On the night of May 27, 2026, a dormitory at Utumishi Girls Academy in Gilgil caught fire. Sixteen students died and 79 others were injured when a fire tore through the Meline Waithera block, a dormitory housing approximately 220 students. In the days that followed, CCTV footage from inside the dormitory went viral, broadcast on television, shared across WhatsApp, dissected on X. The footage aired by a local TV station showed students walking through the dormitory moments before the fire broke out, revealing how persons of interest moved from cube to cube before the blaze erupted near the exit points, trapping dozens of students who were still sleeping. Then a second conversation started- quieter, but just as uncomfortable. CCTV footage showed girls inside their dormitory. They were minors. They hadn’t consented to being filmed. They hadn’t consented to their images being broadcast on national television. And now, some of them are facing murder charges partly based on that footage.
There has been a lot of chatter about whether this violates their right to privacy, but we ask a different question: Was it right for that footage to go viral?
The first thing to establish is where the cameras were. Some observers noted that the footage appeared to have come from corridor and common area cameras, not from inside sleeping cubes themselves. Kenyan law does not ban CCTV in schools outright. The ODPC Guidance Note for the Education Sector specifically recognizes public safety as a lawful basis for processing personal data, noting that educational institutions may need to process such data to ensure the safety of their students and staff, for instance, using CCTV cameras. The Data Protection Act 2019 similarly permits video surveillance where there is a legitimate purpose, a proper legal basis, and where the processing is proportionate to that purpose.
But what the law does not permit, under any framing, is placing cameras where children sleep, bathe, or change. Lawyer Dr Vellah Kigwiru was direct on this: legally installing CCTV where minors sleep and change is a violation of their right to privacy. She also pointed to the 2025 ODPC Guidance Notes for Processing Children’s Data, which recognizes children’s visual data as sensitive data and requires data controllers and processors to provide additional safeguards.
Article 31 of the Constitution of Kenya protects every person’s right to privacy including the right not to have their home or private communications searched, and not to have the privacy of their communications infringed. A dormitory is, for a boarding student, functionally their home. So, the location of the cameras is question number one, and from what the footage shows, it may not have a clean answer. The footage itself appeared to show beds placed in corridors, a visible sign that the dormitory was overcrowded, and the Education CS later confirmed that the school had 715 students admitted in 2026 against a capacity of 650.
The ODPC’s Guidance Note for the Education Sector specifically flagged the use of CCTV cameras in boarding schools as one of the privacy concerns that prompted the guidance in the first place, alongside issues like publishing exam results publicly and posting students’ photos without consent. The office did not say CCTV is impermissible, but it requires careful handling. Under the Data Protection Act and the ODPC’s framework, a school installing CCTV is a data controller. That means it must: identify a lawful basis for the processing; inform data subjects, meaning students, parents, and guardians, about the surveillance, its purpose, and define a retention period appropriate to the stated purpose; the ODPC’s guidance requires that this period be specified, justifiable, and tied to the reason for processing, and delete footage once that period has lapsed unless it is required for a specific, ongoing matter.
The ODPC’s sectoral guidance notes are designed to help data controllers and processors understand their obligations under the Data Protection Act, and the education sector note specifically covers all institutions operating in Kenya, from primary schools to universities. For a boarding school with minors, the bar is higher. The standards of protection as they relate to children’s privacy and data protection are deliberately elevated, because children are considered a vulnerable category of data subjects. It means parents and guardians should have been informed. It means the school should have a written CCTV policy. Whether Utumishi had any of that is a question no one in authority has yet answered publicly.
Here is where the conversation on X has mostly missed the point. The debate has been framed as: was it okay to have CCTV in the dormitory? But there is a second, distinct legal issue, and it may be the more clear-cut violation.
Whatever one says about the installation of the cameras, the footage was released to the public and broadcasted on national television before any court had authorized it. The girls in it, including some who are suspects and some who are not, are minors. The footage spread across social media within hours. The prosecution itself raised alarm in court about the footage having caused public anger, noting that members of the public were “baying for their blood” as a result.
The Data Protection Act is clear that personal data cannot be disclosed to the public without a lawful basis. The fact that the footage was useful for an investigation does not automatically make its public broadcast lawful. Evidence can be relevant to a criminal case and still be improperly disclosed. These are not the same things. The Children Act 2022 adds another layer. It contains explicit protections for the identity and privacy of children involved in legal proceedings. Publishing or broadcasting information that identifies a child in conflict with the law requires judicial authorization. Whether that authorization existed before the footage aired is, at minimum, a live question.
There is something worth sitting with in all of this. A dormitory is the only home these girls had at school. They slept there, changed there, existed there in the way that teenagers exist, unguarded, unselfconscious. The school stood in place of their parents. That relationship carries both the authority to surveil and the responsibility to protect.
Dr Kigwiru noted that schools are still required to justify why cameras were installed, how they were used, and whether students were aware of their presence, even where there is a legitimate safety argument. Kenyan boarding schools have a documented history of fires, bullying, and peer-on-peer harm, and the absence of cameras has historically meant the absence of accountability. Utumishi’s cameras, whatever their legal status, did produce evidence when 16 girls died.
But the same school had 715 students in a facility built for 650. The cameras caught who allegedly started the fire; they did not prevent the conditions that turned a fire into a massacre. Surveillance cannot substitute for structural safety, and if the debate about cameras distracts from the accountability questions around overcrowding, fire safety standards, and emergency preparedness, then the cameras will have served a second, quieter injustice.
International children’s law specialist Achayo Baraka put it plainly: the Kenyan Constitution guarantees the right to privacy for everyone, including minors. The question, in the context of schools, is what privacy means inside a dormitory. That question does not have a simple answer. But what the law asks for is transparency, proportionality, and genuine accountability for every decision made about children’s data, including the decision to put their faces on television before a court had said it was lawful to do so.
That part, at least, has a clearer answer.
Sharlene Muthuri is Amnesty International Kenya’s Technology and Human Rights Officer, and James Kimila is its Human Rights Education and Movement Building Officer. They write in their personal capacity. Email: [email protected] and [email protected]