Thread by @Olez

1. Folks we should really be worried about the state of data protection in Kenya. Here is a short thread about the current proposal by the ICT Ministry. Its important to note that there are two Data Protection Bills floating around

2. One Bill sponsored by Senator Gideon Moi - laibuta.com/constitution/d…

the other by the ICT Ministry - laibuta.com/constitution/d…

3. I have submitted my memorandum on both
Senate memo - laibuta.com/constitution/d…

ICT Bill memo - laibuta.com/constitution/m…

4. When the State wants to scuttle a legislative process, it often comes up with different Bills on an issue. For example, why did the ICT Ministry not piggy ride on the Senate Bill that was already in discussion instead of coming up with a different draft

5. The ICT Ministry Bill is most worrying in terms of form and content, glaring loopholes and clauses that can hardly be operationalised. I have written on several aspects regarding data protection in Kenya -

6. HOW MUCH DO YOU CARE ABOUT YOUR DATA? - laibuta.com/constitution/h…

THE NEED FOR ‘PUBLIC USE OF DATA - laibuta.com/constitution/t…

THE NEED TO TAME COMMERCIALISED USE OF DATA - laibuta.com/constitution/n…

7. Any data protection regulation should cater for three aspects - individuals right to privacy, the public need for data and commercial use of data. The ICT Ministry draft falls short in these aspects

8. One, the draft is not clear about data processors and data controllers and their operations. The law ideally should apply to anyone who processes data from Kenya. This is notwithstanding whether they are based in Kenya or not.

9. Two, the Bill creates the Office of the Data Protection Commissioner. An office with only one commissioner with powers to investigate, regulate and undertake some judicial functions. Surely, one person???

10. Three, the Bill wants to create a register of data processors and data controllers plus some form of licencing. This means that even a second year university student needs to be registered to carry out research...LOOOOL

11. Four, the Bill talks of self-regulation. I mean, why come up with a law then tell people to self regulate? You could have well saved time and just do away with the law....

12. Five, BTW the Office of the Data Protection Commissioner is both executive and policy making. There is no provision for a structured secretariat with a CEO etc

13. Six, the Bill proposes blanket fines if one contravenes the law. That means if a company like Google or Facebook contravened the law, they would be fined the same as an NGO in some remote place with limited funds....

14. Seven, the Bill does not set time for reporting of a data breach. Surely???

Eight, the Data Protection Commissioner has too much powers for one individual. Ideally the Commission should have three members - A Chairperson and two members then a CEO and a Secretariat

15. Nine, the Bill is unclear about personal data during medical emergencies and natural disasters.

Ten, the Bill proposes that the Minister be in charge of exempting certain data from regulation. Imagine the potential for abuse in that clause

16. Eleven, if you want to transfer data from Kenya, you must get authorisation...yeah I know how absurd that sounds

17. Anyway with out data protection woes in Kenya, there is no light at the end of the tunnel. Wish there was robust public debate on these matters...but....

/End/