We would like to bring to your attention a recent decision (ODPC Complaint No. 1667 of 2024: Everlyn Lavuha Mugita Suing On Behalf of NSM (Minor) vs Nova Pioneer Kenya Limited) which underscores the importance of obtaining parental consent before sharing a minor’s personal information with third parties. The Nature of the Complaint The Complainant alleged that Nova Pioneer issued a letter containing her child’s personal information to third parties, specifically a travel agency and the U.S. Embassy Consulate, without obtaining prior parental consent. Nova Pioneer students had participated in the World Scholars Debate Championship and advanced to the global rounds, scheduled to take place at Yale University. As part of the visa application process, Nova Pioneer claimed that it had requested parents of participating students to sign a parental consent form to authorize the sharing of personal data with the travel agency and the U.S. Embassy. However, the school failed to provide evidence that the Complainant had granted such consent. Data Commissioner’s Determination The Data Commissioner ordered Nova Pioneer to pay the Complainant Kenya Shillings Five Hundred Thousand (KES 500,000/-) for the following violations: Failure to obtain parental consent before sharing the minor’s personal data with third parties (the travel agency and the U.S. Embassy), in contravention of Sections 30 and 33 of the Data Protection Act. Breach of key data protection principles, including: Respect for privacy Lawfulness, transparency, and fairness Purpose limitation Data minimization and proper justification for data collection Key Takeaways Obtain explicit parental consent before sharing a child’s personal information with third parties. Maintain proper records of consent to demonstrate compliance in case of disputes. Ensure transparency by clearly informing parents about how their child’s data will be processed and shared. Failure to comply with data protection laws can result in significant financial penalties and reputational damage. If your organization processes children’s data, we recommend conducting a data protection compliance review to mitigate risks.Should you need any assistance in reviewing your data protection practices or implementing proper consent procedures, please do not hesitate to reach out.
