The Office of the Data Protection Commissioner (ODPC) has ordered the Board of Management of Sacred Heart Mukumu Girls’ High School to pay Ksh300,000 in compensation after finding the institution liable for privacy violations involving a former student.
The decision, according to a document by ODPC obtained by Vantage Ke, followed a complaint over the publication of a photograph of the student, who was 17 at the time, in a May 2023 Saturday Nation newspaper report on a severe health crisis at the school.
The report, published under the headline "Lost Souls", had incorrectly implied that the student had died, despite her being alive and having already been discharged from hospital. The newspaper's parent company, Nation Media Group (NMG) issued a correction and apology the following day.
The complainants subsequently filed a complaint with the ODPC, alleging unlawful processing of the minor's personal data, disclosure of sensitive health information, unauthorised cross-border distribution and privacy violations.
The dispute eventually reached the Nairobi High Court Judicial Review division, which directed the ODPC to admit and determine the complaint.
School Held Responsible
In its determination, the Data Commissioner dismissed the complaint against NMG and one of its reporters but found the Mukumu Girls’ Board liable for unlawfully processing and sharing the student's personal data.
The ODPC found that the school had originally collected the student's photograph in 2020 for administrative and admission purposes. However, the photograph was later shared with external media in 2023 without parental consent. The Commissioner found that this violated requirements on purpose limitation, fairness and transparency under Section 25 of the Data Protection Act.
The school was also found to have breached Section 33(1)(a), which provides safeguards for the processing of children's personal data.
According to the determination, the student's information was processed and shared without obtaining consent from her parent or legal guardian.
The institution was further faulted for failing to notify the guardian before the photograph was subjected to secondary processing.
School Accused of Obstructing Investigation
The ODPC also faulted the school for its conduct during the investigation, with the school found to have ignored notifications from the regulator, failing to submit responses and not cooperating during an official ODPC site visit conducted on July 13 and 14, 2026.
The conduct prompted the Data Commissioner to recommend criminal prosecution of the school's Board of Management under Section 61 of the Data Protection Act for obstructing the Commissioner's investigations. The recommendation adds a potentially more serious consequence to the compensation order against the institution.
Why Nation Media Was Cleared
Despite the student's photograph appearing in the newspaper report, the ODPC cleared NMG and the reporter of liability. The Commissioner found that the reporting concerned an urgent public health and safety matter and fell within the journalistic exemption under the Data Protection Act.
NMG was also found to have demonstrated compliance with its editorial policies and Code of Ethics by issuing a correction and apology within 24 hours after the publication error.
The Commissioner further ruled that the ODPC lacked jurisdiction to penalise NMG under Sections 51(2)(b) and 52(1)(b) of the Data Protection Act, 2019.
The final determination therefore leaves the Mukumu Girls’ Board facing a Ksh300,000 compensation order and a recommendation for criminal prosecution over alleged obstruction of the ODPC investigation.
In 2023, Sacred Heart Mukumu Girls’ High School experienced a severe health crisis linked to water and food contamination, prompting widespread attention and media coverage. Further, the school was closed indefinitely after the crisis which saw deaths reported and several students admitted in hospital.
