Data privacy and protection of Children are not mere data compliance boxes that Nigerian Schools must tick.
The consent-based approach to processing a Child’s data and the stringent protective regime under the Nigerian Data Protection Act 2023 traces its roots to the 1999 Constitution (as amended) through the Child Rights Act 2003.
Background
Windy School offers preschool and primary education to its Dugbe, Abuja community. Windy School is proud of its diversity, inclusivity, and equity.
So, its cultural day celebration was a show of DEI aimed at deemphasising ethnicity among the school community.
Titi, the headteacher’s child, manages Windy School’s website and social media platforms.
The basic science teacher’s undergraduate student at Pan-Atlantic University’s School of Media and Communication is responsible for the school’s photography, audio-visual, and voice production.
The photographer dutifully covered the well-attended cultural day celebration. He emailed the improved media materials from the cultural day to Titi a day after the school events. Titi shared children’s pictures and audio-visuals on social media.
Windy School’s image rights and data privacy policy did not anticipate data anonymisation, and the website has no on-copy, on-cut, and on-paste attributes.
These are protection measures to prevent copying, cutting, and pasting of images from the website.
Moreover, Windy School’s copyright policy imposed no restriction, and Titi turned off the RSS (Really Simple Syndication) Feeds.
As education lawyers, we understand how Nigerian schools face similar challenges in a highly globalised digital environment.
Inadequate data privacy and protection policies in Nigerian schools hurt Children’s Constitutionally enshrined right to privacy and the best interest of the child’s principle under the Child Rights Act and domesticated Conventions.
Our education lawyers are determined to assist Nigerian schools, parent associations, teachers, school administrators, regulators, and non-profit educational organisations manage children’s data privacy and protection.
Child’s Data Privacy and Protection
Indeed, children’s data include biometrics, pictures, names, home addresses, examination and other assessment result sheets, mobile numbers, and audio or visual images.
Since a child cannot consent to data processing, Nigerian school admission packs must be updated to incorporate privacy and data protection policies.
Students’ or pupils’ rights to data privacy and protection trace their roots to the Constitutionally guaranteed rights to privacy.
It is through the Child Rights Act 2003, the Nigerian Data Protection Act 2023, and domesticated conventions.
Therefore, the data security and protection regime under the Nigerian Data Protection Act 2023 applies most rigidly to a child.
A student or pupil enjoys inviolable data confidentiality, security, and privacy.
A child’s parents or legal guardian alone can consent to processing a child’s data during school events.
Windy School would have violated children’s rights to privacy if pupils’ parents or legal guardians did not consent to the photography session or sharing images on social media handles.
Nigerian schools must apply the data security measures we highlighted above that arise from the data protection regime under Nigerian laws.
Duty to inform the Commission
Schools must notify the Commission within 73 hours of each data breach. Statutory penalties for a school’s data breach range from ₦2million to ₦10million or 2% of the school’s gross annual revenue.
Data subjects are entitled to compensation for data breaches under civil law.
Conclusion
Given the broad definition of personal data under the Nigerian data protection regime, children’s images are personal data.
Moreover, schools that obtained required documents to photograph and video children during school events must implement data protection measures that include the following:
1. Pseudonymisation or other methods of personal data de-identification.
2. On-copy, on-cut, and on-paste attributes.
3. Periodic risk assessments of processing systems and services.
A school prioritising students’, parents’, and guests’ rights ensures data security, confidentiality, and integrity.
SRJ Legal is the first bespoke education law firm. We complement our education law practice with fintech and commercial dispute (litigation). At the same time, we provide corporate counsel services to businesses and individuals, including families.
