Nairobi Academy school has been ordered to pay Sh637,500 in compensation after it was found to have unlawfully used a minor’s personal data for publicity purposes without parental consent, in violation of the Data Protection Act.
The decision was delivered by Data Protection Commissioner Immaculate Kassait following a complaint lodged by the minor’s parents, who accused the school of disclosing their child’s identity and academic performance in a newspaper advertisement without lawful authority.
According to the ruling, the school published the learner’s name and examination results in a local daily under the advertising feature section to showcase the institution’s academic achievements.
The Commissioner found that the disclosure amounted to unlawful processing of a child’s personal data for commercial benefit.
In her determination, Kassait cited Section 65(4) of the Data Protection Act, which defines damage to include not only financial loss but also non-financial harm such as emotional distress.
“Having established that Nairobi Academy unlawfully processed a minor’s personal data for commercial purposes and violated the complainant’s right to object, the respondent is hereby directed to pay compensation amounting to Sh637,500,” Kassait ruled.
The Office of the Data Protection Commissioner noted that the amount awarded took into account the nature and gravity of the violation, the scope of publication, and the school’s previous conduct in handling personal data.
Evidence before the Commissioner showed that the child’s father first raised concerns with the school in 2023 after a similar disclosure. At the time, the school allegedly acknowledged the issue and assured the parent that the learner’s personal data would not be shared again without consent.
Despite the assurance, the school was accused of repeating the violation by publishing the minor’s details in a newspaper edition dated August 21, 2025.
The parent argued that the disclosure was done without consent and lacked any lawful basis under the Act, insisting that it was intended to promote the school.
In its response, Nairobi Academy conceded that the concerns raised were valid and admitted that no express parental consent had been obtained before sharing the examination results.
The school maintained, however, that the publication was part of a general academic performance update and not deliberately intended for commercial gain.
The institution further acknowledged delays in responding to the parents’ follow-up queries and attributed the incident to weaknesses in its internal data-handling procedures, expressing regret over the lapse.
