Imagine this: You’re enjoying a night out at a popular lounge in Dar es Salaam. A photographer snaps a picture of you mid-laugh, mid-dance, mid-conversation. A few days later, that image is used on the lounge’s Instagram and WhatsApp Status to promote their vibe—without your knowledge, let alone your consent.

This isn’t just a scenario; similar facts are in the recent Kenyan case of Perpetual Wanjiku v. Casa Vera Lounge (Complaint No. 0607 of 2023). This case helps us answer the key question: Is a Data Processing Disclaimer Sufficient when it comes to personal data?

In the case, the lounge argued among other things that a privacy notice was posted at the entrance and that the complainant posed for the photo, implying consent. The Kenya Data Protection Office rejected these arguments.

The Position in Tanzania according to the Personal Data Protection Act (PDPA):

1.A Disclaimer Alone Is Not Enough

Section 25 of the PDPA requires that personal data must be processed lawfully, fairly, and transparently. A generic notice at the door is not sufficient. Privacy notices must be clear, visible, and specific about the purpose of data collection—especially when the data is to be used for commercial gain, such as marketing.

2.Consent Must Be Explicit, Informed, and Documented

Under Section 30 of the PDPA, consent cannot be implied by conduct, such as smiling or posing. Consent must be freely given, specific to the purpose, informed and unambiguous.

3.Photographs Are Personal Data

Section 3 of the PDPA defines “personal data” to means data about an identifiable person that is recorded in any form, including images and video recordings. Using someone’s likeness without their consent—especially for advertising—is a violation of the PDPA and the constitutional right to privacy under Article 16 of the Constitution of the United Republic of Tanzania.

Right to prevent processing of personal data for direct marketing purposes
Section 35 of the PDPA gives a data subject the right to prevent anyone from using his/her personal date for direct marketing, including any form of advertising or for pecuniary benefits unless otherwise agreed.

  Lessons for Tanzanian Businesses

1. A Data Processing Disclaimer is not a Get-Out-of-Jail-Free Card; businesses should not rely on small, hidden notices at the entrance.
2. Images are personal data. A business should treat it’s customer’s photos and videos with the same level of seriousness as names, phone numbers or financial records.
3. Privacy notices must be prominent, accessible, and clearly state how data will be used.
4. Consent must be procured before using a customer’s image especially in advertisements or marketing. Such consent must be explicit, informed as to the purpose of the intended use and ideally in writing or via digital acknowledgment, procured before publishing identifiable images.