From school photos to family disputes: Who has the right to share children's stories?

These may appear to be ordinary moments of communication or personal expression. But as more aspects of children's lives find their way onto social media, questions are emerging about who has the right to share their information, how far that right extends and what happens when the children themselves have little say in the matter.

The debate has become particularly visible in online conversations involving children of public figures, including the children of the late musician Betty Bayo, as well as discussions surrounding the late IT professional Rosemary Kimwatu. While members of the public may be seeking to understand or comment on family circumstances, the conversations can quickly extend to the children left behind, with their photographs, personal circumstances and social media posts becoming material for public discussion.

For data governance researcher Grace Bomu, the distinction between discussing a deceased person and exposing information about those who are still alive is important.

“Privacy does not extend to dead people. It's only for living people,” she says, adding that the Data Protection Act may still apply where information shared about a deceased person also touches on living relatives.

The law does not necessarily resolve every question about who is entitled to speak about a death or a family. Bomu describes some of these as moral questions, particularly where relatives are grieving and different members of a family may have competing views.

But she says the position changes when children are brought into the discussion.

The Children Act, 2022, requires that the best interests of a child be treated as a primary consideration. Bomu argues that adults who take children's photographs, posts or personal circumstances and circulate them online must consider the possible consequences for the children.

“Is it in the best interest of a child to have them all over, have discussions about them on blogs and social media? No, it's not,” she says.

Children may appear old enough to understand what is being posted about them, or may even have their own social media accounts. But their age and vulnerability mean they are still entitled to protection. Adults, including parents, content creators and members of the public, have greater power and responsibility in deciding what to publish.

The school photograph question

The same questions arise in schools, where photographs and videos of learners have become a regular feature of institutional communication and marketing.

Schools use websites and social media platforms to showcase activities, achievements and facilities, often featuring children in swimming lessons, sports days, graduations and other events. Some also produce promotional videos built around learners, presenting the school as an attractive environment for prospective parents.

Many institutions rely on consent forms signed by parents or guardians during admission. But does a general permission to photograph a child during school activities automatically allow an institution to use those images across its social media platforms or in commercial advertisements?

Kenya's Data Protection Act, 2019, provides specific safeguards for children's personal information. Section 33 requires a data controller or processor to obtain consent from a child's parent or guardian before processing the child's personal data, and to ensure that the processing protects and advances the child's rights and best interests.

The Office of the Data Protection Commissioner (ODPC) has issued a Guidance Note for the Education Sector, published in December 2023, to help learning institutions understand their obligations when collecting and processing personal information.

The document addresses issues including student records, parental consent, the publication of examination results, photographs taken in schools, data retention and the use of third-party data processors. It advises institutions to explain why they are collecting personal data, how it will be used and who may have access to it.

The guidance gives a practical example of a school sports day, advising institutions to obtain consent before the event, explain why photographs are being taken and where they will be published, and ensure that only children whose parents have granted permission are photographed. It also advises against publishing children's names alongside their photographs or using images for purposes beyond those specified in the consent form.

In November 2025, the ODPC published a separate Guidance Note on Processing Children's Data, offering further direction on the handling of children's personal information, including online and social media use.

Bomu says schools occupy a position of power because they determine what information is collected, how it is stored and how it is eventually used.

“The school itself, whenever you talk about data protection, is the more powerful actor because they are the ones who decide how the data is going to be collected. They collect the data and then decide how it is going to be used,” she says.

That power, she adds, comes with a greater responsibility to ensure information is used only for the purposes for which it was collected.

Consent is also not necessarily a once-and-for-all permission. Bomu says parents or children can ask a school to remove content they no longer want shared, and the institution should act on such a request.

She draws a distinction between sharing information about a school activity and using a child's image to market the institution.

“When the content is used for marketing, it is very different from when the content is being used for information sharing,” she says.

The Data Protection Act also addresses commercial use of personal data. Section 37 provides that personal data cannot be used for commercial purposes without the data subject's express consent, unless the use is authorised by written law and the data subject was informed when the information was collected.

A Kenyan court has already considered the limits of a school's permission to use a learner's photograph.

In a case involving FSO v Kitengela International School AthiRiver and another in 2024, a father challenged the use of his child's photograph in advertisements promoting the school and its admissions. The school argued that the parent had consented to photographs being taken during programmed school activities.

The High Court found that the use of the child's image to advertise admissions went beyond the stated purpose of photographing learners during school activities. It ruled that the child's rights to privacy and dignity had been violated, awarded Ksh. 700,000 in damages and issued an injunction barring further use of the image in advertisements or promotions without the parent's consent.

The judgment underlines the difference between documenting a school event and using a child's image to attract business. A consent form should not be treated as a blanket authorisation for every possible use of a learner's photograph.

Public channels are not private spaces

The question of where information is shared also matters.

Schools and other organisations increasingly use WhatsApp Channels to communicate updates to parents and the wider public. Unlike WhatsApp groups, where membership is restricted, Channels are public broadcasting spaces that can be accessed by anyone.

Bomu says there is a misconception that such channels are private because they sit within a messaging application rather than on an openly accessible website.

“There is a lack of understanding that these channels are not private. Maybe because it is not as open as the internet, people think that it is not public. But if it is something that can be accessed by anyone, then it is open, it is public,” she says.

That distinction matters where posts contain photographs of children, their names, activities or other details that could identify them. Information shared on a public channel can be viewed, captured and redistributed beyond the original audience.

Bomu says those running public channels need to understand that accessibility comes with a higher responsibility to protect personal information. Where information does not need to be made public, institutions should consider more restricted ways of communicating.

