Background:
In Julian Rowa (Suing on Behalf of a Minor AJR) v The Nairobi Academy, the Complainant alleged that the Respondent unlawfully disclosed and caused the publication of his child’s personal data, specifically the child’s name and examination results, in the Daily Nation newspaper of Thursday 21st August under the Advertising Feature section.
The Complainant further stated that a similar publication had occurred in 2023. After he raised concerns regarding that disclosure, the Respondent assured him that the minor’s personal data would not be shared or published without his consent. Despite that assurance, the Respondent subsequently disclosed and caused the minor’s name and examination results to be published in the Daily Nation newspaper on 21 August 2025.
Respondent’s Response
The Respondent stated that:
- The minor’s examination results were included in material shared with Nation Media Group as part of a general update on the school’s academic performance.
- No express parental consent had been obtained prior to the disclosure of the minor’s personal data.
- The publication was not intended to profile, market, or commercially exploit the minor’s personal data.
- The Complainant’s enquiries were not addressed in a timely manner.
- The incident occurred as a result of lapses in its internal procedures governing the disclosure of learners’ personal data.
- It had since implemented internal reforms and enhanced safeguards to mitigate the risk of a similar occurrence in the future.
Data Commissioner’s Determination:
The Data Commissioner held as follows:
- A minor’s name constitutes personal data under Section 2 of the Data Protection Act, 2019. Further, when combined with contextual information such as the school attended and examination results, the minor is identifiable and therefore falls within the definition of personal data.
- Section 30(1)(a) of the Act prohibits the processing of personal data unless the data subject has consented to the processing or the processing is otherwise justified under Section 30(1)(b) of the Act.
- Section 33(1) of the Act prohibits the processing of a child’s personal data unless consent is obtained from the child’s parent or guardian and the processing protects and advances the rights and best interests of the child.
- Section 37(1) of the Act provides that “a person shall not use, for commercial purposes, personal data obtained pursuant to the provisions of this Act unless the person has sought and obtained express consent from the data subject or is authorized to do so under any written law and the data subject has been informed of such use when collecting the data from the data subject.”
- Regulation 14 (1) of the Data Protection (General) Regulations 2021 defines commercial purposes as use of personal data for commercial purposes where personal data of a data subject is used to advance commercial or economic interests, including another person to buy, rent, lease, join, subscribe to, provide or exchange products, property, information or services, or enabling or effecting, directly or indirectly, a commercial transaction.
- It was not disputed that the Respondent disclosed the minor’s personal data to a third party, which resulted in the publication of the minor’s name and examination results in a national daily newspaper.
- The publication appeared under the newspaper’s “Advertising Feature” section, demonstrating that the disclosure was promotional in nature rather than editorial in nature.
- The use of the minor’s identifiable academic information in this context showed that the personal data was processed for purposes extending beyond academic administration, namely, to advance the Respondent’s commercial and economic interests by promoting its institution to prospective clients.
- The processing of a minor’s personal data for such commercial purposes required prior express parental consent. The Respondent has admitted that no such consent was obtained before the disclosure and publication of the minor’s personal data.
- Section 36 of the Act provides that a data subject has a right to object to the processing of their personal data, unless the data controller or data processor demonstrates compelling legitimate interest for the processing which overrides the data subject’s interests, or for the establishment, exercise or defense of a legal claim.
- The evidence on record showed that prior to the impugned publication, the Complainant had expressly exercised his statutory right to object to the processing of his child’s personal data, which the Respondent acknowledged and expressly assured the Complainant that it would not disclose or publish the minor’s personal data going forward.
- However, notwithstanding this clear objection and assurance, the Respondent subsequently proceeded to share and disclose the minor’s personal data to a third party, which disclosure resulted in the publication of the minor’s name and individual examination results in the Daily Nation newspaper.
- Once the right to object had been exercised, the Respondent was under a legal obligation to cease the disputed processing unless it could demonstrate compelling legitimate grounds overriding the rights and best interests of the data subject, particularly given that the data subject was a minor. The Respondent did not demonstrate the existence of any such overriding grounds.
- Further, having acknowledged the objection and undertaken not to process the minor’s personal data in that manner, the Respondent was required to ensure that no further disclosure occurred and to implement appropriate internal controls to prevent disclosure to third parties. Its failure to do so directly enabled the unlawful publication of the minor’s personal data.
The Data Commissioner found that the Respondent unlawfully processed the minor’s personal data for commercial purposes and violated the Complainant’s right to object and directed the Respondent to pay the Complainant the sum of Kenya Shillings Six Hundred and Thirty-Seven Thousand, Five Hundred. (KES 637,500/-) as compensation.
