School Ordered to Compensate Parent Over Unauthorised Use of Pupil’s Exam Results

A Nairobi school has been ordered to pay Ksh 637,500 for unlawfully publishing a pupil’s name and examination results in a national newspaper without parental consent, following a decision by the Office of the Data Protection Commissioner (ODPC).

The ruling highlights increasing concern among parents over how schools handle children’s personal information, particularly where such data is used for promotional purposes. Many schools have long publicised the performance of top students in newspapers and on social media, often including full names and photographs, without clear consent or consideration of long-term privacy risks.

In this case, the school published a minor’s personal details as part of a paid advertisement promoting its academic performance. The ODPC found that the publication was neither an academic report nor a legal requirement, but a marketing exercise intended to attract new admissions. 

The parent had explicitly objected to the disclosure, and the school had previously given assurances that the child’s information would not be shared. Despite this, the details were published, making the data permanently accessible through print and online records.

The Commissioner described the school’s actions as deliberate and aggravated, noting that it had ignored clear objections and failed to meet its duty of care. The decision found that the child’s right to object to the processing of personal data had been breached.

Under Kenya’s 2010 Constitution and the Data Protection Act, children’s personal data is subject to enhanced protection. Section 65 of the Act provides that individuals who suffer harm as a result of unlawful data processing are entitled to compensation. This includes damages for emotional distress as well as financial loss. 

The ODPC concluded that the school had unlawfully processed the child’s data and that the harm suffered included emotional injury, not only reputational damage.