The Office of the Data Protection Commissioner (ODPC) has ordered Nova Pioneer School–Athi River to pay sh500,000 in compensation to a parent after unlawfully sharing her child’s personal data without consent, in violation of Kenya’s Data Protection Act, 2019.
In a decision delivered on Friday, May 3, the ODPC found the school guilty of breaching key provisions of the Act by disclosing sensitive information including the child’s name, gender, passport number, date of birth, and nationality to a tour company, Bluepath Safaris, and the U.S. Embassy without obtaining verified parental consent.
The data was reportedly shared as part of preparations for a school-sponsored trip to the United States for the World Scholars Cup debate competition, despite the parent having explicitly opted out and declined to sign any consent forms.
The complainant said the disclosure caused her significant emotional distress.
Nova Pioneer defended its actions, claiming it acted in good faith and used a Google Form to obtain parental approvals.
However, the ODPC found inconsistencies in this account, noting that the school failed to produce any signed consent from the complainant and had, in fact, documented the parent’s refusal to participate.
The Data Commissioner ruled that the school violated Section 25 of the Data Protection Act, which requires personal data to be processed lawfully, fairly, and transparently.
Additionally, it breached Section 33(1)(a), which prohibits processing a child’s personal data without verified parental consent.
“The burden of proof rests with the data controller to demonstrate that valid consent was obtained,” the ruling stated. “In this case, the school did not meet that threshold.”
The Ksh500,000 awarded to the complainant covers both financial and non-financial damages, including emotional harm, under Section 65 of the Act and Regulation 14(3)(e) of the Complaints Handling and Enforcement Regulations. Both parties have 30 days to appeal the decision in the High Court.
Second School Found In Violation
In a separate case, Friends School Keveye Girls was found to have violated the Data Protection Act after filming and sharing a video of a minor being punished, without the guardian’s consent.
According to the ODPC, the school’s Deputy Principal recorded a student who was under disciplinary action smashing a mobile phone with a hammer in front of her peers.
The video was shared internally and later went viral on social media platforms.
Although the school claimed the footage was for administrative purposes and denied posting it online, the ODPC ruled that there was no evidence of informed consent for recording or sharing the video, even within internal circles.
The guardian was neither informed nor granted permission for the act.
The ODPC cited breaches of Sections 25 and 29 of the Act, which require data processing to be lawful, transparent, and purpose-specific.
It also rejected the school’s defense that the student’s guardian had signed general school rules, saying this did not amount to informed consent for the recording or dissemination of personal data.
“Minors remain protected data subjects, and any processing of their personal data including video recordings requires heightened legal safeguards,” the Commissioner emphasized.
As a result, Friends School Keveye Girls has been issued with an enforcement notice, requiring the institution to take corrective measures and ensure compliance with the Data Protection Act.
These rulings underscore the ODPC’s commitment to upholding children’s rights and enforcing responsible data handling practices, particularly within educational institutions.
New Details Emerge As BBC Distances Itself From Arrested Filmmakers Linked To ‘Blood Parliament’
