INTRODUCTION
The Personal Data Protection Commission (the Commission), as established under the Personal Data Protection Act, Cap. 44, has on 19 August 2025 delivered its ruling on Protection of Child’s Personal Data in Nyangoma Mwesingwa (Suing as a Next Friend of CAG (Minor) Versus Cecilia Maliganya, Complaint No. PDPC/CMP/002/2025. In its ruling, the PDPC had found the Respondent liable for unlawfully posting and commercialising the image of the newborn child on Instagram without the child’s parents’ consent.
BACKGROUND OF THE CASE
On 25 December 2024, the Complainant discovered a photograph of her newborn child, posted on Cecilia Maliganya’s Instagram account. The post, which included a commercial caption, “Tupunguze zawadi za pampers na vitenge, it is a baby girl.” had gone viral, garnering significant engagement across the platform that is with over 1,114 shares, 857 likes, and 32 comments.
Subsequently, the Complainant attempted to contact the Respondent multiple times, requesting the deletion of the photograph, but her requests were ignored.
During the hearing, the Respondent claimed that she is involved in the sale of children’s products, pregnant women, and breastfeeding mothers.
She also claimed she does not personally know the Complainant. She just came across the photograph of a child on a social media platform. She admitted that upon seeing the image, she liked it and proceeded to repost it on her own Instagram account with the caption “Tupunguze zawadi za pampers na vitenge, it is a baby girl.”
The Complainant raised issues related to the violation of the Personal Data Protection Act (the Act), particularly concerning the unlawful processing of sensitive personal data without consent.
The Commission was tasked with determining whether the Complainant’s actions constituted a breach of the PDPA, including whether the Commission had jurisdiction to address the matter.
RULING/DECISION OF THE COMMISSION
Definition of Personal Data:
The Commission began by defining the meaning of Personal Data. The ruling observed that Section 3 of the Personal Data Protection Act, Cap. 44 defines Personal Data as “personal information,” meaning information about an identifiable person that is stored in any form, including any identification number, mark, or other unique feature that identifies an individual.
A photograph qualifies as one of these identifying marks or forms. Therefore, using pictures or videos without the consent of the person to whom they belong constitutes a violation of the Act.
The Commission also went ahead also to define Sensitive Personal Data including, genetic data, data related to children, and data concerning offences or financial transactions of the individual. In this context, the image of the Complainant’s child falls under sensitive personal data.
The Commission thus held that the Respondent unlawfully processed Sensitive Personal Data by using the child’s image without obtaining the required consent from the Parent (Complainant) is contrary to Regulation 18(2) (b) of the Personal Data Protection (Personal Data Collection and Processing) Regulations GN. No. 449C of 2023.
The Commission noted that, Regulation 18(2)(b) and (c) of Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 provides that “Where the data subject is a child, the data controller or data processor shall ensure that the child’s personal data relating to commercial advertisements shall be collected and processed in accordance with the provisions of the Act and these Regulations; and the Parent or guardian is informed of the risks of processing and protection in place”
The Commission also found that the Respondent’s refusal to remove the images, despite repeated requests, demonstrates a willful disregard for the Complainant’s rights and for the protective framework established under the Personal Data Protection Act, Cap. 44 (PDPA), which amounts to a violation of the fundamental data protection principles outlined in Section 5(a), (b), and (c), which require all data processing to be lawful, fair, transparent and limited to a specific purpose
Commercial Exploitation:
The Commission further ruled that the posting of the child’s photograph amounted to commercial exploitation, given that the Respondent’s Instagram account served as a business platform.
The Commission noted that the Respondent’s conduct demonstrates a deliberate and conscious misuse of the minor’s images to boost her business profile, increase followers, and drive user engagement.
This not only constitutes a violation of the provisions of the PDPA but also infringes upon the child’s rights to dignity, privacy, and protection as enshrined under Article 16 of the Constitution of the United Republic of Tanzania, which mandates the safeguarding of every person’s privacy.
The Commission observed that, according to Section 37(1) of the Act, a data subject who suffers damage by reason of any contravention of any of the requirements of this Act by a data controller or data processor shall be entitled to compensation from the data controller or data processor for that damage.
Jurisdiction of the Commission
The ruling noted that the Commission has the mandate to hear and determine all matters related to individual privacy. The Ruling noted that the Act provides for 4 principles for personal data protection and establishes a minimum requirement for the collection and processing of the personal data i.e.
- to establish minimum requirements for the collection and processing of personal data;
- to provide for the establishment of the Personal Data Protection Commission that oversees the implementation of the Act;
- to provide for the improvement of the protection of personal data processed by public and private bodies; and
- to provide for matters connected therewith.
Compensation
The Commission cited Section 37 and 50 of the PDPA in awarding the compensation to the Complainant. The Commission noted that the Applicant is entitled to compensation for substantial or non-material harm arising after the illegal processing of personal data.
In determining the appropriate penalty, the Commission took into account that the image of the child, CAG, had already been posted on social media by another party. However, the Commission placed greater emphasis on the Respondent’s failure to comply with the Complainant’s request to remove the image.
This refusal constitutes a breach of Regulation 17(1)(d) of the Personal Data Protection (Personal Data Collection and Processing) Regulations 2023 which upholds the data subject’s right to request the deletion of their personal data. In that regard, the Commission ordered the following:
- The Respondent to pay the Complainant a total of TZS 20,000,000/= as general damages.
- The Respondent to pay a fine of TZS 5,000,000/= to the Personal Data Protection Commission for the violation of provisions of the Personal Data Protection Act, and
- The Respondent was instructed to delete all the photos of the child’s images from her Instagram account and any other media platforms within 14 days.
CONCLUSION
The ruling by the PDPC underscores the importance of consent in the processing of personal data, particularly concerning minors. The Commission’s decision highlights the legal framework established by the PDPA to protect individuals’ rights to privacy and the unauthorized use of personal information. This case also serves as a critical reminder for individuals and businesses about the responsibilities associated with handling sensitive personal data, reinforcing the need for compliance with Personal Data Protection Laws in Tanzania.
It is also important to note that, according to Regulation 24 of the Personal Data Protection (Complaints Settlement and Procedures) Regulations, 2023 (Government Notice No. 449B of 2023), the award of the Commission is enforceable as the order of the High Court.
