Data Privacy and the Applicable Law in Kenya
Introduction
Data privacy refers to the proper handling and protection of personal information. Personal data may include a person's name, telephone number, email address, identification number, financial information, photographs, location and other information that can identify an individual.
In Kenya, the protection of personal data is primarily governed by the Data Protection Act, 2019, which gives effect to the constitutional right to privacy and regulates the processing of personal data. The Act also establishes the Office of the Data Protection Commissioner (ODPC) to oversee data protection in Kenya.
What Does the Data Protection Act, 2019 Provide?
The Data Protection Act regulates how organizations and individuals collect, use, store and share personal data. Personal data should generally be processed lawfully, fairly and transparently, collected for specific purposes, limited to what is necessary, kept accurate and protected against unauthorized access, loss or misuse.
Organizations handling personal information should therefore put appropriate technical and organizational safeguards in place to protect the data they process.
Rights of Data Subjects
A data subject is the individual to whom personal data relates. Under Kenyan law, data subjects have important rights, including:
The right to be informed about the use of their personal data.
The right to access their personal data.
The right to object to certain processing of their personal data.
The right to request correction of false or misleading information.
The right to request deletion of false or misleading personal data.
The right to data portability in circumstances provided by law.
Practical Examples of Data Privacy
Example 1 – Law Firm
A law firm collects a client's name, identification documents, telephone number, address and information relating to a legal matter. The firm should only use this information for legitimate purposes and should take reasonable measures to prevent unauthorized persons from accessing the client's information.
Example 2 – Employer
An employer collects employees' identification details, bank information and contact details. Such information should be securely stored and only accessed by authorized personnel who require it for legitimate employment-related purposes.
Example 3 – Business
A business collects customers' telephone numbers to arrange deliveries. The business should not automatically use those numbers for unrelated marketing or share them with another organization without a lawful basis.
Why Data Privacy Matters
Effective data protection helps protect individuals from identity theft, fraud, unauthorized disclosure and other forms of misuse. It also helps organizations maintain public trust and comply with their legal obligations.
Organizations should consider measures such as access controls, strong passwords, encryption, secure backups, employee confidentiality obligations and appropriate data protection policies. The ODPC also identifies technical and organizational safeguards as important measures for protecting personal data.
Conclusion
Data privacy is an important legal and organizational responsibility in Kenya. The Data Protection Act, 2019 provides the principal legal framework for protecting personal data and establishes rights for individuals whose information is processed.
Businesses, professional firms, public institutions and other organizations that process personal data should understand their obligations and implement appropriate measures to protect the information entrusted to them.