Mukumu Girls fined Sh300,000 for sharing minor's photo without consent

Sacred Heart Mukumu Girls’ High School has suffered a major setback after it has been ordered to pay Sh300,000 as compensation for unlawfully sharing a minor student’s photograph without her parent’s consent.

The order was issued by the Office of the Data Protection Commissioner (ODPC), Immaculate Kassait, in a determination arising from a complaint over the unauthorised release of a Form Four student's photograph during the deadly 2023 contamination outbreak at the institution.

The ODPC found that the school had breached data protection principles by disclosing the minor’s photograph to third parties, including a media organisation, for publication without demonstrating that it had obtained the consent of her parent and legal guardian.

The photograph of the student, then 17, had initially been collected in 2020 for purposes of the student’s admission and administration at the school.

It was shared with the media in May 2023 without the knowledge or consent of her parent, and was subsequently used on the front page of one of the local dailies.

However, the Data Commissioner found that disclosure for publication amounted to further processing for a materially different and incompatible purpose.

“The purpose for which the photograph was collected was therefore limited to the 1st Complainant's relationship with the school and the administrative functions arising from her admission and enrolment,” Commissioner Kassait stated.

The ODPC said the disclosure of the photograph for journalistic publication was not reasonably connected to the original purpose for which it had been collected.

“The disclosure of the photograph to external parties for journalistic publication was not reasonably connected to the original admission and administrative purpose,” the Commissioner ruled.

The school was also found to have failed to demonstrate that it obtained the consent of the minor’s parent and legal guardian before disclosing the photograph.

The ODPC further held that the fact that the photograph was already in the school’s possession did not give it unrestricted authority to disclose or repurpose it.

“The fact that the photograph was already in the 3rd Respondent's possession did not confer an unrestricted right to disclose or repurpose it,” the determination states.

The Commissioner found that the school breached the principles of lawfulness, fairness, purpose limitation and data protection in handling the student’s personal information.

The school was also faulted for failing to notify the parent that the photograph collected for admission purposes would subsequently be shared with third parties for publication.

The ODPC noted that the student was a minor at the time and therefore the school had an enhanced obligation to ensure that her parent or legal guardian was appropriately informed about the intended processing and disclosure of her personal data.

The dispute arose from a publication concerning the 2023 health crisis at Mukumu Girls, which involved students falling ill following suspected food and water contamination.

The Commissioner noted that the publication was a matter of legitimate public concern but found that this did not give the school a blanket right to repurpose the minor’s personal data.

The Data Commissioner found that the school breached Section 33(1)(a) of the Act, which bars a data controller from processing a child's personal data unless consent is obtained from the child's parent or guardian.

The office also found the school violated its duty under Section 29 to notify the guardian before the photo was passed on for a purpose different from the one for which it was originally collected, and breached core data-processing principles under Section 25, including purpose limitation and transparency.

The ODPC also found the school had failed to cooperate with investigations, despite being notified of the complaint and being given opportunities to respond.

The school, however, was found to have ignored the ODPC throughout its investigation.

It did not respond to notification of the complaint, failed to appear for a scheduled site visit on July 13 and 14, 2026, and did not comply even after a final reminder was issued on July 23, 2026.

The Data Commissioner ruled that this conduct amounts to a failure to cooperate with the Data Commissioner in the exercise of the Commissioner's statutory functions.

“Having found that the 3rd Respondent unlawfully processed a minor's personal data and was non-compliant with the principles of data protection, the 3rd Respondent is hereby directed to compensate the Complainant a total of Sh300,000,” the Commission ordered

Beyond the compensation order, the Data Commissioner recommended the criminal prosecution of the school's Board of Management under Section 61 of the Act, which criminalises obstruction of the Data Commissioner and carries a penalty of a fine of up to Sh5 million, a jail term of up to two years, or both.

The Commission further directed the school to pay compensation to the two complainants, the former student and her mother, and dismissed all claims against the media respondent