DATA PRIVACY-A WAKE-UP CALL FOR SCHOOLS

In a recent and critical development, the Office of the Data Protection Commissioner (ODPC) has taken a stern stance on data privacy rights, raising questions about how educational institutions handle the personal data of minors. Roma School, based in Uthiru, was recently penalized a substantial fine of Sh4.5 million by the ODPC for posting a minor’s picture without parental consent. This resounding decision underscores the importance of obtaining consent from parents/guardians before processing minors’ data.

In today’s digital era, where sharing moments on social media is a common practice, concerns regarding data privacy, particularly concerning children, have become increasingly prominent. The question of whether public notices and waivers can serve as valid consent for schools to share children’s photos on social media platforms during events like sports days and school functions raises crucial issues at the crossroads of data protection and educational institutions.

The Data Protection Act of 2019 and its Implications:

The Data Protection Act of 2019, which governs data protection in Kenya, casts a discerning eye on the management of personal data, especially when it involves minors. Schools, as data controllers and processors, bear the onus of ensuring compliance with these regulations. Under this legal framework, schools must obtain explicit and informed consent from parents or guardians before processing any personal data relating to a child.

Challenges Faced by Schools:

The challenge schools grapple with during vibrant events lies in determining which children have parental consent for photo sharing. Section 33 of the Data Protection Act stipulates the need for consent, underlining the importance of safeguarding a child’s rights and best interests.

Proposed Solutions for Schools and Parents:

FOR SCHOOLS:

1. Detailed Consent Forms: Implement a system where parents or guardians provide consent in advance, either at the beginning of the school year or before specific events, for the school to share their child’s photos on social media.It should also state;
2. what the photo will be used for; advertising, social media, etc
3. where the photo will be published; websites, magazines, bill boards etc
4. and for how long thew school will retain the child’s photo i.e should the child transfer or leave the school, will their photo still be used?

1. Opt-Out Mechanism: Establish an opt-out mechanism, allowing parents to communicate their objection to photo sharing. This empowers parents to exercise their rights easily.

1. Technology Solutions: Leverage technology to streamline the consent process, age verification, and data protection compliance. Digital consent forms and tracking systems can efficiently manage consent records.

1. Clear Communication: Maintain clear and transparent communication with parents regarding the school’s photo-sharing policies and practices. Parents should be informed about the purposes and methods of photo sharing.

• Consent Identifiers– Have easy identifiers such as wrist bands on children whose parents have not issued consent.

FOR PARENTS:

1. Check for School Policies: Inquire if your child’s school has a well-defined student photo policy that aligns with the Data Protection Act of 2019.

1. Review Consent Forms: Ensure you receive a clear and detailed photo consent form that outlines how the school may use your child’s photos across various channels.

1. Assess Consent Validity: Confirm that the consent you provided is voluntary, informed, current, and specific. It should grant the school permission to use your child’s photos for specific purposes.

1. Awareness of Usage: Familiarize yourself with all possible ways your child’s photo could be used by the school. This knowledge enables you to make an informed choice regarding granting or refusing permission.

Legal Implications for Non-Compliance:

Non-compliance with the Data Protection Act carries significant penalties. Section 63 of the Act outlines penalties of up to five million Kenyan shillings or up to one per centum of the school’s annual turnover from the preceding financial year, whichever is lower. Schools and parents must take this obligation seriously to avoid potential penalties.

Conclusion:

While schools aim to celebrate events and activities, they must do so within the framework of data protection laws. By implementing the proposed solutions and fostering open communication with parents, schools can strike a balance between their objectives and compliance with the law. Parents, in turn, can exercise due diligence in assessing school policies and consent forms to protect their child’s personal data.

These penalties by the ODPC and the resulting dialogue emphasize the critical need for schools and parents to navigate the complex landscape of data privacy rights together. Responsible data management practices are the cornerstone of educational institutions’ commitment to their students and their families in an era marked by evolving technology and data privacy concerns.