Two schools have been sanctioned for unlawfully disclosing children’s personal data to third parties without the express consent of their parents or guardians, providing an important lesson for institutions in the education sector that routinely handle sensitive information about minors.
The Office of the Data Protection Commissioner (ODPC) found that Nova Pioneer, a private international school, and Friends School Kaveye Girls High School, a public secondary school, to have breached Kenya’s data protection laws by sharing students’ personal information without appropriate legal grounds.
Nova Pioneer was accused by a parent (name withheld to protect the minor) of sharing the child’s personal information with other parents, a travel agency and the United States Embassy, all without her express permission.
The school had used the agency to write a letter of introduction to the US Embassy, listing the names of students selected to take part in the World Scholars Debate Competition in the US, in order to help secure visas.
The information shared included the child’s name, gender, passport number, date of birth and nationality. The parent said they had not consented to the processing or sharing of this personal data, but the school went ahead.
The parent claimed that disclosing the child’s details to other parents and third parties exposed the minor to identity fraud and caused emotional distress to both the child and the family.
Nova Pioneer’s Athi River branch, where the student was enrolled, was unable to provide prove that the parent had given consent for the processing of the child’s data. As a result, the ODPC ruled against the school.
“The respondent failed to provide proof of having obtained parental consent to process the minor’s personal data,” said Data Commissioner Immaculate Kassait in the ruling.
“Therefore, the respondent unlawfully processed the minor’s personal data as it did not demonstrate that it had a lawful basis to share the minor’s personal data with third parties.”
The ODPC ordered Nova Pioneer to pay Sh500,000 to the parent as compensation for the unlawful handling of the child’s data. The office noted that “personal data belonging to minors requires special protection due to their vulnerability.”
This is not the first time Nova Pioneer has been sanctioned by the ODPC. Last year, the school was fined Sh950,000 for using a minor’s image on two commercial billboards without obtaining parental consent.
Filming a minor
The second case involved Friends School Kaveye Girls High School, which did not receive a financial penalty but was served with an enforcement notice ordering it to cease the unlawful processing of children’s data.
In this case, the school’s deputy head teacher reportedly filmed a student while being punished and later shared the video on social media, where it went viral. The guardian of the student said they had not consented to the filming or the sharing of the video.
The school argued that the recording was made as internal documentation to show the school principal and the parent teachers association that disciplinary measures had been properly administered.
It also claimed that it did not deliberately publish or facilitate the publication of the video online and had made efforts to have it removed from social media.
ODPC investigations revealed that although the guardian had technically consented to filming by signing the school’s rules at the time of admission, the school had failed to notify the guardian when the video was being taken, in breach of the principle of transparency under data protection law.
This omission led to the issuance of an enforcement notice, though no monetary fine was imposed.
