By 
By John Syekei, Partner and Head of IP and Technology, Richard Odongo, Senior Associate, and Flora Mukasa, Associate, Bowmans Kenya
Across East Africa, regulators are drawing a hard line on the misuse of children’s personal data – and two recent rulings in Kenya and Tanzania make that crystal clear. In both the Roma School Uthiru case in Kenya and the Cecilia Maliganya case in Tanzania, authorities found that minors’ images had been used online for commercial gain without parental consent, triggering substantial fines and enforcement action. This analysis unpacks how the regulators approach consent, children’s rights, and what these landmark rulings mean for anyone processing a minor’s data in the digital age.
In a world where we share every milestone of our lives through a digital lens, it becomes increasingly imperative to protect our personal data, and especially that of minors.
RELATED: Kenya confirms major data breach exposing millions of company records
Whether it is a picture posted on social media or any form of advertisement involving children, one fundamental principle remains constant: the consent of the parent, guardian or caregiver. This free and unequivocal consent is essential before a minor’s image, name, personal details, or any other form of data is generally processed, displayed or posted online.
How Kenya and Tanzania Are Enforcing Data Privacy Regulations
When it comes to protecting personal data in Kenya and Tanzania, the Office of the Data Protection Commissioner (ODPC) in Kenya and the Personal Data Protection Commission (PDPC) in Tanzania are the key regulators.
This analysis, compares the Roma School Uthiru case in Kenya and the Cecilia Maliganya case in Tanzania, highlighting how each regulator assesses parental consent, children’s rights, and what this means for organisations handling minors’ data.
Kenya: Christine Wairimu Muturi V Roma School Uthiru, ODPC Complaint NO. 0841 OF 2023 (the Roma School Uthiru case)
In this case, Roma School Uthiru was sharing images of minors on social media platforms for marketing and advertisement without firstly obtaining the express consent of the respective parents or guardians. A complaint was then lodged with the ODPC, citing violations of the Data Protection Act, 2019 (DPA).
Upon investigation, the ODPC found that Roma School had indeed processed the personal data of minors unlawfully, breaching several provisions of the DPA, including the principles of data protection, the rights of data subjects, and specific rules governing the processing of children’s data.
Parental Consent Required for Processing Children’s Data
According to the DPA, data relating to a child can only be processed with consent from the child’s parent or guardian, and such processing must ensure the protection and advancement of the child’s rights and best interests. Notably, the school failed to notify parents and obtain valid consent before using the images for marketing purposes. I
n response, the ODPC issued both an enforcement notice and a penalty notice and subsequently fined the school. As a result, the ODPC imposed a considerable monetary fine of KES 4.55 million (approx. USD 35 000) on Roma School Uthiru.
Tanzania: Nyangoma Mwesingwa V Cecilia Maliganya Complaint NO. PDPC/CMP/002/2025 (the Cecilia Maliganya case)
The PDPC delivered its first-ever ruling on the protection of children’s personal data under the Personal Data Protection Act, 2022 (PDPA). Nyangoma Mwesingwa (Complainant), acting as a next friend of her newborn child (CAG), discovered that a photo of her newborn had been posted on a social media account belonging to Cecilia Maliganya, a businesswoman selling maternal and child products.
The image, captioned with a promotional message, had gone viral, garnering over 1 114 shares, 857 likes and 32 comments. Despite repeated requests from the Complainant and her relatives to pull down the post, Cecilia Maliganya (Cecilia) refused, prompting the Complainant to file a formal complaint with the PDPC.
Children’s Images Classified as Sensitive Personal Data
The PDPC found that Cecilia had unlawfully processed sensitive personal data by posting and commercialising the image of a minor without parental consent. The PDPC emphasised that children’s images constitute sensitive personal data and that their use for commercial gain without consent violates both the PDPA and the child’s rights to privacy and dignity.
The PDPC ruled that Cecilia’s actions breached the data subject’s right to erasure under regulation 17 of the Personal Data Protection (Personal Data Collection and Processing) Regulations, GN. No. 449C of 2023. The PDPC further emphasised that the PDPA prohibits the processing of a child’s personal data without the prior written consent of the parent and guardian.
As a result, the PDPC ordered Cecilia to delete all the images of the child from her social media platforms within 14 days, pay general damages of TZS 20 million (approx. USD 8 132) to the Complainant, and a fine of TZS 5 million (approx. USD 2 032) to the PDPC.
Key takeaways and conclusions
The Roma School Uthiru case in Kenya and the Nyangoma Mwesingwa case in Tanzania both highlight the growing importance of safeguarding minors’ personal data in the digital age. In both instances, the OPDC and PDPC found that images of minors had been unlawfully processed and shared online without parental consent.
Despite the slight differences in context and nuance, both cases involved the unauthorised use of minors’ data for commercial gain, and both regulators emphasised the centrality of parental consent under their respective data protection laws.
These decisions not only affirm the legal protections afforded to children under the DPA and PDPA but also signal a firm regulatory stance against the exploitation of minors’ data.
For organisations and individuals handling minors’ personal data, the message is clear: consent is not optional, and any infractions, however slight could expose an organisation thereby attracting significant legal and financial consequences.