Even within closed groups, however, information is not guaranteed to remain private. Members may take screenshots or forward posts beyond the intended audience.

Consent is more than accepting terms and conditions

The questions raised by children's photographs and school records point to a wider issue: whether people understand what they are agreeing to when they hand over personal information.

Outgoing Data Commissioner Immaculate Kassait says organisations cannot assume that a person has given informed consent simply because they have accepted a set of terms and conditions.

“Terms and conditions do not equal informed consent,” is the central message from Kassait, who says people must be given a clear explanation of why their information is being collected and what it will be used for.

Under the Data Protection Act, consent must be freely given, specific, informed and unambiguous. A person should understand what information is being collected, the purpose of the collection and how it will be processed. The ODPC's own guidance on consent also requires that the information be presented in clear, accessible language, with consent requests separate from lengthy terms and conditions.

This distinction is particularly important when people are asked to provide sensitive personal information or are offered an incentive to do so.

The controversy surrounding Worldcoin's biometric data collection in Kenya illustrates the risks.

The project used an iris-scanning device known as the Orb to collect biometric information from people seeking to obtain a digital identity, World ID. Participants were offered cryptocurrency tokens, prompting questions about whether consent was genuinely voluntary and whether they understood the implications of surrendering highly sensitive biometric data.

The ODPC investigated the company's processing of personal and sensitive data, including iris scans and facial images, and raised concerns about the validity of consent, the transfer of data outside Kenya and the safeguards in place. It directed the company to stop processing the information in 2023.

Kassait says the regulator had engaged the company before the public controversy escalated, questioning the purpose of the processing and the legal basis on which it was relying. She disputed the company's reliance on legitimate interest, arguing that people were being signed up for a service that was supposedly going to be available in the future.

In May 2025, the High Court issued orders requiring the deletion of biometric data collected from Kenyans without the necessary safeguards. In January 2026, the ODPC confirmed that the company had deleted the biometric data collected from Kenyan citizens.

For Kassait, the case demonstrated the importance of ensuring that consent is meaningful, particularly where organisations collect sensitive information that cannot easily be changed or replaced, such as biometric identifiers.

When collecting data is justified

Not every request for personal information is unlawful. Kassait says there are legitimate circumstances in which organisations may need to collect personal details, including for security purposes.

For instance, buildings may require visitors to provide their names, identity card details and telephone numbers before being allowed entry. Such information can be necessary to maintain visitor records and protect occupants and property.

However, the organisation collecting the information must explain the purpose. Visitors should know why their details are required, how the information will be used and what happens to it after it has served that purpose.

The Data Protection Act requires personal data to be collected for explicit, specified and legitimate purposes, and limits the amount of information collected to what is necessary. Information collected for security should not automatically be repurposed for marketing or other unrelated activities.

The same principle applies to schools, employers, hospitals and other institutions that routinely collect personal information.

The challenge of enforcing the law across borders

The difficulty of ensuring that organisations handle personal data responsibly is not limited to what happens within Kenya. Information can be stored, accessed or processed in other countries, making enforcement more complicated.

Kassait points to the breach involving the State-owned Business Registration Service (BRS) and a Moldovan company, B2bhint, as an important lesson in the need for international cooperation among data protection authorities.

In February 2025, B2bhint accessed sensitive information held by BRS, including details of beneficial owners of companies registered in Kenya. The information included names, residential addresses, email addresses and telephone numbers. More than two million company records were affected, with millions of individual data items subsequently exposed and offered for sale online.

The breach brought into focus the vulnerability of government-held information and the risks posed when personal data falls into the hands of third parties without authorisation.

Kassait says the ODPC initially faced resistance when it contacted the company behind the breach. The regulator also lacked mutual legal assistance arrangements that would have made it easier to pursue an entity operating outside Kenya.

Her office therefore relied on cooperation from the European Union Commission and data protection authorities in Moldova to identify the company and secure the deletion of the exposed information.

The Moldovan firm has since confirmed that it deleted the Kenyan data following contact from authorities in both countries. However, information previously purchased from the website may still be held by those who acquired it.

The ODPC also investigated BRS and issued an enforcement notice identifying weaknesses in its information systems and requiring it to improve its security measures. Kassait says the agency implemented the recommendations, and the regulator did not escalate the matter to a penalty notice.

The case, she says, demonstrated that data protection enforcement increasingly requires cooperation beyond national borders, particularly when the organisations handling Kenyans' information are based elsewhere.

Who is accountable?

The Data Protection Act gives individuals the right to be informed about how their personal data is used, to access it, object to its processing and seek correction or deletion in certain circumstances. Where the data subject is a minor, these rights may be exercised by a person with parental authority or a guardian.

The ODPC is mandated to investigate complaints, assess compliance and take enforcement action against organisations that violate the law. Kassait says the office handled more than 13,000 complaints during her six-year tenure, issued 459 determinations and took 206 enforcement and penalty notice actions.

For parents, this means asking schools not only whether photographs will be taken, but also where they will be published, for what purpose and for how long. They can also raise concerns where an image or other personal information is being used in a way they did not agree to.

For schools and other institutions, the responsibility goes beyond obtaining a signature or displaying a lengthy privacy notice. They need to consider whether collecting the information is necessary, whether the person understands its intended use and whether the data is being protected.

And for members of the public, the growing visibility of children's lives online calls for a similar level of restraint. A child's photograph or family circumstances should not automatically become public material simply because an adult has access to it or believes there is a reason to share it.

The central question is not simply whether information can be collected or posted. It is whether there is a legitimate reason to do so, whether the person understands what they are agreeing to, whose interests are being served and what consequences may follow long after the information has been shared.