- First decision of its kind in Tanzania
- Children’s images qualify as sensitive personal data under the PDP
- Commercial use without parental consent amounts to unlawful processing
- Refusal to delete photo breaches right to erasure
- PDPC affirms its jurisdiction over children’s data protection complaints
- Respondent fined and ordered to pay damages
On 19 August 2025, the Personal Data Protection Commission (the Commission), established under the Personal Data Protection Act, Cap. 44 (PDPA), delivered its ruling in Complaint No. PDPC/CMP/002/2025. The Commission found the Respondent liable for unlawfully posting and commercially exploiting the photograph of a newborn child on Instagram without parental consent.
Background of the Case
On 25 December 2024, the Complainant found a photo of her newborn child posted on the Respondent’s Instagram business page with the caption “Tupunguze zawadi za pampers na vitenge, it is a baby girl.” The image went viral with over 1,100 shares. Despite repeated requests from the Complainant and her relatives, the Respondent refused to delete the photo, insisting she was free to use it.
Ruling of the Commission
The Commission held that the child’s photograph constitutes sensitive personal data under the PDPA. And processing such data without parental consent is unlawful. Posting the image on a business Instagram account amounted to commercial exploitation, and the refusal to remove it violated the data subject’s right to erasure under Regulation 17 of the Personal Data Protection (Personal Data Collection and Processing) Regulations.
The Commission in affirming its jurisdiction to enforce the protection of personal data further emphasised that children’s data is afforded special protection. Referring to Article 16 of the Constitution, which guarantees the right to privacy, and Regulation 18, which governs the use of children’s personal data in commercial advertisements, it was held that parental consent is mandatory before such images are published for business purposes.
The Respondent was ordered to pay TZS 20 million in general damages to the Complainant, a TZS 5 million fine payable to the Commission, and to delete all the child’s photos from Instagram and other media within 14 days.
This ruling serves as a reminder to ensure compliance with the PDPA by registering with the Data Protection Commissioner. It also underscores that personal data, including photographs, cannot be collected, processed, or used without the explicit consent of the data subject. Furthermore, it serves as a warning to individuals and entities that use or disseminate personal data online without registration and/or consent, that such practices are unlawful and may result in legal consequences.
To read the ruling, click here
For further information and updates please contact FB Attorneys, the LEX Africa member in Tanzania, on info@fbattorneys.co.tz or visit www.fbattorneys.co.tz.
