Thread by @mmnjug

.@ODPC_KE Immaculate Kasait has promised to ensure sufficient security for personal data despite increased cases of unauthorised access. - @NationAfrica

Her statement on Friday came after Kenyans complained on social media about illegal access to their personal data, which saw some listed as members of political parties without their knowledge or consent.

Ms Kassait said her office was engaging with data processors and controllers, including @ORPPKenya on how best to ensure the data they store is protected from illegal access.

She noted that her office had by June 24 received 200+ complaints about the illegal enlisting.
The Political Parties Act provides that one can resign as a member of a political party at any time provided they write to respective parties and send a copy to the parties’ registrar.

Other than irregular registration as members of political parties, there have been numerous complaints of people’s data being misused- forwarding to the Credit Reference Bureau (CRB) without their knowledge.

.@ODPC_KE calls for patience from those aggrieved and assures the public that the office is taking steps to ensure the rights of data subjects are respected and protected

On November 16, 2020, Ms Kassait, former director of voter registration and election operations at @IEBCKenya was appointed the country’s inaugural Data Protection Commissioner at @ODPC_KE.

Her office is the creation of the Data Protection Act that came into force on November 8, 2019. The appointment set the stage for the securitisation of the country’s data against unauthorised access.

However, almost a year down the line, little has been achieved by the office, with Kenyans demanding more.

In checking data misuse, the Act gives the ODPC powers to maintain a register of data controllers and regulate the processing of data, which includes health, biometric and personal data.

Under the Data Protection Act, data processors and controllers, whose data activities fall under @ODPC_KE include:

National Registration Bureau (NRB)
Hospitals
@nhifkenya
Banks
Telcos
@IEBCKenya
@ORPPKenya
@NSSF_ke

It is highly likely that the intruders may have used data stored by controllers to illegally enlist Kenyans as members of the political parties or that they have their details sent to the Credit Reference Bureau (CRB).

.@ORPPKenya is also both a data controller and a data processor. It is a data controller in the sense that it has the custody of the political parties’ membership register of about 16M, and a processor, because it uses the membership register in the party elections.

.@ODPC_KE pledges to work and resolve the data breach that happened on the @ORPPKenya parties' list bit.ly/3h2II2O