Nairobi Academy Ordered to Pay Sh637,500 for Unlawfully Using Minor’s Personal Data Without Consent

Nairobi Academy has been directed to compensate a minor Sh637,500 after the Office of the Data Protection Commissioner found the school guilty of unlawfully processing the child's personal data for commercial purposes.

The case centered on the school's publication of the minor's name and examination results in a local newspaper's advertising feature section. The publication, which appeared in an edition dated August 21, 2025, aimed to highlight the institution's academic performance and promote its reputation.

This was not the first instance of concern. In 2023, the minor's father had raised objections with the school after a similar disclosure of the child's personal information. The school had then assured the parent that such details would not be shared again without explicit consent. Despite this promise, the school repeated the action in 2025.

The minor's parents lodged a formal complaint with the Office of the Data Protection Commissioner following the latest publication. Investigations revealed that the school had processed the child's data without obtaining parental consent, violating provisions of the Data Protection Act.

Data Protection Commissioner Immaculate Kassait delivered the decision, ruling that the disclosure constituted unlawful processing of a minor's personal data for commercial benefit. The commissioner emphasized that the action breached the complainant's right to object to such processing. Section 65(4) of the Data Protection Act was cited, noting that compensable damage includes not only financial loss but also non-financial harm such as emotional distress.

The commissioner determined that the compensation amount of Sh637,500 appropriately reflected the nature and gravity of the violation, the wide scope of the publication through a newspaper, and the school's prior conduct in managing personal data.

The school acknowledged the validity of the concerns raised. It admitted that no express parental consent had been obtained for the publication. While describing the feature as a general academic update rather than deliberate commercial advertising, the institution conceded weaknesses in its internal data-handling procedures and expressed regret over the lapse, including delays in responding to related queries.

This ruling serves as a reminder to educational institutions and other entities handling minors' data to strictly obtain parental or guardian consent before processing such information for any promotional or public purposes. The decision reinforces the protections afforded to children's personal data under Kenyan law.