In a significant development, Roma School, an educational institution based in Uthiru, Nairobi, has been fined a substantial amount of Ksh 4.5 million by the Office of the Data Protection Commissioner for failing to comply with the Data Protection Act.
The Data Protection Commissioner’s office made this decision after Roma School allegedly posted photographs of minors without obtaining prior consent from their parents or guardians. This action violates the Data Protection Act and underscores the importance of ensuring the privacy and security of individuals’ data, especially when it comes to children.
This marks a crucial milestone, as it is the highest penalty ever imposed on an educational facility for such a breach. According to a statement released by the Data Protection Commissioner’s office on a Tuesday, “Roma School, an Educational Institution based in Uthiru has been fined Ksh 4,550,000 for posting minors’ pictures without parental consent.” This hefty penalty serves as a stern reminder to all educational institutions and entities handling personal data, particularly data concerning minors.
This case highlights the critical need for schools and similar institutions to adhere to the principles and safeguards outlined in the Data Protection Act. In particular, it underscores the essential requirement of obtaining explicit consent from parents or guardians before processing any data related to minors.
Immaculate Kassait, the Data Commissioner, stressed the importance of compliance with the Data Protection Act and the responsibility of data controllers and processors to ensure that personal data processing aligns with the provisions of the Act. She emphasised that failure to comply with the Act would result in the institution of enforcement procedures.
While Roma School’s director acknowledged receiving the letter from the Data Protection Office regarding the fine, he expressed his surprise, stating:
“I don’t understand what is happening because I have not received any complaint from anyone regarding the matter.” Despite this, he expressed his intention to visit the Data Protection Commissioner’s office to further discuss and clarify the situation.
The penalty notices issued to Roma School are based on Sections 62 and 63 of the Data Protection Act, 2019 (Act), and Regulations 20 and 21 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. This significant fine serves as a strong message to educational institutions and all entities entrusted with personal data, urging them to prioritize data protection and seek appropriate permissions, especially when dealing with minors. It reinforces the importance of safeguarding individuals’ privacy rights and adhering to the regulations set forth by the Data Protection Act.