The Nairobi Academy has been ordered to pay Sh637,500 in compensation after unlawfully using a minor’s photograph and examination results to promote the school without parental consent.
The decision was issued by the Office of the Data Protection Commissioner, with Data Commissioner Immaculate Kassait finding the school liable for breach of data privacy.
Unlawful Use of Minor’s Personal Data
According to the ruling, Nairobi Academy disclosed and caused the publication of the minor’s name, photograph, and examination results in a newspaper segment appearing under the Advertising Feature section of a local daily.
The Data Commissioner found that the publication was made without parental consent and in the absence of any other lawful basis, in violation of the Data Protection Act.
“Having established that the Respondent unlawfully processed a minor’s personal data for commercial purposes and violated the Complainant’s right to object, the Respondent is hereby directed to pay the Complainant Sh637,500 as compensation,” Kassait ruled.
Parents’ Complaint and Prior Warning
The complaint was lodged by the minor’s parents, who told the Commissioner that the school had on several occasions shared and disclosed their child’s personal data without consent.
The child’s father stated that the first incident occurred in 2023, after which he raised the issue with the school. Nairobi Academy allegedly acknowledged the concern and assured him that it would not publish the minor’s personal data again without prior consent.
Despite the assurance, the school later published the child’s name and examination results in a newspaper edition dated Thursday, August 21, 2025.
Data Commissioner Cites Distress, Not Just Financial Loss
In assessing compensation, the Commissioner relied on Section 65(4) of the Data Protection Act, which defines “damage” to include both financial loss and non-financial harm, such as distress.
The Office of the Data Protection Commissioner said it considered:
-
The nature and extent of the violation
-
The scope of publication of the minor’s data
-
The school’s previous conduct after earlier complaints
School Admits Lapses
In its response, Nairobi Academy acknowledged the seriousness of publishing a minor’s identifiable examination results and admitted that the parents’ concerns were legitimate.
However, the school argued that the results were included as part of a general academic performance update and were not intended for commercial gain, even though no express parental consent had been obtained.
The school further admitted that the parent’s follow-up enquiries were not addressed in a timely manner, attributing the incident to internal procedural lapses in handling learners’ personal data. It expressed regret over the delay.
Key Takeaway
The ruling reinforces that schools are data controllers under Kenyan law and must obtain explicit parental consent before publishing or using minors’ personal data, especially for promotional or advertising purposes.