NAIROBI, Kenya, Aug 20 – Sacred Heart Mukumu Girls’ School has been ordered to pay Sh300,000 for unlawfully sharing a student’s photo with third parties without parental consent.
The Office of the Data Protection Commissioner (ODPC) also recommended the prosecution of the school’s Board of Management (BoM) for obstructing its investigations into the privacy breach.
In its ruling, the ODPC found that the school breached Section 33(1)(a) of the Data Protection Act by processing and sharing the minor’s personal data without consent from her parent or legal guardian.
“The Board of Management of Sacred Heart Mukumu Girls’ School was found liable for privacy violations and ordered to pay KES 300,000 in compensation to the Complainants,” the ODPC announced in a statement.
“The Data Commissioner formally recommended the criminal prosecution of the school’s Board of Management under Section 61 of the Act for obstructing the Data Commissioner’s investigations.”
The school had collected the student’s photograph in 2020 for administrative and admission purposes but later shared it with external media in 2023 without parental consent, violating purpose limitation, fairness and transparency requirements under Section 25 of the Act.
The complaint followed a 2023 Saturday Nation publication featuring the student after a severe water and food contamination crisis at the school.
The complaint alleged that the publication incorrectly implied that the student had died, despite her being alive and having been discharged from hospital. NMG published a correction and apology the following day.
However, the ODPC cleared Nation Media Group (NMG) and the journalist of data protection infringement, citing jurisdictional limitations under Sections 51(2)(b) and 52(1)(b) of the Data Protection Act.
The Commissioner also considered NMG’s correction and apology issued within 24 hours and the public-interest nature of the story.
