This archive report was first published on 23 October 2019.
The Kenya Parliament is currently debating the Data Protection Bill, a crucial piece of legislation that has far-reaching implications for the right to privacy of Kenyan citizens.
As the Bill makes its way through the legislative process, it is essential that Members of Parliament (MPs) ensure that the final law is watertight and provides robust safeguards for citizens' rights.
According to the Constitution of Kenya 2010, the right to privacy is guaranteed, and this right may be enforced by the Constitutional Court. Furthermore, the right to privacy is also protected under common law, with restrictions on the interception and monitoring of communications.
Privacy is closely tied to the concept of human dignity, which empowers individuals to make autonomous decisions about their lives without interference from the State or private actors. It is also an essential enabling right, providing the conditions for individuals to enjoy other human rights, such as freedom of expression, association, and peaceful assembly.
The Data Protection law aims to give full effect to the constitutional right to privacy by safeguarding personal information when it is processed by another party. It also regulates the manner in which personal information may be processed by establishing a threshold of minimum conditions.
Moreover, the law provides persons with rights and remedies to protect their personal information from processing that is not in accordance with the law. The Kenya Government has already admitted to a serious breach of personal data in the Huduma Namba registration.
MPs must ensure that the Data Protection law forces everyone responsible for using personal data to follow strict rules of 'data protection principles.' These principles include using information fairly, lawfully, and transparently, as well as ensuring that the information is accurate and kept up to date.
Additionally, the law must regulate the acquisition and use of personal data, particularly in the context of large internet companies and digital technologies. It must also expand individuals' rights, extend the role and enforcement powers of data protection authorities, and place a stronger burden on data controllers to be transparent and accountable to individual data subjects.
Kenya Parliament should borrow a leaf from the European Union on data protection. The 1995 European Union Data Protection Directive imposes a standard of protection on any country in which the personal data of European citizens is processed.
The Communication authority of Kenya must be legally empowered to be the Information Regulator enforcing the best governance practices of the protection of personal information.
Ultimately, the final Data Protection law that Kenya Parliament will pass must prioritize the protection of citizens' rights and provide robust safeguards for their personal information.
