School fined Sh500,000 for sharing student’s data without parental consent

A top school has been ordered to pay Sh500,000 by the Office of the Data Protection Commission (ODPC) after it was found guilty of unlawfully sharing a student’s personal information without the consent of the parent.

The Commission determined that the school shared the student’s details with a travel agency and the US Embassy, violating data protection laws related to children’s privacy.

This followed a complaint filed by the parent of the minor, accusing the institution of breaching data rights by circulating personal information to third parties.

"The Respondent is hereby found liable for unlawful processing of the minor's personal data and is hereby ordered to pay the complainant (minor's parent) Sh500,000 as compensation," the Data Commissioner ruled.

According to the Commission, the school provided a letter containing the child’s personal details without consulting the parent or seeking consent, which amounted to an unlawful act.

ODPC said personal data involving children should always be treated with care and attention due to their vulnerable status.

"Personal data belonging to minors requires special protection due to their vulnerability and should always advance the rights and best interests of the child," the Data Commissioner said.

The parent who brought the matter before ODPC said the breach happened when the school issued a document to 16 parents in preparation for a trip to the United States for an academic event.

The letter in question included personal data about the student and was shared both among parents and submitted to the US Embassy on October 18, 2024.

The documents consisted of an invitation letter from the World Scholars Cup Debate Competition and an introduction letter from the school, listing all the qualifying students.

The parent claimed that at no point was she asked to give consent for her child’s information to be shared, and she expressed worry about the potential risks.

She said the breach caused her emotional distress, noting that sharing her child’s details with strangers could expose them to identity theft or fraud.

In response, the school defended its actions by stating that the processing of the data was done in connection with an invitation to participate in the World Scholars Cup, dated September 26, 2024.

The letter listed names of selected students and chaperones for visa application purposes, as they were to attend the competition hosted by Yale University.

The school further argued that it acted in the interest of providing learning experiences to its students.

It added that a consent form was made available to parents through Google Forms and was only accessible by the school’s trips team.

Despite this defence, ODPC maintained that prior and explicit consent was necessary, especially because the data involved a minor.