This archive report was first published on 23 July 2021.
Kenya's Data Protection Act, enacted in November 2019, aims to safeguard citizens' personal information. However, a recent survey by consulting firm Ernest & Young (EY) reveals a concerning trend: six out of 10 organizations in Kenya transfer personal data to third parties without consent, often for commercial gain.
According to the survey, which was conducted between November 2020 and February 2021, 59% of organizations in Kenya transfer personal data to third parties, while only 47% seek consent from the data subjects. The survey also found that spending habits and identity are the two leading sets of data that are pricey, largely transacted at 47% each.
Immaculate Kassait, the nominee for the position of Data Commissioner, warned that people should be wary of who they share their personal information with and why. 'For example, when you take your clothes to the laundry, you will be asked your number, where you live, and you end up giving your whole biography. We should shift our minds on sharing information freely,' she said.
Robert Nyamu, EY Partner and Technology Consulting Leader, noted that millennials and Generation Z are leading the charge in inquiring about the safety of their data. 'Young people want to work with organizations that handle their data responsibly. We know this population spends most of their time online,' he said.
The survey also found that mobile or web applications (39%) are the leading channels for getting consent, followed by email (37%). The rest (24%) include SMS and physical signed forms. Additionally, 45% of organizations have ways for people to access their personal data through online portals, while 37% access via mail and 18% use other means such as physical visits.
