SCHOOLS FACE PENALTIES FOR EXPOSING CHILDREN’S PERSONAL DATA IN LANDMARK PRIVACY RULINGS

In a significant development for data protection standards in Kenya’s education sector, two schools have been sanctioned for unlawfully disclosing children’s personal information to third parties without proper parental consent.

The Office of the Data Protection Commissioner (ODPC) ruled against Nova Pioneer, a prestigious private international school, and Friends School Kaveye Girls High School, a public secondary institution, finding both in breach of Kenya’s increasingly enforced data protection laws.

Private School Ordered to Pay Substantial Compensation

Nova Pioneer’s Athi River branch has been ordered to pay Sh500,000 in compensation after sharing a student’s sensitive personal information with other parents, a travel agency, and the United States Embassy without obtaining proper permission from the child’s parent.

The violation occurred when the school attempted to secure visas for students selected to participate in the World Scholars Debate Competition in the United States. In doing so, Nova Pioneer disclosed the child’s name, gender, passport number, date of birth, and nationality through a third-party travel agency.

“The respondent failed to provide proof of having obtained parental consent to process the minor’s personal data,” said Data Commissioner Immaculate Kassait in her ruling. “Therefore, the respondent unlawfully processed the minor’s personal data as it did not demonstrate that it had a lawful basis to share the minor’s personal data with third parties.”

The parent, whose name was withheld to protect the minor’s identity, argued that the unauthorized disclosure exposed their child to potential identity fraud and caused significant emotional distress to both the child and family.

This marks the second time Nova Pioneer has faced sanctions for data protection violations. Last year, the school was fined a heftier Sh950,000 for using a minor’s image on commercial billboards without parental consent.

Public School Disciplinary Video Shared on Social Media

In a separate but equally concerning case, Friends School Kaveye Girls High School faced regulatory action after its deputy head teacher filmed a student being disciplined and later shared the video on social media platforms, where it went viral.

While the school escaped a monetary penalty, it received an enforcement notice ordering the immediate cessation of unlawful processing of children’s data.

The school claimed the recording was made solely for internal documentation to demonstrate to the principal and parent-teacher association that proper disciplinary procedures had been followed. School officials also maintained they did not intentionally publish the video online and had attempted to have it removed from social media after it spread.

ODPC investigations revealed a troubling gray area in consent practices. While the student’s guardian had technically consented to filming by signing the school’s admission rules, the school failed to notify the guardian at the time the video was being recorded—a violation of transparency principles under data protection law.

Growing Focus on Children’s Digital Privacy

The rulings highlight increasing scrutiny on how educational institutions handle sensitive information about minors in Kenya’s digital age.

Legal experts note that these cases establish important precedents for schools and other organizations that routinely collect and process children’s data.

“Personal data belonging to minors requires special protection due to their vulnerability,” emphasized Commissioner Kassait in her statement, signaling the ODPC’s commitment to enforcing stricter standards when children’s information is involved.

Data protection attorney Martha Njenga, who was not involved in either case, told this reporter that schools must now recognize the serious legal and financial consequences of casual approaches to student data.

“These rulings send a clear message that consent isn’t just a checkbox exercise,” Njenga explained. “Institutions have an affirmative duty to obtain explicit permission before sharing children’s information, regardless of how benign the purpose may seem.”

Implications for Educational Institutions

The cases expose common practices in many schools that may now require urgent review, including:

• Sharing student information with external organizations for educational trips and competitions
• Recording disciplinary actions or student activities for internal documentation
• Using blanket consent forms at admission that may not cover specific instances of data processing
• Sharing student achievements and activities with other parents or on social media

Education sector analysts suggest schools across Kenya will need to develop more robust data protection policies, provide staff training on privacy principles, and implement clearer consent mechanisms that go beyond general admission agreements.

Parents, meanwhile, are increasingly questioning what happens to their children’s personal information and how schools use these details.

As digital documentation becomes standard practice in educational settings, these landmark rulings suggest Kenya’s data protection regime is maturing—with significant implications for how institutions handle the personal information of the country’s most vulnerable citizens.