This archive report was first published on 16 September 2019.
As the world becomes increasingly reliant on data, Kenya's Data Protection Commission must be empowered to effectively protect citizens' personal information.
Published on September 16, 2019, the Data Protection Bill aims to safeguard sensitive data collected by the government and private entities. However, the current draft law limits the commission's role to receiving and investigating complaints, rather than enforcing data protection laws.
Unlike Estonia's data protection inspectorate, which has the power to warn controllers and processors, order rectification, and fine data processors, Kenya's commission is restricted to reporting violations to the state. This is ironic, given that the commission reports to the same state agencies that collect and store sensitive data.
For the commission to be truly effective, it should be given the powers of the Ethics and Anti-Corruption Commission, including the ability to investigate and prosecute data-related crimes. This would enable the commission to take a more proactive role in protecting citizens' rights and freedoms.
As data breaches become more common, the need for a robust data protection system is increasingly urgent. The Chief Justice should establish cyber, data, and adjudication divisions to handle data-related cases, and the commission should train a special team of police officers to handle cyber and data evidence.
Ultimately, Kenya's data protection system must be fully functional and effective in protecting citizens' rights. This requires a strong policy that is actualized, and a commission that is empowered to enforce data protection laws.
— Mustafa Yousif, senior programme and advocacy officer at Namati, a human rights NGO.
