Last Updated on March 2, 2026 by courtnews reporter

Immaculate Kassaiti Finds Marsabit School Liable

Data Commissioner Immaculate Kassaiti has found Zad Muslim School-Marsabit liable for violating Kenya’s data protection law.

The ruling followed an investigation by the Office of the Data Protection Commissioner (ODPC).

Unlike many cases, this probe was started without a complaint. The office acted on its own after identifying public interest concerns.

read:Malindi Court Permanently Blocks Lamu Coal Power Plant in Landmark Environmental Ruling

Why the Investigation Was Launched

The ODPC noticed that images and videos of children were being shared online.

The content appeared promotional in nature.

Because children are considered a vulnerable group, the office treated the matter as urgent.

Under the law, children’s data requires strict protection.

What the Investigation Found

According to the Data Commissioner, the school:

• Processed large amounts of children’s personal data

• Was not properly registered under data protection law

• Used children’s images online without valid consent

• Failed to clearly notify parents or guardians

• Lacked proper safeguards

The Commissioner said the school could not prove how it informed parents before collecting or using the students’ data.

Issue of Consent

The Data Protection Act requires clear consent before using personal data for commercial purposes.

The Commissioner stated that posting students’ images in school uniform on social media promoted the institution.

That, she said, amounted to commercial use of personal data.

Under Section 29 of the Act, organisations must notify data subjects about:

• The purpose of data collection

• How the data will be used

• Their legal rights

The school failed to demonstrate compliance with these requirements.

read:Activist Joseph Aura to Appeal Dismissal of Petition Over Kenyatta University Land Allocation to WHO

Final Determination

“It is therefore our finding and determination that Zad Muslim School-Marsabit is not compliant with the Act and its attendant regulations,” the Data Commissioner ruled.

The ODPC emphasized that:

• Children’s data attracts strict legal protection

• Organisations cannot rely on the absence of complaints

• The office will use its own investigative powers where necessary

What This Means for Schools

The ruling sends a clear message.

Schools must:

• Obtain valid parental consent

• Register where required

• Put proper safeguards in place

• Avoid using children’s images for marketing without legal basis

The decision strengthens enforcement of Kenya’s Data Protection Act and highlights the risks of non-compliance.