Kenya Legal &amp; Ethical Issues Network on HIV and AIDS

Cover - Kenya DPA 2019 analysis.jpg

Impact

Summary

This is a legal analysis of Kenya’s Data Protection Act which was adopted in November 2019.

Media

Key points

Kenya must take measures to ensure the effective implementation of the new Data Protection Act, 2019.
The shortcomings of the Act adopted must be effectively addressed and rectified through the development of comprehensive regulations.
The Office of the Data Protection Commissioner must be well-resourced, made operational and is empowered to operate independently from the government.

We welcome the effort by the Government of Kenya to give life to and specify the right to privacy, already enshrined in Article 31(c) and (d) of the Constitution of Kenya by proposing a draft Data Protection Act. We particularly appreciate the direct reference to this Constitutional right in the purpose of the Act and the way it is referred to on several occasions in the Act.

While these efforts have positive intentions and we are pleased that Kenya has adopted a comprehensive data protection law, the Act adopted has a number of shortcomings which ought to be addressed moving forward with the implementation and application of the Act.

As part of this process, we call on the government of Kenya to review the areas of concerned flagged in this analysis in order to ensure that personal data is effectively and adequately protected, and to ensure that the Office of the Data Protection Commissioner is well-resourced (both administrative and financial), made operational and is empowered to operate independently.

Furthermore, given some of the areas of concerned outlined in our analysis, it is important that the Office of the Data Protection Commissioner address rapidly some of these issues by issuing recommendations and guidelines, outlining its interpretation of some provisions or aspects of a data protection law and clarifying the law as necessary.

This analysis was undertaken by the Defenders Coalition, The Kenya Legal and Ethical Issues Network on HIV and AIDS (KELIN), Dr. Robert Muthuri and Privacy International (PI).

Repeating Image and Text

What PI is calling for

Technologies, laws, and policies contain modern safeguards to protect people from exploitation.

PI seeks protections for everyone

Location

Kenya

Democracy portfolio country

More about our partner

Kenya Legal & Ethical Issues Network on HIV and AIDS

The Kenya Legal & Ethical Issues Network on HIV and AIDS (KELIN) is a non-governmental organisation based in Kenya. Founded in 1994, KELIN advocates for a holistic and rights-based system of service delivery in health, and for the full enjoyment of the right to health by all, including vulnerable, marginalised, and excluded populations.

Country of Operation

Region of Operation

Website

Nubian Rights Forum and others V. The Attorney General (Kenya)

Target Stakeholders

Our fight

Defending Democracy and Dissent

The seamless way we communicate using some of these technologies has helped many to organise politically and to express dissent online and offline. But the hidden data harvesting on which many of these technologies rely also threatens our ability to challenge power, no matter the type of government.

Safeguarding Peoples' Dignity

The promises made with innovation have not been enjoyed by all equally. Innovative solutions can be designed to empower and serve individuals and communities, rather than state and corporate power. A new approach to data and technology must be established to make this a reality.

The Right to Privacy in Kenya

tech-admin — Fri, 06 Dec 2019 13:50:15 +0000

Date

Friday, December 6, 2019

Our legal action

Audiences and Purpose

Influence key stakeholders

Content

Summary

PI submitted with its partners a joint stakeholder report on the state of privacy in view of Kenya's review at the 35th session of the Universal Periodic Review.

Media

UPR Kenya cover.jpg

Key points

Kenya must review its legal framework to comply with the right to privacy including its laws regulating communications surveillance and intelligence activities.
Kenya must take measures to ensure HRDs and journalist are able to work freely and safely without being subject to surveillance.
Kenay must adopt a comprehensive and robust data protection law to regulate the processing of personal data, and protect people.

This stakeholder report is a submission by Privacy International (PI), the National Coalition of Human Rights Defenders Kenya (NCHRD-K), The Kenya Legal & Ethical Issues Network on HIV and AIDS (KELIN), and Paradigm Initiative.

PI, NCHRD-K, KELIN, and Paradigm Initiative wish to bring their concerns about the protection and promotion of the right to privacy, and other rights and freedoms that privacy supports, for consideration in Kenya’s upcoming review at the 35th session of the Working Group on the Universal Periodic Review.

Repeating Image and Text

What PI is calling for

Technologies, laws, and policies contain modern safeguards to protect people from exploitation.

