Nova Pioneer Fined Ksh 500,000 for Unlawful Sharing of Student’s Personal Data

Nova Pioneer has been ordered to pay Ksh 500,000 in compensation after the Office of the Data Protection Commissioner (ODPC) ruled that the private international school unlawfully shared a minor’s personal information with third parties without obtaining proper parental consent.

The case, which was decided in January 2025, involved Nova Pioneer’s Athi River branch sharing a student’s sensitive personal data—including name, gender, passport number, date of birth, and nationality—with other parents, a travel agency, and the United States Embassy without the parent’s express permission.

The complaint was filed in October 2024 by a parent acting on behalf of their child who had been selected to participate in the World Scholars Cup Debate Competition at Yale University.

According to ODPC documents, the school forwarded the student’s information to Bluepath Safaris Limited (the tour company) and the US Embassy to facilitate visa applications, but failed to secure proper consent beforehand.

“The respondent unlawfully processed the minor’s personal data as it did not demonstrate that it had a lawful basis to share the minor’s personal data with third parties,” stated Data Commissioner Immaculate Kassait in her ruling.

Second Offense for Nova Pioneer

This marks the second time Nova Pioneer has been sanctioned by the ODPC for data protection violations.

Last year, the school was fined Ksh 950,000 for using a minor’s image on commercial billboards without parental consent.

The most recent case highlights growing concerns about how educational institutions handle sensitive information about children.

The ODPC emphasized in its determination that “personal data belonging to minors requires special protection due to their vulnerability.”

School Claims Consent Was Obtained

Nova Pioneer defended its actions by claiming it had issued consent forms to parents through Google Forms, which included language explicitly permitting data sharing for the international trip.

The school maintained that parents had voluntarily signed these forms “with full knowledge of the terms, evidencing their agreement to the data processing requirements.”

The school also stated that some parents exercised their right to opt out of arrangements with the tour company, suggesting that such options were available to all parents, including the complainant.

However, the ODPC found that Nova Pioneer could not provide proof that the specific complainant had signed any consent form before sharing the child’s data.

Emotional Distress Cited

The parent alleged that the disclosure of their child’s details to other parents and third parties exposed the minor to potential identity fraud and caused emotional distress to both the child and the family.

The Data Protection Act recognizes emotional distress as a form of damage that warrants compensation, with Section 65(4) specifically stating that “damage includes financial loss and damage not involving financial loss, including distress.”

Public School Also Sanctioned

In a separate but related case mentioned in the Business Daily report, Friends School Kaveye Girls High School was issued an enforcement notice for filming a student being punished and sharing the video on social media.

While the school did not receive a financial penalty, it was ordered to cease the unlawful processing of children’s data.

Implications for Educational Institutions

These cases serve as a stern warning to educational institutions across Kenya about their obligations under the Data Protection Act of 2019.

Schools must ensure they have proper consent mechanisms in place before processing or sharing students’ personal information, particularly when it involves minors.

The rulings highlight that:

1. Schools must obtain explicit parental consent before sharing students’ personal data with third parties
2. Consent must be obtained before processing occurs, not as an afterthought
3. Schools must maintain proper records of consent
4. Special protection is required for personal data belonging to minors

Educational institutions are encouraged to review their data protection policies and procedures to ensure compliance with Kenya’s data protection laws and avoid similar penalties.