Data Protection Office to Hold Crisis Meeting With Schools Over Pupils' Photos

 Immaculate Kassait
A photo of Data Commissioner Immaculate Kassait during a function on November 23, 2022.
Office of the Data Protection Commissioner (ODPC)

The Kenya Private Schools Association (KPSA) has called for a meeting with Data Commissioner Immaculate Kassait to discuss guidelines and modalities to adopt when dealing with children's photos that are either published online or on print.

Speaking on Hot 96 on Wednesday, Commissioner Kassait said that the meeting will enhance compliance even as parents continue to raise concerns over schools sharing their children's photos online without their consent.

During the interview, Kassait further reiterated that posting children's images online exposes them to various risks such as cyberbullying, especially for children in their tender ages.

While stressing the issue, Kassait referred to the recent case when the agency penalised 3 institutions Ksh9.4 million for violating privacy rights. 

Kenyan Data Commissioner Immaculate Kassait gives an address at a past event.

One school based in Kiambu County was penalised Ksh4.5 million for posting a minor's picture without consent from parents. 

This, according to Kassait, will serve as a strong warning to institutions handling minors' photos.

To ensure that Kenyan institutions in various industries respect data privacy, the Commissioner explained that her office has developed Guidance Notes clarifying all issues surrounding privacy issues and concerns.

"The issue around school is more sensitive because you're dealing with children. When it comes to children, you're supposed to take more caution because you have to deal with guardians. In this particular case, when it was children's images that were online and then posted on TikTok for commercial purposes and there's no consent from the guardian," she stated.

"These are children who we must protect as a society. Having children's images out there can expose them to such risks, in the case of Europe, people are using artificial intelligence to superimpose people's images on children in an absurd way, so you have to be extremely careful. Having said that, I know we're in a culture of sharing, hence it's a challenge for many schools."

The Data Commissioner also gave a breakdown of why she fined a nightclub Ksh1.8 million for posting a reveler's image without consent.

In coming up with the figure, Kassait explained the fine amount depends on the severity of the infraction.

Other factors are also considered including; the frequency of the offence and whether the institution takes remedial measures from the time they are informed of the violation.

"By the time we fine any institution, there has been almost 90-day conversation, it's not an instant fine. If we establish, there's a breach, we give a 30-day notice, to perhaps bring down the posters or rectify the issue. If you do not, that is when we impose penalties," she added.

Revelers at a nightclub in Nairobi
Revelers at a nightclub in Nairobi.