Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Roma School was penalized for non-compliance with the Data Protection Act after publishing a minor's image online without consent. Roma School challenged the penalty, arguing they hadn't received the initial Enforcement Notice due to improper service. The court found the electronic service of the notice to be valid, upholding the penalty and the ODPC's actions.

Facts

Christine Muturi filed a complaint with the Office of the Data Protection Commissioner (ODPC) against Roma School Uthiru on 22nd May 2023. The complaint alleged that the school had published an image of a minor on social media without obtaining consent from the parents or guardian. The ODPC notified the school of the complaint on 9th June 2023 via email and physical delivery. Roma School responded on 6th July 2023, requesting further details and clarification on the allegations.

<aside> 📑

Read the original case here:

Christine Wairimu Muturi vs. Roma School Uthiru - ODPC Complaint No. 0841 of 2023

</aside>

On 11th August 2023, the ODPC issued an Enforcement Notice to Roma School outlining remedial measures. The ODPC alleges this was served via email on 15th August 2023.

Roma School claimed it was not served with the Enforcement Notice and only became aware of it when a Penalty Notice was issued on 25th September 2023. The Penalty Notice demanded a payment of Kshs. 4,550,000 for failure to comply with the Enforcement Notice.

Roma School argued that the penalty was unfair as they were not given an opportunity to respond to the Enforcement Notice due to a lack of proper service, violating their right to a fair hearing. The school argued that the ODPC should have ensured the Enforcement Notice was delivered with a delivery receipt and served personally, as previous correspondence had been.

The ODPC argued that they had served the Enforcement Notice electronically to the school's email address, as permitted by the relevant regulations. The ODPC also claimed that the school had failed to sufficiently respond to the complaint and was therefore in violation of several sections of the Data Protection Act, 2019.

Issues for determination by the court:

• Was the Enforcement Notice served on Roma School properly and in accordance with the law and principles of fair administrative action?
• Did the ODPC violate Roma School's right to a fair hearing by issuing a Penalty Notice without ensuring the school had received and had the opportunity to act upon the Enforcement Notice?
• Did the ODPC's reliance on electronic service of the Enforcement Notice satisfy the requirements of procedural fairness and natural justice, especially given previous personal service of documents?

Laws reviewed by the court: