Every Kenyan has the right to be informed of how personal data collected from them is used, stored or shared.
According to the Office of the Data Protection Commissioner (ODPC), personal data and the privacy of individuals must be protected, as enshrined in the Constitution.
Speaking in Kajiado during a County Awareness and Sensitization Forum on Data Protection, ODPC’s Principal Legal Officer Wcyliffe Jakech noted that being aware of one’s privacy rights is key to ensuring that personal data does not fall into the wrong hands.
“The Constitution guarantees one’s right to privacy. Being aware of your privacy rights will ensure that your personal data does not fall into the wrong hands. Any breach of personal data must be reported within a reasonable time period to the ODPC,” he said.
Jakech revealed that the Data Protection Act 2019 gives the ODPC the sole responsibility of overseeing the protection of personal data by both public and private data controllers and processors.
It seeks to protect the privacy of individuals and personal data by regulating the processing of personal information by private and public entities.
Data controllers refer to entities that collect personal data from the public and determine the purpose and means of processing this data, while data processors are the entities that process this data on behalf of the controllers.
They include private and public companies, learning and health institutions, government departments, among others.
The Officer added that with the increased collection of data by both private and public entities for various purposes, data controllers and processors must be proactive to ensure that data is preserved well and used for the intended purpose.
“Data controllers and processors are accountable for the information in their custody and they should ensure that it is stored safely and used for its intended purpose only,” Jakech said.
Ali Samow, OPDC Compliance Officer, directed all data controllers and processors to register with the Office of the Data Protection Commissioner in accordance with the provisions of the Data Protection Act of 2019.
He further called on them to establish strategies to guard against breaches of personal data in their custody, warning that under the Data Protection Act of 2019, one could be punished for misuse of or failure to secure such records.
“All data controllers and processors are required to register with the ODPC and develop a data protection policy to ensure that all data that is in their hands is secure,” he emphasised.
Failure to comply with provisions of the act will result in an enforcement notice and penalty notice, where one may be fined up to Sh5 million.
Samow said registration of data controllers and processors would help the ODPC regulate the processing of personal and sensitive data by various entities.
Personal data refers to any information that may be used to identify a person, such as a national identification card, phone number, birth certificate and location, while sensitive data include one’s health status, ethnicity, marital status, biometric data and sexual orientation.
Apart from regulation, the Office of the Data Protection Commission is granted the power to facilitate reconciliation, mediation and negotiation of disputes.
Since its inception in 2021, the office has received 2,831 complaints, out of which 922 have been admitted, 1,895 declined and 29 are under preliminary review.
Three enforcement notices and two penalty notices have also been issued during the period, with two cases determined.
To fast-track addressing the complaints, the ODPC has developed an Alternative Dispute Resolution framework.
This is a voluntary and participatory process for settling disputes between individual complainants and respondent organisations.
By Rop Janet
