Thread by @PrivacyMatters

1/ Facebook “in the spirit of providing privacy protections that empower individuals and are implementable by innovators, we wish to highlight some aspects of the Bill and Policy that may need further consideration in light of #Kenya’s goals for its digital economy”

2/ Facebook wants to remove the requirement for registration entirely because ‘accountability” will deal with this.

“we recommend appropriately limiting the Bill’s applicability by clarifying that “personal data” belongs to data subjects in Kenya”

3/ “We also suggest revising the definition to account for information that is linked may be “reasonably linked” to data subjects, rather than information that is merely “relating to” a specific natural person. “

4/ “For instance, a person has brown hair” arguably “relat[es] to” a natural person, but, without more, it could not be linked back to that person” ..... <wait for it ..... her comes the but/and ....

5/ & “In addition, we suggest aligning the definition with international standards by specifying that information that has been de-identified or that is obtainable from publicly available sources is excluded from the definition” <wow . Publicly available info should be excluded

6/ so is this Facebook saying that personal data in the public domain should be exempt entirely from the definition / scope of the Kenyan Data Protection Bill - if so, wow.

7/ Hey Kenya, “don’t fuck with our business model” <Facebook didn’t really say that but .... 8/

8/ “‘location’ data should be narrowed to cover precise GPS locations – not location in general, which could include the country where a person is located or more general types of location that are reflected in the Internet protocol address a person uses on a network”

9/ “we recommend the Ministry for moving away from its previous approach that relied heavily on consent in favor of the model provided by Article 6 of the GDPR, which recognizes multiple legal bases under which data may be processed (including consent)”<remember #WhatsApp ?

10/ “research shows that requiring consent too frequently can result in what is known as “consent fatigue,” in which users are asked to provide consent so frequently that they stop paying attention to the privacy notices presented to them” <Oh Facebook 🤦‍♂️ techcrunch.com/2018/05/25/fac…

11/ 👀 “amend the bill to focus more directly on people’s expectations about how their information will be used – imposing higher obligations in cases where a use is inconsistent w/the context in which information was collected or the entity’s relationship with the data subject”

12/ Hey Kenya. Think of our bottom line won’t ya.> “The Bill provides several collection, purpose, and retention restrictions that are incompatible with the flexibility required for a modern data economy”

13/ Facebook. Really. You shouldn’t. You’re being too kind. It’s embarrassing. Really. We know you care> “As an overarching principle, we support the Bill’s notion that data should be processed “lawfully, fairly, and in a transparent manner.” < oh. Wait. 👉 HOWEVER

14/ “However, the Bill also requires that personal data only be collected for “explicit, specified, & legitimate” purposes,” “not further processed in a manner incompatible with those purposes,” & that all personal data collected be “adequate, relevant, & limited to ....” /15

15/ ”what is necessary in relation to the purposes for which it is processed. In addition, the Bill requires that collected personal data be “kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data” be erased or rectified without delay”

16/ “Although we believe it’s important for people to know when their information will be used for purposes that are significantly different from what they were orig told, the Bill should reflect that data may reasonably be collected for more than 1 purpose in the 1st instance”

17/ “the reasonable data subject has certain expectations that his or her information may be used and processed in a variety of ways in order to offer a variety of services” <I’d love to see @Facebook’s research on what are the expectations of a ‘reasonable data subject’ 🤔

18/ “Finally, we suggest removing the requirement that data be kept “up to date.” First, we anticipate this requirement will be too burdensome for many orgs, especially when the data subject is in the best position to identify and correct inaccuracies in their own personal data.”

19/ Oh @facebook You really are being too kind. “We believe that everyone deserves strong privacy protections, including many of the data subject rights reflected in the Bill, and we support the idea that people should have basic protections for their data across organization” 👉

20/ 👉BUT “As the Ministry considers the specific approach to adopting these data subject rights, we encourage you to anticipate situations where those rights should be limited to protect other important interests” <‘did we say don’t fuck with our biz model yet?’

21/ “data subject rights would not apply in situations where exercising these rights would: (1)enable fraud or other unlawful activity,(2) interfere with law enforcement or judicial activity,(3) undermine privacy or data security interests of others,(4) be unduly burdensome or..”

22/ “.. excessive, (4) reveal proprietary assets or business insights, or (5) require the collection or processing of additional personal information about the consumer.”

23/ “We also encourage the Ministry to recognize that the exercise of certain data subject rights may mean that an organization will not provide requested products or services to an individual” 👉

24/ “For instance, if a particular service relies on the processing of a particular piece of data, the organization providing that service may not be able to provide the service if the data subject does not allow the data processing” 🤔worries over consent perhaps ..

25/ 👉We like rights but

“when a person exercises the right to object to the use of his or her information for direct marketing, the Bill should anticipate that a company may no longer provide services that are funded through advertising to a person who does not wish to see ads”

26/ “To avoid these unanticipated complications, the Ministry might decide to amend the right to object to processing of data so that it extends only to uses of data that are materially inconsistent with the uses disclosed by the data controller/processor ..” 27/

27/ “or with the relationship between the data subject and the data controller/processor” < Oh Facebook. A right to object to direct marketing is a “unanticipated complication.”

28/ Facebook says it likes transparency but “we recommend that the notice obligations under the Bill be modified so that notice is not required to be given before the collection of personal data” ... 29/

29/ “Although prior notice is in many cases desirable, research suggests that in many instances just-in-time notice – that is, notice contemporaneous with the data collection – is preferable, and may in some instances be a more effective way to educate people”

30/ eg “when people share photos on Facebook, they’re given the opportunity to review & control whom they are sharing such photographs with at the same time. We believe this [approach] can be effective at informing users of their choices than lengthy privacy notices” <needs both

31/ “we recommend narrowing the breach notification obligations to
circumstances in which the breach is likely to result in a material risk to the rights and freedoms of natural persons”

32/ Hey Kenya. Won’t ya think of our bottom line! “We are encouraged .. that the Commissioner is explicitly charged with promoting self-regulation among controllers & processors & suggest that the Bill also charge the Commissioner with promoting innovation, as well”

33/ ok. “Adopting provisions that enable unusually broad government access to data raise meaningful concerns for companies that may seek to do business in Kenya, and could also complicate Kenya’s effort to achieve findings of adequacy under foreign data protection regimes”

34/ “in several places the Bill contemplates imprisonment as a penalty, an approach that is highly unusual in data protection legislation. To maintain parity with most modern data protection regimes & avoid disincentives for foreign entities to partner with Kenyan businesses or”

35/ “.. further invest in Kenya, we encourage the Ministry to modify the Bill to focus on financial penalties subject to a reasonable cap, such as a flat amount specified by statute or a percentage of the revenue the entity earned in Kenya during the preceding year” <$$$

36/ link to Facebook’s submission to the Kenyan consultation on a Data Protection Bill ca.go.ke/wp-content/upl…