The Office of the Data Protection Commissioner (ODPC) has found The Nairobi Academy liable for a deliberate and aggravated violation of the Data Protection Act.
The school has been ordered to pay Ksh. 637,500 in compensation to a parent after publishing a minor’s national examination results in a newspaper advertisement without consent.
According to the determination, the school published the child’s name and academic performance in an “Advertising Feature” in the Daily Nation on August 21, 2025.
The complainant revealed that a similar incident occurred in 2023. At that time, the school acknowledged the error and provided a formal assurance that they would never again disclose the minor’s personal data without prior consent. By publishing the results again in 2025 for commercial gain, the school was found to have acted in bad faith.
Data Commissioner Immaculate Kassait, SC, MBS, ruled that the school’s actions violated several core tenets of the Data Protection Act, 2019:
- Unlawful Processing: The school used a minor’s personal data for commercial purposes (marketing) without a legal basis.
- Right to Object: The school ignored the parent’s express right to object to the processing of their child’s data.
- Definition of Damage: Under Section 65(4) of the Act, the Commissioner noted that “damage” is not limited to financial loss but includes emotional distress, which was evident in this case.
The ruling has sent shockwaves through the Kenyan education sector. Social media commentators have hailed the decision as a turning point for privacy in Kenya, with many noting that schools have long used student results as marketing billboards without considering the privacy implications for the children involved.