Sacred Heart Mukumu Girls’ High School has been ordered to pay Sh300,000 after the data watchdog found it unlawfully shared a minor’s photograph without consent.
The Office of the Data Protection Commissioner (ODPC) has found the school culpable of unlawfully processing and disclosing the personal data of a minor student.
In a determination, the Commissioner said the school had no valid basis to share the student’s photograph with external parties for publication after collecting it for admission and administrative purposes.
The ODPC said the photograph was initially collected in 2020 as part of the student’s admission and relationship with the school.
However, its subsequent disclosure in May 2023 for journalistic publication amounted to further processing for a different purpose.
“The purpose for which the photograph was collected was therefore limited to the 1st Complainant’s relationship with the school and the administrative functions arising from her admission and enrolment,” the Commissioner stated.
The watchdog rejected the argument that possession of the photograph gave the school unrestricted powers to use or disclose it.
“The fact that the photograph was already in the 3rd Respondent’s possession did not confer an unrestricted right to disclose or repurpose it,” the determination states.
According to the Commissioner, the school should have obtained consent from the minor’s parent and legal guardian before allowing the photograph to be used for another purpose.
The ODPC found that the disclosure of the photograph to external parties for publication was not reasonably connected to the purpose for which the information had initially been collected.
“The disclosure of the photograph to external parties for journalistic publication was not reasonably connected to the original admission and administrative purpose,” the Commissioner ruled.
The case arose from the publication of material concerning the 2023 health crisis at Mukumu Girls, when students fell ill amid concerns over food and water contamination.
While acknowledging that the matter was of legitimate public interest, the Commissioner said this did not give the school an automatic right to repurpose a minor’s personal information.
The school was further faulted for failing to adequately inform the parent that the photograph collected during admission could later be shared with third parties for publication.
The Commissioner said the student’s status as a minor heightened the school’s responsibility to protect her personal information and ensure that appropriate consent and safeguards were in place.
Mukumu Girls was also criticised for its handling of the ODPC’s investigations into the complaint.
The Commissioner found that the school had failed to cooperate with the investigations despite being notified of the complaint and being given an opportunity to respond.
The school allegedly failed to facilitate a scheduled site visit and did not provide information requested by the Data Commissioner.
The ODPC consequently found that the school had breached key principles of data protection, including lawfulness, fairness and purpose limitation.
In ordering compensation, the Commissioner said the unlawful processing of the minor’s personal data warranted an award to the complainant.
“Having found that the 3rd Respondent unlawfully processed a minor’s personal data and non-compliance of principles of data protection, the 3rd Respondent is hereby directed to compensate the Complainant a total of Kenya shillings Three Hundred Thousand shillings only (KES 300,000),” the determination states.
The Commissioner also found that the school’s failure to cooperate with the regulator amounted to non-compliance with its obligations under the Data Protection Act.
