Mukumu Girls Fined Sh300,000 for Sharing Student Photo Without Parental Consent

What Happened
The Office of the Data Protection Commissioner (ODPC) has ordered the Board of Management of Sacred Heart Mukumu Girls' High School in Kakamega County to pay Sh300,000 in compensation after finding the institution liable for unlawfully processing and sharing a former student's photograph without the required parental consent.

The decision, announced on August 20, 2026, also included a recommendation for criminal prosecution of the school's Board of Management under Section 61 of the Data Protection Act for obstructing the Commissioner's investigation.

The dispute dates back to the 2023 health crisis at Mukumu Girls, when students became seriously ill following what was reported at the time as suspected food and water contamination. During the crisis, a photograph of a student who was then 17 years old appeared in a Saturday Nation report concerning the situation at the school.

The report reportedly created the impression that the student had died, although she was alive and had already been discharged from hospital. Nation Media Group later issued a correction and apology.

The ODPC found that the student's photograph had originally been collected by the school in 2020 for admission and administrative purposes. Sharing the photograph with an external media organisation in 2023 for journalistic publication amounted to processing the personal data for a purpose materially different from the original reason for which it had been collected.

The Commissioner concluded that the school had failed to demonstrate that it obtained consent from the student's parent or legal guardian before making the disclosure, citing violations of important principles under Kenya's Data Protection Act, 2019, including lawfulness, fairness, transparency and purpose limitation.

The ODPC also said the Board failed to adequately respond to notifications, did not provide the required cooperation and failed to participate in an official site visit scheduled for July 13 and 14, 2026. A final reminder was reportedly issued on July 23, but the regulator still considered the Board's conduct to amount to obstruction of the Commissioner's statutory investigations.

Why This Matters
The case is particularly significant because the photograph belonged to a person who was a minor. Under the Data Protection Act, children's personal data receives additional protection, and institutions handling such information have a heightened responsibility to ensure that it is processed lawfully and appropriately.

The matter involved Grace Ellah Indoshi and Felistus Khadi Mukami, who challenged the handling and publication of the student's information. Court records show that the matter had earlier reached the High Court, where the complainants sought orders compelling the ODPC to act on their complaint concerning the photograph and its publication.

Interestingly, the ODPC did not find Nation Media Group and journalist Hellen Shikanda liable in the same manner. Reports on the determination indicate that the Commissioner dismissed the complaint against the media organisation and journalist, citing the applicable journalistic considerations and jurisdictional limitations. The Commissioner also took into account the fact that the media organisation published a correction and apology shortly after the inaccurate report.

Community Impact or Background Context
The ruling carries a wider message for schools across Kenya. Schools routinely collect photographs, medical information, academic records, contact details and other personal information about learners. The fact that a school legitimately possesses a photograph does not automatically mean it can freely share or repurpose that photograph for another purpose.

The Mukumu Girls decision demonstrates that institutions need to consider why information was collected, whether a new use is compatible with that purpose, whether the necessary consent has been obtained and whether parents or guardians have been properly informed.

For parents and guardians, the case reinforces the principle that children do not lose their privacy rights simply because they attend school or because a school has photographs and other information about them. Schools must establish clear procedures governing the use and disclosure of learners' information, particularly when dealing with the media, social media platforms or other external organisations.

Safety & Prevention
To avoid similar violations, schools should:

• obtain written parental or guardian consent before sharing any learner's personal data with third parties;
• clearly document the purpose for which photographs and other personal information are collected;
• ensure that any new use of personal data is compatible with the original purpose;
• train staff on data protection requirements and the rights of learners and parents;
• establish a data protection policy and designate a data protection officer or focal person.

Parents and guardians should also ask schools how their children's information will be used and request written confirmation before consenting to any data sharing.

What Happens Next
As a result of the Board's conduct during the investigation, the ODPC recommended criminal prosecution under Section 61 of the Data Protection Act for obstructing the Commissioner's investigation.

Reports indicate that the provision carries serious potential consequences, including a fine of up to Sh5 million, imprisonment for up to two years, or both, if an offence is established. It is important to note that a recommendation for prosecution is not itself a criminal conviction; any criminal liability would have to be determined through the appropriate legal process.

The school is expected to pay the Sh300,000 compensation to the complainants, and the matter may proceed to court if the Board contests the ODPC's findings or if criminal charges are filed.

Share Your Thoughts

We would like to hear from you.

• Should schools be required to obtain parental consent before sharing student photos?
• How can parents better protect their children's privacy in educational settings?
• Do you think the Sh300,000 compensation is sufficient for the violation of a minor's privacy rights?

For official updates or emergency assistance, residents are advised to contact the relevant authorities.