Background
In Grace Ellah Indoshi & Felistus Khadi Mukami v Hellen Shikanda, Nation Media Group PLC & Board of Management, Sacred Heart Mukumu Girls’ School (ODPC Complaint No. 2118 of 2026), the Complainants lodged a complaint alleging the unlawful processing of a minor’s personal and sensitive personal data, the commercial use of personal data and the violation of the right to privacy.
The 1st Complainant was a minor aged seventeen (17) years and a Form Four student at Sacred Heart Mukumu Girls’ School (the “3rd Respondent”). The 2nd Complainant is her parent and legal guardian.
In 2020, upon her admission to Form One, the 3rd Respondent collected the 1st Complainant’s photograph for school admission and administration purposes. However, in May 2023, the 3rd Respondent shared the photograph with the 1st Respondent, a health and science reporter, and the 2nd Respondent, Nation Media Group PLC, without the knowledge or consent of the 1st Complainant’s parent and legal guardian.
The 1st and 2nd Respondents subsequently published the photograph in the Saturday Nation edition of 27th May 2023 under the headline “Lost Souls”, in an article concerning a health crisis at the 3rd Respondent’s school that had resulted in student hospitalisations and deaths. The publication created the impression that the 1st Complainant was among the deceased students, whereas she had been discharged from hospital and was alive.
Upon discovering the error, the 1st and 2nd Respondents published a correction and public apology in the Sunday Nation edition of 28th May 2023. However, the apology disclosed that the 1st Complainant had received medical treatment in connection with the health crisis, thereby revealing information relating to her health status.
The Complainants further alleged that the publications were distributed and sold in Uganda, Tanzania and Rwanda, resulting in the dissemination of the 1st Complainant’s personal data outside Kenya.
The Complainants contended that the Respondents had processed and disclosed the 1st Complainant’s personal data without the requisite consent and in violation of the Data Protection Act, 2019, including the rights of data subjects, the duty to notify and the requirements governing the processing of children’s personal data.
The 1st and 2nd Respondents’ Response:
The 1st and 2nd Respondents challenged the jurisdiction of the Data Commissioner to determine the complaint against them on the following grounds:
- The impugned publication concerned a matter of significant public interest due to the health crisis at the 3rd Respondent’s school which had resulted in student deaths and hospitalisations, raising serious concerns regarding public health and safety.
- The processing was exempt under Section 51(2)(b) of the Act, which provides an exemption where the processing of personal data is necessary for national security or in the public interest. The Respondents further relied on Regulations 55 and 56 of the Data Protection (General) Regulations, 2021, which recognise processing undertaken to lessen or prevent a serious threat to public health or safety as a permitted general situation.
- The processing was also exempt under Section 52(1)(b) of the Act, as the publication was undertaken in the course of journalistic activities, the 1st Respondent reasonably believed that publication was in the public interest, and compliance with the applicable data protection principles would have been incompatible with that purpose.
- The Respondents relied on Nation Media Group’s Editorial Policy Guidelines and Objectives, which recognise the protection of public health and safety as matters of public interest, to demonstrate compliance with the relevant self-regulatory code of ethics.
- The Respondents further submitted that, upon discovering the erroneous publication of the 1st Complainant’s photograph, they promptly issued a correction and public apology the following day. They maintained that these actions demonstrated good faith and compliance with the Code’s requirements concerning accuracy, fairness and the prompt correction of errors.
The 3rd Respondent’s Response:
- Despite being duly notified of the complaint, the 3rd Respondent failed to submit a response or cooperate with the Data Commissioner’s investigation.
- The Data Commissioner scheduled a site visit for 13th and 14th July 2026 and requested the attendance of the 3rd Respondent’s Data Protection Officer, ICT personnel and an authorised representative to facilitate the investigation.
- However, the 3rd Respondent failed to cooperate with the scheduled visit or provide the requested assistance. Consequently, the Data Commissioner issued a further reminder on 23rd July 2026, granting the 3rd Respondent an additional seven (7) days to comply.
- Notwithstanding the extension, the 3rd Respondent neither responded to the complaint nor complied with the Data Commissioner’s requests.
