Kenyan School Ordered to Pay Ksh500K Compensation for Sharing Child’s Data

The Office of the Data Protection Commissioner (ODPC) has ordered a school to pay Ksh500,000 to a complainant whose child’s personal data was unlawfully processed and shared without consent.

In a determination, the Data Commissioner ruled that the respondent, the Nova Pioneer School-Athi River, violated key principles of data protection enshrined in the Data Protection Act, 2019.

The case revolved around the collection and use of a minor’s data without lawful justification or verified parental consent.

It came after the complainant, a parent, alleged that the school issued a letter containing her child’s data to Bluepath Safaris and the United States Embassy without obtaining her prior consent.

The complaint, filed on October 21, 2024, claimed that Nova Pioneer shared details including the child’s name, gender, passport number, date of birth, and nationality as part of the documentation for a school-sponsored trip to the US for the World Scholars Cup debate competition.

16 students were involved, and letters were distributed to parents and third-party entities for visa processing.

The parent said she had expressly declined participation in the trip and did not sign any consent forms.

Despite this, her child’s personal information was included in documents presented to both the tour company and the US Embassy, causing her significant emotional distress.

Also Read: NCBA to Pay Client Ksh 250K Compensation for Sending His Data to Wrong Email

Nova Pioneer School issues defense

Nova Pioneer maintained that it acted in good faith and that the data sharing was part of its commitment to providing growth opportunities for students.

The school argued that a Google Form consent process had been used to obtain approval from parents for data sharing.

They also submitted documentation, including a Service Delivery Agreement with the tour company, their internal data privacy policy, and the student trip guidelines.

However, ODPC found inconsistencies in this defense. While the school presented a blank sample of the consent form, it failed to provide any signed version from the complainant.

Furthermore, records submitted by Nova Pioneer showed that the parent had actually opted out of the trip altogether.

The Data Commissioner ruled that Nova Pioneer failed to comply with the principles of data protection as outlined in Section 25 of the Data Protection Act, which demands that data be processed lawfully, fairly, and transparently.

The school was also found to have breached Section 33(1)(a), which prohibits the processing of a child’s personal data without verified parental consent.

ODPC orders Ksh500 K compensation

The judgment emphasized that the burden of proof lies with the data controller—in this case, the school—to demonstrate that consent was obtained. Nova Pioneer was unable to meet this threshold.

Moreover, the Data Commissioner found that the school had no lawful justification under Section 30(1)(b) of the Act for sharing the minor’s data without consent.

The claim that the child’s information was not shared with the tour company was undermined by the school’s admission that letters with students’ personal data were issued to parents and presented to the Embassy.

“Personal data belonging to minors requires special protection due to their vulnerability and should always advance the rights and best interests of the child,” the ruling stated.

Also Read: Zuku to Pay Ex-Client Ksh500K Compensation for Sending Him Promotional Messages

As a result of these findings, the Data Commissioner awarded the complainant Ksh500,000 in compensation.

The amount covers both financial and non-financial losses, including the emotional distress suffered due to the privacy breach.

The ruling was made under Section 65 of the Data Protection Act and Regulation 14(3)(e) of the Complaints Handling and Enforcement Regulations.

“The Office hereby orders the Respondent to pay the Complainant Kenya Shillings five hundred thousand (KES. 500,000) as compensation for the unlawful processing of the Minor’s personal data.”

Both parties have the right to appeal the decision in the High Court within 30 days.

Friends School Keveye found guilty

ODPC also found Friends School Keveye Girls in violation of the Data Protection Act, 2019, after it recorded and disseminated a video of a minor without the guardian’s consent.

According to the ruling, the school’s Deputy Principal had filmed the student—then under punishment—destroying a mobile phone using a hammer in front of peers and staff.

The video was later shared with the principal and the Parents Teachers Association (PTA), before it surfaced on various social media platforms, where it went viral.

While Friends School Kiveye claimed the video was recorded for administrative purposes and was never officially published online, ODPC found that no evidence was provided to show the guardian had been informed or had consented to the recording and internal sharing of the footage.

The ODPC ruled that the school had violated key principles of data protection, including transparency, purpose limitation, and lawful processing, as required under Sections 25 and 29 of the Act.

Additionally, the Data Commissioner emphasized that despite the school’s internal disciplinary policies, minors remain protected data subjects whose personal data—including video images—must be processed with heightened sensitivity and lawful justification.

ODPC’s investigation revealed that although the school cited a signed copy of rules and regulations by the guardian and student, this did not equate to informed consent for recording or sharing personal data.

The office concluded that the school failed in its duty to uphold the child’s right to privacy.

“Given this Office’s finding that the Respondent failed to fulfill its obligations as a data controller and processor in the processing of the minor’s personal data, and having in mind the circumstances of the complaint, it is determined that the most appropriate remedy in this case is the issuance of an enforcement notice to the Respondent,” the ruling reads.

Follow our WhatsApp Channel and X Account for real-time news updates