The Office of the Data Protection Commissioner (ODPC) has delivered a detailed determination in ODPC Complaint No. 1597 of 2025, brought by a parent acting on behalf of a minor, AJR, against The Nairobi Academy. The complaint arose from the alleged unlawful disclosure and publication of a child’s personal data specifically the child’s name and examination results without consent or any other lawful basis.
The dispute is rooted in Article 31 of the Constitution of Kenya, which guarantees the right to privacy, and the Data Protection Act, 2019, which operationalises that constitutional protection by regulating how personal data is collected, processed, and shared. The ODPC, established under Section 5 of the Act, is mandated to oversee compliance, investigate complaints, and enforce data protection rights, including those relating to children.
According to the Complainant, the school had previously disclosed similar information in 2023, prompting concern from the parent. At that time, the school allegedly assured the Complainant that no further disclosure of the child’s personal data would occur without prior consent. Despite this assurance, the Complainant later discovered that the child’s name and examination results had been published in the Daily Nation newspaper on 21 August 2025 under an “Advertising Feature” section. The parent argued that this amounted to unlawful processing of personal data for commercial benefit and was done without consent.
The ODPC found that the complaint was properly lodged under Section 56 of the Data Protection Act and Regulation 4 of the Enforcement Regulations, 2021. Following notification, the Respondent was required to explain the circumstances of the disclosure, provide supporting evidence, and justify the legal basis for processing the child’s data.
In its response, the school acknowledged the seriousness of the allegations and admitted that the minor’s individual examination results were shared with a media outlet as part of a broader academic performance update. Importantly, it conceded that no express parental consent had been obtained before the disclosure. The Respondent further accepted that children’s data requires special protection under Section 33 of the Act and that the failure to obtain consent represented a deviation from legal requirements, attributing the incident to internal procedural lapses.
The Commissioner first considered whether there had been unlawful processing of personal data for commercial purposes. Under the Act, personal data includes any information relating to an identifiable person, and the combination of a child’s name, school, and examination results clearly meets this threshold. The ODPC noted that Section 30 of the Act generally prohibits processing of personal data without consent, while Section 33 imposes stricter safeguards for children, requiring parental consent and a focus on the child’s best interests. The Office further relied on Section 37 and Regulation 14 of the General Regulations, which prohibit the use of personal data for commercial purposes without express consent.
The ODPC concluded that the publication of the child’s results in a national newspaper, particularly under an advertising feature, demonstrated a promotional and commercial purpose. This showed that the data was not merely used for academic reporting but was instead leveraged to advance institutional visibility and attract prospective clients. Since no parental consent had been obtained, the Commissioner held that the processing was unlawful.
The second issue concerned whether the child’s rights had been violated. The ODPC noted that the parent had explicitly objected to further processing of the child’s data following earlier concerns. The school had acknowledged this objection and assured compliance yet proceeded to disclose the information anyway. Under Sections 26, 27, and 36 of the Act, data subjects have the right to object to processing, and where the subject is a minor, that right is exercised by a parent or guardian.
The Commissioner found that once the objection was made, the school had a legal obligation to cease or strictly limit any further processing unless it could demonstrate compelling legitimate grounds, which it failed to do. The ODPC therefore held that the Respondent not only ignored a valid objection but also breached its own prior assurances, resulting in an aggravated violation given the public nature of the disclosure and the vulnerability of the data subject.
On remedies, the ODPC applied Section 65 of the Data Protection Act, which allows compensation for both financial and non-financial harm, including distress. The Office concluded that the unlawful disclosure, combined with the breach of trust and public exposure of a minor’s academic results, justified an award of damages. The school was ordered to pay the Complainant KES 637,500 as compensation.
In its final determination, the Data Commissioner found the Respondent liable for unlawful processing of personal data and violation of the child’s rights. The award was made considering the seriousness of the breach, the fact that the data belonged to a minor, and the widespread publication through a national newspaper. The parties were also informed of their right to appeal the decision to the High Court within thirty days.
This determination underscores the strict legal safeguards surrounding children’s data in Kenya and reinforces that consent is not a formality but a binding legal requirement. It also signals a firm regulatory stance that institutions, including schools, must treat personal data especially that of minors with heightened caution, regardless of intent or tradition of practice.
#mmsadvocates #CorporatelawyersinNairobi #IntellectualpropertylawKenya
