With the two-year anniversary of the Kenyan Data Protection Act fast approaching, there are lessons to be learned from other jurisdictions that have enacted data protection legislation, and from what is happening in Kenya. This is not unlike any other data protection act, as it is common for new laws to go through a teething phase as they develop into fully operational and effective frameworks. As evidenced by recent developments in the Huduma Namba litigation in Republic v Joe Mucheru, Cabinet Secretary Ministry of Information Communication and Technology and 2 others ex parte Katiba Institute and Yash Pal Ghai, and the daily lived experience of Kenyans, legal frameworks such as this act are essential to the protection of constitutionally founded rights. It is therefore essential that we ensure they are in proper working condition.

Access Now recently published "Data protection in Kenya: how is this right protected?" — a report that provides key recommendations to the Office of the Data Protection Commissioner and the Kenyan government on how to achieve better implementation of the law. The data protection act is rich in progressive and well-thought-out provisions, but it is marred by the fact the ODPC does not have the proper independence. 

In keeping with its function as required by the act, the ODPC, over the last few months, has formulated the accompanying regulations to implement the act and has publicly invited stakeholders, including individuals, corporations and civil society  to public participation fora to take a look at these laws and provide feedback. This is a step in the right direction and should be applauded. Whether these participation processes are effective in their current formulation remains to be seen, as it should be noted that the regulations have yet to be adopted. 

Accordingly, in our paper, we make the following recommendations to the government of Kenya and the Office of the Data Protection Commissioner:

To the government: 

• Guarantee the independence of the Office of the Data Protection Commissioner by removing seemingly compulsory involvement of the Cabinet Secretary for ICT and national security bodies.
• Ratify international agreements to protect personal data as established under the African Union Convention on Cyber Security and Personal Data Protection and the Convention for the Protection of Individuals.
• Clarify the scope of the act regarding national security and public interest exemptions and ensure it mirrors the spirit of the constitution.
• Provide adequate resources to the Office of the Data Protection Commissioner to ensure effectiveness and functionality.

To the Office of the Data Protection Commissioner:

• Improve transparency and participation in processes by making provisions for meaningful public participation processes, by ensuring there is enough time for stakeholders to submit comprehensive comments.
• Streamline processes by reducing the amount of information required to submit a complaint and register a data controller or data processor.

We are hopeful that the government and the ODPC will continue to engage with stakeholders and civil society to implement these and more recommendations in order to strengthen this and other legislation that are fundamental to the realization of human rights.

Photo by Sergey Pesterev on Unsplash