The Office of the Data Protection Commissioner (ODPC) has found the school culpable of unlawfully processing and disclosing the personal data of a minor student.

In a determination, the Commissioner said the school had no valid basis to share the student’s photograph with external parties for publication after collecting it for admission and administrative purposes.

The ODPC said the photograph was initially collected in 2020 as part of the student’s admission and relationship with the school.

However, its subsequent disclosure in May 2023 for journalistic publication amounted to further processing for a different purpose.

“The purpose for which the photograph was collected was therefore limited to the 1st Complainant’s relationship with the school and the administrative functions arising from her admission and enrolment,” the Commissioner stated.

The watchdog rejected the argument that possession of the photograph gave the school unrestricted powers to use or disclose it.

“The fact that the photograph was already in the 3rd Respondent’s possession did not confer an unrestricted right to disclose or repurpose it,” the determination states.

According to the Commissioner, the school should have obtained consent from the minor’s parent and legal guardian before allowing the photograph to be used for another purpose.

The ODPC found that the disclosure of the photograph to external parties for publication was not reasonably connected to the purpose for which the information had initially been collected.

“The disclosure of the photograph to external parties for journalistic publication was not reasonably connected to the original admission and administrative purpose,” the Commissioner ruled.

The case arose from the publication of material concerning the 2023 health crisis at Mukumu Girls, when students fell ill amid concerns over food and water contamination.

While acknowledging that the matter was of legitimate public interest, the Commissioner said this did not give the school an automatic right to repurpose a minor’s personal information.

The school was further faulted for failing to adequately inform the parent that the photograph collected during admission could later be shared with third parties for publication.

The Commissioner said the student’s status as a minor heightened the school’s responsibility to protect her personal information and ensure that appropriate consent and safeguards were in place.

Mukumu Girls was also criticised for its handling of the ODPC’s investigations into the complaint.

The Commissioner found that the school had failed to cooperate with the investigations despite being notified of the complaint and being given an opportunity to respond.

The school allegedly failed to facilitate a scheduled site visit and did not provide information requested by the Data Commissioner.

The ODPC consequently found that the school had breached key principles of data protection, including lawfulness, fairness and purpose limitation.

In ordering compensation, the Commissioner said the unlawful processing of the minor’s personal data warranted an award to the complainant.

“Having found that the 3rd Respondent unlawfully processed a minor’s personal data and non-compliance of principles of data protection, the 3rd Respondent is hereby directed to compensate the Complainant a total of Kenya shillings Three Hundred Thousand shillings only (KES 300,000),” the determination states.

The Commissioner also found that the school’s failure to cooperate with the regulator amounted to non-compliance with its obligations under the Data Protection Act.

The post Mukumu Girls fined Sh300,000 for sharing minor’s photo appeared first on Insider Bits News.

Justice Bahati Mwamuye barred the Government of Kenya from transferring or sharing any medical or sensitive health data of Kenyans with President Donald Trump led-government  pending the hearing of a petition filed by the Consumers Federation of Kenya (COFEK) challenging the safety and legality of the deal.

“Pending the inter-partes hearing and determination of the applicant’s Notice of Motion Application dated 09/12/2025, a conservatory order be and is hereby issued suspending, staying and/or restraining the Respondents…from implementing, operationalizing, or howsoever giving effect to the Health Cooperation Framework executed between the Government of Kenya and the Government of the United States of America on or about December 4, 2025, insofar as it provides for or facilitates the transfer, sharing or dissemination of medical, epidemiological or sensitive personal health data,” Justice Mwamuye ordered.

The petition, filed by COFEK through lawyerTali Tali contends that the Sh 208 billion agreement, executed on December 4, 2025, threatens the privacy of millions of Kenyans and violates constitutional and statutory safeguards.

The Framework requires Kenya to share extensive medical data, including information on HIV/AIDS, tuberculosis, malaria, maternal and child health, and disease surveillance, forming part of the country’s strategic health-security infrastructure.

COFEK argues that the deal was executed without proper parliamentary oversight and lacked public participation, contrary to constitutional principles of transparency, accountability, and integrity under Article 10.

“Despite its significant implications, the Framework was not subjected to the constitutional principles of good governance… The process was therefore opaque and constitutionally improper,” the petition states.

The petitioners further warned that once Kenya’s medical and epidemiological data is transferred abroad, the harm becomes permanent and irreversible.

“Neither this Honourable Court nor Kenyan regulators will have the power to recall, restrict or oversee the foreign use of such data. This exposes citizens to lasting privacy violations, stigma and potential misuse of their information,” the lobby group adds.

Justice Mwamuye ordered COFEK to serve the Cabinet Secretary of the Ministry of Foreign Affairs, the Cabinet Secretary of the Ministry of Health, the Digital Health Agency, the Office of the Data Protection Commissioner, the National Assembly of Kenya, the Senate, and the Attorney General with the pleadings by December 17, 2025.

The government has been ordered to file their responses by January 16, 2026.

The case will be mentioned on February 12, 2026 before Justice Lawrence Mugambi to confirm compliance and provide directions on an expedited hearing.

The post Court Bars Kenya from Sharing Medical Records with US Government in Sh208 Billion Health Deal appeared first on Insider Bits News.