Top Tweets for #DataProtectionLaw

In Kenya, in Julian Rowa (suing on behalf of a minor AJR) v The Nairobi Academy, ODPC Complaint No. 1597 of 2025 (19 Jan 2026), the school was ordered to pay KSh 637,500 after the Office of the Data Protection Commissioner found that it unlawfully processed a minor’s personal data by publishing the learner’s name and exam results in the Daily Nation newspaper under an advertising feature section showcasing its academic performance, without parental consent. The parent argued that the disclosure had no consent or lawful basis and was intended to promote the school, while the school maintained that it was merely a general academic update. The Commissioner held that the publication amounted to processing a child’s data for commercial benefit, reaffirming that schools are data controllers and must obtain explicit parental consent before using minors’ data for promotional purposes. Key takeaway for Ugandan schools: Always obtain parental consent before publishing or using a child’s personal data, including results, photos, and names, especially for promotional or commercial purposes such as highlighting performance in PLE, UCE, or UACE.