PI seeks protections for everyone

A universal rights framework protects people everywhere.

PI has led the push for privacy to be recognised globally.

Location

Kenya

Democracy portfolio country

More about our partner

Kenya Legal & Ethical Issues Network on HIV and AIDS

Country of Operation

Region of Operation

Website

Target Stakeholders

Our impact

Recognition of Privacy in UN Human Rights Mechanisms

We got the UN to address and build on the right to privacy.

Our fight

Defending Democracy and Dissent

Safeguarding Peoples' Dignity

Comments on the Kenyan Data Protection Bill, 2019

staff — Tue, 01 Oct 2019 17:38:09 +0000

Content

Development of an effective and comprehensive Data Protection law in Kenya is a priority. In particular, given that a number of strategies are currently being deployed in Kenya to promote digital inclusion including: digital identities, micro-lending and Alternative Credit Scoring. While these efforts have positive intentions, a number of concerns ought to be addressed and a strong data protection framework would be a step in the right direction, for example:

Firms should deploy secure infrastructures to avoid data breaches, like those currently being seen with the Aadhaar system in India.
Biometrics are used excessively in certain circumstances where less intrusive options such as unique identifiers would be sufficient without the concomitant risk. This is particularly true in the health sector where biometrics could expose certain at-risk populations.
Alternative Credit Scoring by Micro-Lending institutions use a vast range of data points such as call detail records (CDR) and customer relationship management (CRM) details. These firms are often acting without clear opt-in mechanisms or sufficient information being provided to individuals.

However, the Data Protection Bill proposed by the Taskforce has a number of significant shortcomings. In our joint submission, we recommend that to effectively protect privacy and to meet international standards in protecting personal data, that full consideration be given to the areas of concern and improvements outlined below under each Part of the Bill, and include:

Reviewing the definition of ‘sensitive personal data’ to ensure a comprehensive definition.
Replacing the current proposal to establish the office of the data commissioner as a body corporate with its establishment as a Constitutional Commission under Chapter 15 of the Constitution.
Guaranteeing that all data protection principles are included and revised clearly to provide for principles of integrity and confidentiality and accountability.
Guaranteeing that data subjects are consolidated in the law in a clear manner under the same section, and the right to effective remedy, and the right to compensation and liability which are currently missing must be added to the list of rights of data subjects.
Reviewing the current scope of the obligation to inform a data subject about the processing of their personal data.
Providing clarity as to what the legal grounds for processing may be including by defining concepts such as ‘public interest’ and ‘legitimate interest’, and in particular review the legal grounds for processing ‘sensitive personal data’ to strengthen the protection of such data.
Ensuring that any exemptions relating to the different data protection principles and the rights of data subjects must be provided for in the law in a form which is clear, precise and limited to specific necessary and proportionate exceptions rather than broad blanket exemptions, particularly for government authorities.
Reviewing the grounds for processing including ensuring that data processing of data which is available to the public or deemed publicly available is not free for all to use without requiring further involvement of the data subject.
Reviewing the clause on the storage of data in Kenya and recommending that focus should be on ensuring the data is protected with the highest safeguards rather than demanding data localisation which may not achieve the purpose of providing a higher level of protection as intended.
Guaranteeing that a strong process is in place to regulate the transfer of personal data including developing a process for assessing adequacy of protection in the receiving country, and not only in terms of data protection but protection of human rights and rule of law.
Ensuring that the protection of the data subject and their data as well as their right of privacy is balanced with freedom of expression under Article 33 of the Constitution for the media, artistic or literary work.

We invite you to read our joint submission which elaborates on these and areas of concern and improvements under each Part of the Bill.

Our joint legal analysis of previously proposed data protection bills can be accessed here.

We remain available to provide interested parties with further expertise to ensure that Kenya adopts a robust, comprehensive data protection law which will ensure its citizens will be able to enjoy their right to privacy and their data will be subject to the highest safeguards.

