- The ODPC has found Sacred Heart Mukumu Girls’ High School liable for privacy violations and ordered it to pay Sh300,000 in compensation.
- The Data Commissioner has dismissed the complaint against Nation Media Group and reporter Hellen Shikanda, citing the journalistic exemption.
- The ODPC has recommended criminal prosecution of the school’s Board of Management for obstructing its investigation.
The Office of the Data Protection Commissioner (ODPC) has found the Board of Management of Sacred Heart Mukumu Girls’ High School liable for violating the privacy and data protection rights of a former student, ordering it to pay Sh300,000 in compensation.
The determination follows a complaint filed by Grace Ellah Indoshi and Felistus Khadi Mukami over the publication of a photograph of the first complainant, who was a minor at the time, in a May 2023 Saturday Nation report on the health crisis that affected Mukumu Girls’ High School.
According to the case summary, the newspaper published a front-page special report under the headline “Lost Souls”, featuring the photograph of the then 17-year-old student. The report incorrectly implied that she had died, although she was alive and had already been discharged from hospital. Nation Media Group subsequently issued a correction and apology the following day.
The complainants accused the respondents of unlawful processing of a minor’s personal data, disclosure of sensitive health information, unauthorised cross-border distribution and other privacy violations.
However, the Data Commissioner dismissed the complaint against Nation Media Group PLC and reporter Hellen Shikanda.
The ODPC ruled that it lacked jurisdiction to penalise NMG under the relevant provisions of the Data Protection Act, 2019. It also recognised the journalistic exemption, noting that the publication concerned an urgent public health and safety matter.
ALSO READ:
TSC opens terminal benefits claims for families of teachers who died during disciplinary proceedings
The Commissioner further observed that NMG had complied with its editorial policy and professional obligations by publishing a correction and apology within 24 hours after the erroneous report.
The ODPC, however, found the Board of Management of Sacred Heart Mukumu Girls’ High School liable for unlawfully processing and sharing the student’s personal data.
The Commissioner established that the school had originally collected the student’s photograph in 2020 for administrative and admission purposes. According to the determination, the subsequent sharing of the photograph with external media in 2023 without parental consent amounted to a breach of the principles of purpose limitation, fairness and transparency under Section 25 of the Data Protection Act.
The school was also found to have breached safeguards protecting minors’ personal data by processing and sharing the student’s information without obtaining consent from her parent or legal guardian.
The ODPC further found that the school failed to notify the guardian before the secondary processing of the personal data, contrary to its statutory obligations.
The determination also criticised the school’s conduct during the ODPC investigation.
The Board allegedly ignored notifications from the data protection regulator, failed to submit responses and did not cooperate during an official ODPC site visit conducted on July 13 and 14, 2026.
As a result, the Data Commissioner went beyond the compensation order and formally recommended criminal prosecution of the school’s Board of Management under Section 61 of the Data Protection Act for obstructing the Commissioner’s investigations.
Lentoijoni: No teacher has stayed in one job group for over 17 years
The ODPC consequently dismissed the complaint against Nation Media Group and Hellen Shikanda, while holding the Mukumu Girls’ Board responsible for the privacy violations and ordering it to pay Sh300,000 to the complainants.
The decision highlights the growing obligations on schools and other institutions handling children’s personal information, particularly photographs and health-related data, and the need to obtain appropriate consent before such information is shared for purposes beyond those for which it was originally collected.
By Godfrey Wamalwa
Get more stories from our website: Education News
To write to us or offer feedback, you can reach us at: editor@educationnews.co.ke
You can also follow our social media pages on Twitter: Education News KE and Facebook: Education News Newspaper for timely updates.
>>> Click here to stay up-to-date with trending regional stories
