Apart from passing a set of data protection rules last year, Kenya is, again, set to confront the activities of data collectors under its jurisdiction. According to the office of data protection commissioner Kenya, in a draft guidance note published on Tuesday, entities must issue consent forms to individuals before embarking on collection of personal data.
“Under no circumstances should the data collected be sold to third parties or transferred out of the country, unless the concerned individual consents to the transfer. The transfer of personal data to another country shall only take place where sufficient proof has been given on the appropriate safeguards with respect to the security and protection of the personal data,” the draft guidance policy reads.
Here Is What You Need To Know
- Under the proposed new rules, mobile applications requesting access to personal data shall publish policies on the information being collected.
- Again, any person who requests for personal data will be required to enter into a data protection and sharing agreement with the entity or person having the control of data.
- Under the proposed rules, public entities are also expected to channel all personal data requests to their respective ministries and state agencies.
- Furthermore, the commissioner will require entities to endeavor to collect personal data in an anonymized format ensuring that individuals cannot be re-identified.
- The new policy is coming on the heels of the Data Protection Act passed at the end of 2019. The Act is Kenya’s first piece of legislation on personal data.
- The draft guidance note is geared at responding to the increased need for personal data under the COVID-19 pandemic.
“For instance, health data and geo-location may be necessary for contact tracing. Innovations built in response to pandemic including apps and related services, may request some access to personal data from a government or private entities to enable the development of a product,” added the note.
Kenya data rules Kenya data rules
Read also: New Data Regulations Allow Kenyans To Exclude Personal Data From National Database
What Are The Implications Of This For Startups In Kenya?
For consumers or data subjects in Kenya, this is a welcome development in an era of intense data mining. For startups, there is now an official regulatory hurdle to leap over, although application play stores such as Google Play Store and App Store already require such consent to be obtained from the data owners before the data are collected. However, the new rule will, notably, change what happens to the data after they have been collected. For instance, once the rules are effective, it will no longer be enough to obtain consent at the point of the initial collection, neither would it be enough to just insert in the privacy policy or terms of use of the app a clause that data collected may be shared with third parties. It is now going to be mandatory, especially for data auditing purposes, that the sharing entity seek the data subject’s consent as well as execute a data share agreement with the third party seeking to collect data. This is coming in the wakes of several data scandal and compromises, including the recent incident of Facebook — Cambridge Analytica.
Charles Rapulu Udoh
Charles Rapulu Udoh is a Lagos-based lawyer who has advised startups across Africa on issues such as startup funding (Venture Capital, Debt financing, private equity, angel investing etc), taxation, strategies, etc. He also has special focus on the protection of business or brands’ intellectual property rights ( such as trademark, patent or design) across Africa and other foreign jurisdictions.
He is well versed on issues of ESG (sustainability), media and entertainment law, corporate finance and governance.
He is also an award-winning writer