Repeating Image and Text

Location

Kenya

Democracy portfolio country

More about our partner

Kenya Legal & Ethical Issues Network on HIV and AIDS

Country of Operation

Region of Operation

Website

Social protection programmes

Data Privacy Week: Exposing Harms, Fighting Back

staff — Mon, 28 Jan 2019 08:04:15 +0000

Data Privacy Week: Exposing Harms, Fighting Back staff Monday, January 28, 2019

The Privacy International Network is celebrating Data Privacy Week, where we’ll be talking about how trends in surveillance and data exploitation are increasingly affecting our right to privacy. Join the conversation on Twitter using #dataprivacyweek.

It is often communities who are already the most marginalised who are at risk because of the privacy invasions of data-intensive systems. Across the globe, we see the dangers of identity systems; the harms of online violence against women and the LGBTQ+ community; and the threat of surveillance faced by activists and other communities.

But, as the Privacy International Network continues to uncover, campaign and advocate on these issues, it becomes clear that it is possible to begin to achieve change. The threats to the rights of individuals and communities are massive, and the forces against them from the public and private sectors can be immense. Yet, the efforts of civil society across the world can begin to make positive impacts on these issues.

Identity

The use of biometric technology in Peru has expanded, as revealed by Hiperderecho. Peru's National Registry of Identification and Civil Status (RENIEC) features biometric data including photographs and fingerprints. But the security of the system is at risk: in April 2018, Hiperderecho reported that the identity photographs of all Peruvians were left exposed. While the vulnerability was later fixed, it indicates how the security of these giant centralised biometric databases can put people at risk.

National ID cards continue to be promoted around the world. In the Philippines, a new ID system is coming into law, despite the concerns of several activists, including the Foundation for Media Alternatives (FMA). We also explored the issue in a podcast with two local transgender rights activists. Voter registration is another key aspect of debates on identity. An investigation by the Centre for Intellectual Property and Information Technology at Strathmore University revealed that there was a lack of sufficient controls to protect the data of voters in Kenya’s biometric voter registry. In our own research on the identity system in Chile, we highlighted challenges that migrants face in accessing healthcare, employment, and accommodation – all because they lack the Chilean ID card.

Gender

The issues surrounding privacy and gender have become an important field of study, with the online arena – while potentially providing a safe space for marginalised communities – also becoming a place for harassment and abuse. A report by SMEX revealed some of the online privacy threats that women and the LGBTQ+ community in Lebanon face, such as the non-consensual sharing of intimate images, blackmail and doxxing.

Online gender-based violence was also explored by the Chilean-based Datos Protegidos, who analysed the law and the experience of women activists and members of the LGBTQ + community online.

The importance of the impact of privacy issues upon gender has been developed in Privacy International’s own work on this topic.

Surveillance of activists

Government surveillance is often targeted at people who are campaigning for social change. A striking example is that of Operación Huracán (Operation Hurricane) in Chile, a case that, according to research by Derechos Digitales, involved alleged police interception of communications of Mapuche leaders (the major indigenous group in the country), which turned out to be an attempt to frame them as criminals.

The risks of surveillance are also deeply felt by activists in Kenya. A survey by the National Coalition of Human Rights Defenders found that increased digital-based media and online interactions have changed the perceived risks that human rights defenders face, causing them to fear surveillance and take measures to protect themselves.

Health and welfare

Healthcare, and welfare provision, are other areas where people can be placed in highly vulnerable situations. In Paraguay, as revealed by TEDIC, the social security system presents several privacy flaws. Issues surrounding the medical examination of workers, and who has access to their medical records and sensitive health data, including biometric information, creates the risk of discrimination in the workplace.

But change is possible. In a 2015 case explored by KELIN, plans were made to use biometric details as part of a study of people with HIV and key populations in Kenya. However, members of the community vocally objected to the use of biometrics in the study. They succeeded in achieving change and the biometric requirement was dropped. This case illustrates how unified coalitions, led by those most affected, can achieve change.

Learn more

LGBTIQ+

Biometrics

Communications Surveillance

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

ID, Identity and Identification

Realise Our Rights to Live with Dignity

Our fight

Safeguarding Peoples' Dignity

Location

More about our partner

Hiperderecho

Foundation for Media Alternatives

SMEX

Derechos Digitales

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Kenya Legal & Ethical Issues Network on HIV and AIDS

Our campaign

Demanding identity systems on our terms

Content

News and Analysis

Reports

The time has finally come: Kenya is seizing the opportunity to protect individuals and their data

staff — Wed, 18 Jul 2018 16:42:51 +0000

Education material

The risks of data-intensive systems

Content

This photo originally appeared here.

