Two schools have come under fire for violating children’s data protection rights, in what the Office of the Data Protection Commissioner (ODPC) calls a serious breach of trust and legal obligation.
Nova Pioneer, a private international school, was fined Sh500,000 for unlawfully sharing a student’s personal data without the parent’s consent. The child’s information — including name, gender, passport number, date of birth and nationality — was allegedly disclosed to a travel agency, other parents, and the US Embassy.
“The respondent failed to provide proof of having obtained parental consent to process the minor’s personal data,” said Data Commissioner Immaculate Kassait. “Therefore, the respondent unlawfully processed the minor’s personal data as it did not demonstrate that it had a lawful basis to share the minor’s personal data with third parties.”
The data was reportedly used in support of a visa application for the World Scholars Debate Competition in the US. However, the child’s parent maintains they were never asked for permission, and that the disclosure exposed the minor to potential identity fraud and emotional distress.
This is not the first time Nova Pioneer has faced scrutiny. Last year, the school was fined Sh950,000 for using a minor’s image on billboards without consent.
In a separate case, Friends School Kaveye Girls High School escaped a fine but was issued with an enforcement notice after a deputy head teacher filmed a student during punishment.
The video, later shared online, went viral — again without parental permission.
Although the school claimed the video was for internal records, ODPC found it had failed to notify the student’s guardian at the time of filming, breaching the principle of transparency.
“Personal data belonging to minors requires special protection due to their vulnerability,” Kassait added.
The ODPC’s rulings highlight growing concerns over the handling of minors’ data in education.