the customer. The exact amount wasn’t
specified in the document, but the message is clear: businesses cannot treat your phone
number as free advertising real estate.
What Does Kenyan Law Say About Your Private Data?
You might be surprised to learn that Kenya has strong privacy protections. Your right to
privacy is rooted in Article 31 of the Constitution – and it covers more than just your home or
letters. It includes digital privacy too.
The main law is the Data Protection Act (2019). Here’s what it means for you, in plain
language:
• Consent is king. A business cannot collect or use your phone number, email, or other
personal details without your permission. “We thought you wouldn’t mind” is not a
valid excuse.
• Purpose matters. They can only use your data for the specific reason they collected it.
If you gave your number to book a table, they can’t later use it for weekly pizza deals
unless you agree.
• Opt-out must be easy. Every marketing message should include a clear way to
unsubscribe – like “Reply STOP” or a link to opt out.
• You stay in control. Even after you share your data, you have the right to ask how it’s
being used and to demand that it’s deleted.
Why This Case Matters for Every Kenyan
This ruling isn’t just about one restaurant. It sends a strong signal to all businesses – big or
small – that data protection isn’t a suggestion. It’s the law.
For you as a customer, it means:
• You can say no to unwanted marketing texts, emails, or calls.
• You can complain if a business ignores your privacy.
• You may be entitled to compensation if your data is misused.
The Data Protection Commissioner now has real power to enforce these rules. Businesses that
treat your personal information carelessly can face fines, compensation orders, and
reputational damage – just like CJ’s Restaurant.
What You Can Do If You Receive Unwanted Marketing
Feeling empowered? Here’s a simple checklist:
1. Don’t just delete the message – save it as evidence (screenshot works).
2. Ask the business to stop – send a polite but firm email or text requesting they remove
your number.
3. Look for an opt-out link – many legitimate messages include one.
4. File a complaint – if they ignore you or continue, report them to the Office of the Data
Protection Commissioner (ODPC). You can do this online.
5. Seek compensation – if you suffered any harm (like stress, wasted time, or financial
loss), you can claim damages.
Final Takeaway: Your Phone Number Belongs to You
The CJ’s Restaurant case is a wake-up call. Sending unsolicited marketing messages might feel
like harmless advertising, but under Kenyan law, it can be a data breach.
For businesses, the lesson is simple: always get consent, always offer an opt-out, and always
respect customer privacy.
For you, the message is even simpler: *You have rights. Use them.*

14/04/2026

06/03/2026

It started with one Facebook message when James reached out to me for an internship position in August 2023 which I wanted to ignore as many are always application from jokers.

He had cleared his LLB undergraduate course in 2018 but couldn't manage to join Kenya School of Law. Further, he was living in a construction site during the day and at night as a watchman at the same site in Kasarani.

We incorporated him into our firm as an intern and he showed his capabilities by working diligently despite the challenges he had which convinced us at / Bonventure & Associate Advocate to take a chance and pay for his school fees at the Kenya School of Law.

In January 2024, I organised a fund raising to assist in paying the fees which failed incredibly leading to me going into my personal saving. I had to clear the fees, ensured he was working in the morning and going for classes in the afternoon for the entire year.

Today, we are proud to have James admitted into the Bar as an Advocate of athe High Court of Kenya and looking forward to what God has for him in his Life. Congratulations 🎊 👏 💐 Wakili James.

25/11/2025

Congratulations to our newest Advocate Cherono. Proud of you and welcome to the Bar.