The Office of the Data Protection Commissioner (ODPC) has found the Board of Management of Sacred Heart Mukumu Girls’ High School liable for violating the privacy and data protection rights of a former student and ordered the school to pay Sh300,000 in compensation.
The determination follows a complaint filed by Grace Ellah Indoshi and Felistus Khadi Mukami over the publication of a photograph of the first complainant, who was a minor at the time, in a May 2023 Saturday Nation report concerning the health crisis that had affected Sacred Heart Mukumu Girls’ High School.
The case has drawn attention to the responsibilities of schools when collecting, storing and sharing personal information belonging to learners, particularly minors. It also highlights the legal obligations of institutions to ensure that photographs, medical information and other personal data are only used for legitimate and properly disclosed purposes.
According to the case summary, Saturday Nation published a front-page special report under the headline “Lost Souls”, which featured a photograph of the then 17-year-old student. The report incorrectly created the impression that the student had died, despite the fact that she was alive and had already been discharged from hospital. Nation Media Group subsequently published a correction and apology the following day.
The complainants raised several concerns, including unlawful processing of the minor’s personal data, disclosure of sensitive health information, unauthorised cross-border distribution of personal information and other alleged violations of privacy rights.
ODPC Dismisses Complaint Against Nation Media Group
Despite the serious concerns raised over the publication, the Data Commissioner dismissed the complaint against Nation Media Group PLC and reporter Hellen Shikanda.
The ODPC determined that it lacked jurisdiction to penalise Nation Media Group under the relevant provisions of the Data Protection Act, 2019. The Commissioner also recognised the journalistic exemption, taking into account the nature of the publication and the fact that it concerned an urgent public health and safety matter.
The Commissioner further noted that the media organisation had taken corrective action by publishing a correction and apology within 24 hours after the erroneous report. This was considered in assessing the conduct of the media organisation in relation to its editorial and professional obligations.
The decision therefore places a distinction between the responsibilities of a media organisation reporting on a matter of significant public interest and those of an institution that initially collected and subsequently shared personal data.
School Found Liable for Sharing Student’s Data
The ODPC, however, found the Board of Management of Sacred Heart Mukumu Girls’ High School liable for unlawfully processing and sharing the former student’s personal data.
The Commissioner established that the school had originally collected the student’s photograph in 2020 for administrative and admission purposes. The subsequent sharing of that photograph with an external media organisation in 2023 was found to have gone beyond the original purpose for which the information had been collected.
According to the determination, the sharing of the photograph without appropriate parental consent amounted to a breach of key data protection principles, including purpose limitation, fairness and transparency, as provided under Section 25 of the Data Protection Act, 2019.
The school was also found to have failed to observe safeguards relating to the processing of children’s personal data. Since the individual was a minor when the photograph was initially collected and subsequently used, the Commissioner emphasised the importance of obtaining consent from the relevant parent or legal guardian where required.
The ODPC further found that the school failed to notify the guardian before the secondary processing of the personal data. This means that information originally collected for one purpose was subsequently used for another purpose without adequately informing the person responsible for the child’s rights and welfare.
School Accused of Obstructing ODPC Investigation
The determination also raised concerns about the conduct of the school’s Board of Management during the regulatory investigation.
According to the ODPC, the Board allegedly failed to respond adequately to notifications from the data protection regulator and did not submit the required responses. The school was also accused of failing to cooperate during an official ODPC site visit conducted on July 13 and 14, 2026.
The regulator considered the conduct serious enough to go beyond the compensation order. The Data Commissioner formally recommended the criminal prosecution of the school’s Board of Management under Section 61 of the Data Protection Act for allegedly obstructing the Commissioner’s investigations.
This aspect of the determination sends a strong warning to institutions that are subject to data protection investigations. Schools and other organisations are expected to cooperate with the regulator and provide information or assistance required during an official inquiry.
Sh300,000 Compensation Ordered
Following its findings, the ODPC dismissed the complaint against Nation Media Group and Hellen Shikanda while holding the Board of Management of Sacred Heart Mukumu Girls’ High School responsible for the privacy violations.
The school was ordered to pay Sh300,000 in compensation to the complainants.
The case underscores the increasing importance of data protection compliance within Kenya’s education sector. Schools routinely collect large amounts of personal information about learners, including names, photographs, contact details, academic records, medical information and other sensitive data.
The determination serves as a reminder that collecting personal information for admission or administrative purposes does not automatically give an institution unlimited authority to use or share that information for unrelated purposes. Schools must consider the purpose for which data was collected, the applicable legal basis for processing, transparency requirements and the additional safeguards that apply when dealing with children’s information.
The case also highlights the importance of clear data protection policies within learning institutions. School administrators and Boards of Management need to ensure that teachers, staff and other authorised personnel understand when learner information can be shared with third parties, including media organisations.
For parents and guardians, the decision reinforces the importance of understanding how schools intend to use children’s photographs and other personal information. Where information is to be used for a purpose beyond ordinary school administration, appropriate consent and communication may be necessary.
More broadly, the ODPC determination demonstrates that data protection obligations apply not only to technology companies and large corporations but also to schools and other institutions that collect and process personal information. As the use of digital records, photography, social media and online communication continues to grow in Kenyan schools, institutions will increasingly be required to balance legitimate communication and public interest with the privacy and protection rights of learners.
The Mukumu Girls’ case therefore provides an important reminder that a learner’s personal information remains protected even after it has been collected by a school, and institutions must exercise caution before sharing such information for purposes different from those for which it was originally obtained.