For years, Privacy International and our partners in Kenya have been promoting the right to privacy in Kenya through research and investigations into government and private sector policies and practices and advocating for the adoption and enforcement of the strongest data protection and privacy safeguards.

The need for Kenya to adopt a comprehensive data protection framework (in addition to strengthening privacy protections in other legislation) has always been there but the urgency for such a regulation has heightened over the last few years with the move by the government of Kenya to deploy data-intensive systems including the expansion of state and corporate surveillance, the use of biometric electoral registry, and the use of social media data and other platforms to profile and target online users.

This is why the legislative process announced in early July 2018 by the government of Kenya to adopt a comprehensive data protection framework is an immense opportunity.

Privacy and data protection are intrinsically linked. Individuals, as citizens, customers, and consumers, need to have the means and tools to exercise their right to privacy and protect themselves and their data from abuse. We are pleased that the Kenya government has recognised this intrinsic link in clause 1 of the Data Protection Bill they published on 6 July 2018 by stating that the law “will to give effect to Article 31(c) and (d) of the Constitution” which uphold the right to privacy.

The on-going engagement by the National Coalition of Human Rights Defenders in Kenya (NCHRD-K) demonstrates the growing concerns of HRDs with regards to state and corporate surveillance which deeply impact their ability to undertake their work securely and freely.

Research by the Centre for Intellectual Property and Information Technology Law (CIPIT) on the privacy implications of using biometric technology during the electoral process in Kenya raised key questions on how the Kenyan government is adopting new technologies for governance and yet doesn’t have the necessary regulatory and security framework in place to do so in a way that protects the privacy of individuals. Similarly, the Kenya Legal & Ethical Issues Network on HIV and AIDS (KELIN) has advocated for the rights of key populations such as persons living with HIV, against the use of biometrics in HIV research, which they saw as both high-risk and intrusive: “Everyone just said no, and we kept saying no.”

In December 2017, Privacy International released an investigative feature revealing how Harris Media LLC, a far-right American digital media company, developed online campaigns on behalf of President Kenyatta’s re-election campaign targeting users through ad words in Google search and targeted advertising on a range of social media platforms. Despite what we have come to know, we still don’t have further details on what data and/or user profiles Harris Media had access to, and how they processed the data. Our concerns of such activities in Kenya were further heightened following the revelations that emerged from the Cambridge Analytica and Facebook scandal in March 2018 as they demonstrated the lack of transparency and accountability of both the public and private sector.

Whilst data protection won’t solve all the problems we’ve highlighted above, it will be extremely helpful and thus it constitutes a foundational protection mechanism for individuals to exercise their right to privacy.

It is crucial for any regulatory framework to be centred around the protection of human rights, autonomy and dignity, and therefore essential to ensure that legislative processes leading to the adoption of a data protection framework are open, inclusive and transparent.

Following the publication of a first bill in 2015, we welcome this renewed opportunity for Kenya to adopt a comprehensive data protection framework which will regulate the processing of personal data. It won’t be easy but PI and our partners are ready to take on this opportunity to share our expertise as well as our in-depth understanding of the privacy and data protection context in Kenya.

We invite you to read our joint submission on the Bill which highlights a number of significant shortcomings and presents various recommendations identified by PI, the NCRDH-K, CIPIT and KELIN to ensure that the law would provide for the effective protection of privacy and would comply with international data protection standards and principles and protect the rights of individuals.

Privacy International looks forward to engaging, in collaboration with our partners, in the next steps of this legislative process and calls on any other parties, in particular civil society organisations, to directly engage within the legislative process.

To find out more about privacy and data protection in Kenya, please refer to ‘The State of Privacy in Kenya’ (last updated in February 2018).

If you are interested you can visit our website to find out more about our efforts to call for the adoption and enforcement of stronger privacy and data protection laws with the Privacy International Network, and you can also sign up to our public engagement platform to stay in touch with us!

Repeating Image and Text

Location

Kenya

Democracy portfolio country

Africa

Democracy portfolio country

Off

Global South

Democracy portfolio country

Off

More about our partner

Kenya Legal & Ethical Issues Network on HIV and AIDS

Country of Operation

Region of Operation

Website