MasiboLaw LLP

By Tracy Gakii

Under the Kenya Data Protection Act (DPA), children are considered vulnerable data subjects. This means their personal information must be handled with extra care. Minors cannot legally make privacy decisions on their own. Therefore, parents or legal guardians must consent before a child’s personal data is collected, used, or shared.

The decision in Julian Rowa (suing on behalf of minor AJR) v. The Nairobi Academy shows how these protections apply in practice. It highlights the risks institutions face when student data is used for promotional purposes.

Case Background

The dispute began after The Nairobi Academy published a student’s name and exam results. They did this in an advertising feature in a local newspaper celebrating the school’s academic performance. The student’s parent objected, arguing that the school had not obtained consent before publicly sharing the child’s personal information.

The school assured the parent that the information would not be published again. However, the school later shared the student’s results with a media house. This led to a second publication in August 2025. The parent then filed a complaint with the Office of the Data Protection Commissioner (ODPC).

Key Findings by the ODPC

1. The Publication Was Commercial in Nature

The school argued that the publication was simply an academic update. However, the ODPC found that the information appeared in an “Advertising Feature,” making it promotional.

Under the Kenya Data Protection Act, using personal data to promote services or enhance institutional reputation qualifies as commercial use, which requires consent.

2. Violation of the Minor’s Rights

The school admitted it had not obtained parental consent. In addition, the parent had already exercised the right to object after the first publication. Ignoring that objection further violated the Act.

The ODPC also emphasized that all processing involving children must prioritize the best interests of the child.

3. Compensation Awarded

Because the minor’s rights had been infringed, the ODPC awarded the parent Kshs. 637,500 in compensation.

Compliance Lessons for Institutions

The case provides important guidance for schools and organizations that handle children’s data:

• Obtain explicit parental consent before using student information in media or marketing materials.
• Apply stronger safeguards when handling minors’ personal data.
• Establish clear internal policies, including appointing a Data Protection Officer and training staff on data protection obligations.
• Respect objections immediately, ensuring that requests to stop processing data are properly implemented.

The Broader Risk: Reputation and Trust

Beyond financial penalties, privacy violations can damage a school’s reputation and erode parental trust. If a breach occurs, institutions should act quickly by issuing a formal apology, requesting removal of published content, and conducting a full data audit.

Conclusion

The ruling in Julian Rowa (suing on behalf of minor AJR) v. The Nairobi Academy reinforces a key principle of the Kenya Data Protection Act: children’s personal data must be protected with the highest level of care.

For schools and institutions, the message is clear—using student data for publicity without parental consent can lead to legal liability, financial penalties, and reputational harm.

Need Help With Data Protection Compliance?

If your school or organization processes personal data—especially children’s data—it is essential to ensure your practices comply with the Kenya Data Protection Act.

The team at MasiboLaw LLP advises institutions on data protection compliance, privacy audits, incident response, and regulatory investigations.

📩 Contact us today: info@masibolaw.co.ke
We can help you assess your data practices, reduce legal risk, and build a strong privacy compliance framework.