Christine Muturi Vs Roma School Uthiru

1. Introduction

This case involves a complaint regarding the processing of minors’ personal data by an educational institution for marketing purposes on social media platforms without proper consent. The Office of the Data Protection Commissioner investigated alleged violations of the Data Protection Act, 2019 concerning children’s privacy rights.

2. Nature of Complaint

The complainant alleged that:

• The school planned to process images of minors on TikTok and other social media platforms without parental consent
• No adequate data protection measures were provided when requested
• The school failed to respond to parental concerns about children’s privacy and safety
• The processing was intended for marketing purposes without proper justification

3. Analysis of Evidence

Complainant’s Position

• Provided WhatsApp screenshots showing school’s intention to use children’s images
• Demonstrated legitimate parent status through school fee receipts
• Showed school’s failure to provide requested data protection documentation
• Expressed valid concerns about children’s safety and privacy rights

Respondent’s Defense

• Initially denied knowledge of complainant or alleged violations
• Claimed not to use minors’ data for marketing
• Failed to provide substantive response after complainant’s evidence was shared
• Did not demonstrate compliance with child data protection requirements

4. Issues for Determination

1. Whether the Respondent processed children’s personal data in accordance with the Data Protection Act
2. Whether the Respondent breached its obligations under the Act

5. Final Determination

6. Significance and Impact