The Office of the Data Protection Commissioner (OPDC) has today imposed fines totalling Sh9 million on three businesses for violations of data privacy regulations.

In an official announcement, the agency disclosed that the fines were levied against a private school, a digital credit provider and a nightclub, each for distinct breaches.

The private school, Roma School as mentioned by ODPC incurred a Sh4.5 million penalty for the unauthorized posting of a minor’s photos on its social media platforms without parental consent.

Meanwhile, Mulla Pride Ltd, the named digital credit provider faced a Sh3 million fine for utilizing the names and contact information of individuals acquired from third parties.

Additionally, Casa Vera Lounge, the nightclub mentioned by the ODPC, which is located in Ngong, Nairobi, was fined Sh1.9 million for sharing revellers’ images on their social media platforms without obtaining proper consent.

The OPDC emphasized that the fine imposed on the private school was the most substantial ever imposed on an educational institution, serving as a cautionary example to other schools regarding the importance of obtaining consent before sharing personal data.

In a statement, the OPDC explained, “The Office of the Data Protection Commissioner (ODPC) has issued three Penalty Notices to three Data Controllers for failing to respect Data Privacy Rights of Data Subjects and for non-compliance with the Data Protection Act.”

Furthermore, the agency stated that the penalty imposed on the digital credit provider was intended to discourage similar actions in the future.

“This penalty will ensure that digital lenders and financial institutions notify data subjects when collecting and processing their data, along with disclosing the purpose of processing said data,” the statement concluded.