A learner, through their parent, has been awarded KSh 637,500 in compensation after their school was found guilty of unlawfully publishing their name and examination results in a national newspaper.
The learner’s parent argued that that the publication was done without their consent.
The parent formally lodged their complaint with the Office of the Data Protection Commissioner (ODPC), which immediately investigated the matter.
The case arose after the school featured the student’s personal details in a newspaper advertisement designed to attract new clients.
The advertisement included the child’s name and exam results, effectively turning his private academic performance into a public billboard.
According to the parent, this was done despite clear objections and assurances from the school that the child’s privacy would be respected.
The ODPC described the incident as a “deliberate and aggravated violation.”
The Data Commissioner noted that the school’s actions not only disregarded parental authority but also exposed the minor’s sensitive data to the entire country, permanently.
According to the ODPC, the nonconsensual publication was a breach of trust which highlighted the dangers of institutions prioritising marketing gains over the rights and dignity of children.
The parent had explicitly communicated concerns about the use of the child’s information, making the violation even more serious.
Despite these objections, Nairobi Academy proceeded with the publication, demonstrating what the ODPC termed a reckless disregard for the law.
The ruling therefore served as both a punishment and a deterrent, reminding schools and other organizations that consent is not optional when handling personal data.
Kenya’s Data Protection Act, enacted in 2019, provides clear guidelines on how institutions should collect, process, and share personal information. The law requires organizations to obtain informed consent before publishing or sharing data, particularly when dealing with minors. In this case, the ODPC found that Nairobi Academy had failed to meet these obligations, thereby infringing on the student’s right to privacy.
The award of KSh 637,500 to the student’s family is intended to compensate for the emotional distress and permanent exposure of the child’s academic records. It also sends a strong message to schools and businesses that violations of data protection laws will attract significant penalties. The Commissioner reiterated that protecting children’s data is a priority, given their vulnerability and the long-term impact of such breaches.
This ruling has sparked wider conversations about the responsibilities of educational institutions in Kenya. While schools often celebrate student achievements publicly, the case highlights the need for caution and respect for privacy. Parents and guardians are increasingly demanding accountability, insisting that their children’s information should not be used for promotional purposes without consent.
The Nairobi Academy case is expected to set a precedent for similar disputes in the future. It demonstrates that the ODPC is prepared to enforce the law vigorously, ensuring that organizations respect the rights of individuals. For parents, it offers reassurance that their concerns about privacy will be taken seriously. For institutions, it is a reminder that compliance with data protection laws is not just a legal requirement but a moral obligation.
Source: TUKO.co.ke
