As the country undergoes digital transformation where a variety of services to the public will be availed on digital platforms, the Office of the Data Protection Commissioner (ODPC) has put in place legal and institutional mechanisms to ensure that personal data is protected.
It’s a constitutional right of all Kenyan citizens, legally referred to as data subjects, to have their data protected from persons and organizations who may intend to use this information for unlawful purposes.
Protection of personal data is what informed the establishment of ODPC in November, 2020 following the enactment of the Data Protection Act of 2019. The office is mandated to ensure that processing of personal data of a subject is guided by the principles set out in the Act.
Head of Legal Services at ODPC Ms. Susan Waweru said that the office is also mandated to create awareness among Data Controllers and Processors on how they can operate within the law. She said registering with ODPC is the first step towards compliance with the Data Protection Act.
An Advocacy officer at ODPC, Mr. Abdullahi Ali said that the office was creating awareness in all counties and hoped to reach all counties by the end of this financial year.
“Several teams have therefore been dispatched to different counties to sensitize data collectors and processors on the mandate of the ODPC, the provisions of the data protection Act and their obligation in data protection”, he said.
Speaking at Embu County during sensitization exercise, Ali asked data controllers and processors to be accountable for the information in their custody and ensure that it’s only used for the intended purpose. He urged them to only collect the data they require in order to minimize risks such as fraud or unsolicited marketing by entities that could obtain this data illegally.
Data collectors and processors were asked to undertake a Data Protection Impact Assessment (DPIA) in order to identify the risks involved in their work and address them thus ensuring there is no data breach.
“They should also have a retention schedule which will guide how long they should hold information after which it should be discarded in a lawful manner”, he said.
Mr Ali said that in instances where a data collector provides private data to another party for processing, a contract bearing details on how this information will be managed should be drawn.
Embu West Deputy County Commissioner Ms Mercy Gatobu speaking at the function pledged support for the ODPC in ensuring that all public and private entities that were handling personal data in the County complied with the provisions of the Data Protection Act.
She noted that government departments collected a lot of personal and even sensitive data in the cause of providing services to the public and concurred that there was urgent need to protect this information that at times leaked into the public domain.
By Jane Gicharu