Data Commissioner’s Determination
The Data Commissioner held as follows:
- Section 51(2)(b) of the Act provides an exemption from the application of the Act where the processing of personal data is necessary for national security or in the public interest. The publication concerning the health crisis at Sacred Heart Mukumu Girls’ School, which involved student deaths and hospitalisations, constituted a matter of legitimate public interest, particularly in relation to public health and student safety.
- Section 52(1) of the Act further provides exemptions relating to processing undertaken for the publication of literary or artistic material where the data controller reasonably believes that publication would be in the public interest and that compliance with the applicable data protection principles would be incompatible with that purpose. Section 52(2) requires such belief to be demonstrable by reference to a relevant self-regulatory code of ethics.
- The Data Commissioner found that Nation Media Group’s Editorial Policy Guidelines and Objectives constituted a relevant selfregulatory code of ethics for purposes of Section 52(2) of the Act. The 1st and 2nd Respondents had demonstrated compliance with the Code, particularly through the prompt correction and public apology issued following the erroneous publication of the 1st Complainant’s photograph.
- Accordingly, the Data Commissioner upheld the 1st and 2nd Respondents’ objection to jurisdiction and held that, by virtue of the exemptions under Sections 51(2)(b) and 52(1)(b) of the Act, the Office lacked jurisdiction to determine the complaint against them. The complaint against the 1st and 2nd Respondents was therefore dismissed.
- Regarding the 3rd Respondent, the Data Commissioner found that the 1st Complainant’s photograph had initially been collected in 2020 for the specific purposes of school admission and administration. However, its subsequent disclosure to the 1st and 2nd Respondents in May 2023 for journalistic publication constituted a separate processing activity undertaken for a purpose materially different from, and incompatible with, the original purpose of collection.
- The Data Commissioner observed that the subsequent disclosure could not reasonably be regarded as a continuation of the original processing activity. Consequently, the fact that the photograph had been lawfully collected for admission and administrative purposes did not, in itself, authorise its subsequent disclosure to third parties for publication.
- 31(3)(a) of the Act requires a data controller to obtain the consent of a child’s parent or guardian before processing the child’s personal data. The 3rd Respondent had not demonstrated that it obtained the consent of the 2nd Complainant, being the 1st Complainant’s parent and legal guardian, before disclosing the photograph. The Data Commissioner therefore found that the 3rd Respondent lacked a lawful basis for the subsequent processing of the 1st Complainant’s personal data.
- The Data Commissioner further held that the 3rd Respondent breached the principles of lawfulness, fairness, transparency, purpose limitation and data minimisation under Section 25 of the Act. In particular, the disclosure of the photograph for journalistic publication was incompatible with the purpose for which it had originally been collected, and the 3rd Respondent had not demonstrated that the disclosure was necessary, proportionate or limited to that original purpose.
- Regarding the duty to notify, the Data Commissioner observed that Section 29 of the Act requires data controllers to inform data subjects of the collection and intended processing of their personal data. This obligation is not discharged merely because personal data was lawfully collected in the first instance. Where personal data is subsequently used or disclosed for a different purpose, the data controller must ensure that the data subject is adequately informed of the intended processing and its purpose.
- The Data Commissioner found that the 3rd Respondent had failed to demonstrate that the 1st Complainant or her parent and legal guardian had been informed that the photograph collected for admission purposes would subsequently be disclosed to third parties for journalistic publication. Given that the 1st Complainant was a minor, the 3rd Respondent was under an enhanced obligation to ensure that her parent or legal guardian was appropriately informed. Accordingly, the Data Commissioner found that the 3rd Respondent had breached its duty to notify under Section 29 of the Act.
- The Data Commissioner further found that the 3rd Respondent’s persistent failure to respond to the complaint, provide the requested information or facilitate the scheduled investigative site visit frustrated the exercise of the Data Commissioner’s statutory functions and amounted to obstruction under Section 61 of the Act.
Consequently, the Data Commissioner found the 3rd Respondent liable for unlawfully processing the 1st Complainant’s personal data and directed it to compensate the 1st and 2nd Complainants a total of Kenya Shillings Three Hundred Thousand (KES 300,000).
The Data Commissioner further recommended the prosecution of the 3rd Respondent’s Board of Management for obstruction of the Data Commissioner under Section 61 of the Act.
