The Office of the Data Protection Commissioner (ODPC) has taken action against Nova Pioneer and Friends School Keveye Girls High School for violating the Data Protection Act, signalling a tougher regulatory stance on how minors’ personal data is handled in educational institutions.
- •Nova Pioneer Kenya, a prominent private school group, has been fined KSh 0.5 million for unauthorized sharing and use of students’ data.
- •The school shared a student’s personal information—including passport number, nationality, and date of birth — with a safari company and the U.S. Embassy, despite the parent having declined the child’s participation in a planned school trip.
- •In a separate case, Friends School Keveye Girls High School recorded and stored a video of a student being disciplined by destroying her mobile phone, a contraband item under school rules.
“The Respondent failed to provide proof of having obtained parental consent to process the Minor’s personal data. Further, the Respondent did not prove that it satisfied the reasons […] that allow for the processing of personal data without obtaining consent from the data subject,” The Data Commissioner Immaculate Kassait ruled.
“Therefore, the Respondent unlawfully processed the Minor’s personal data as it did not demonstrate that it had a lawful basis to share the Minor’s personal data with third parties,” she added.
The ODPC investigation revealed that the school acknowledged that the initial data consent form lacked sufficient clarity and the school had indeed shared the child’s data with third-party organizations.
The Friends School Kaveye Girls’ video was captured by staff on school premises and shared internally for administrative purposes. However, the ODPC found that the school had failed to obtain informed consent from the parent or guardian, and that the act of recording and storing the video infringed upon the student’s privacy and dignity.
The ODPC also cited breaches of data minimization and transparency requirements, noting that the school had not updated its policies to inform parents or students about such recordings. It also directed the school to pay a KSh 20,000 compensation for the damaged phone.
“It is the finding of this Office that the Respondent processed the minor’s personal data without lawful basis as the requirements for valid consent […] were not met,” Kassait stated.
The determinations reflect a growing assertiveness by the data regulator in Kenya and a firm emphasis on the rights of data subjects, particularly minors. Both cases underscore that consent from parents and guardians must be explicit, verifiable, and obtained in advance of any data processing.
