10/3/2023

Privacy

◻ The right and ability of individuals to control

their personal information and decide how and
when it is collected, used, and shared within the
framework of legal and cultural norms.
◻ Privacy is a significant topic within the realm of
legal and ethical issues.
◻ It involves the protection of an individual's
PRIVACY personal information and their right to keep
certain aspects of their life and identity private.

Personal Data vs Sensitive Personal Data Personal Data vs Sensitive Personal Data

◻ Personal data: any piece of information that ◻ Sensitive personal data aka as special category
someone can use to identify, with some degree data: a specific set of “special categories” that must
of accuracy, a living person. be treated with extra security.
◻ It is a subset of personal data that requires higher
 e.g., name, address, phone number, email
levels of protection due to the potential harm if
address, date of birth, financial details, and exposed.
information related to work, education and ◻ Includes highly confidential information that, if
hobbies. mishandled, could cause significant damage e.g.:
◻ Personal data is also classed as anything that  racial or ethnic origin; data related to a person’s
can affirm your physical presence somewhere. sex life or sexual orientation; and biometric data
(where processed to uniquely identify someone).

1
 10/3/2023

Privacy Data Protection vs Freedom of Information

◻ We want to keep some (if not all) areas of q When data was stored in paper form it
our lives private. was that much harder to work with.
◻ It is our right to do so.
q Today, massive amounts of data can be
◻ Though…
stored, accessed or moved/transferred at
There seems to be a difference in how much
we value our privacy, depending on which the click of a button.
generation we belong to. q Two areas of law become of interest:
■Social media generation q Data protection
■However, too, loyalty cards
q Freedom of information ...

Data Protection vs Freedom of Information Privacy: Key Concepts

◻ Data protection ◻ Data Privacy

there should be controlled access to data qthe protection of personal data and
about me information from unauthorised access or
■For privacy misuse.
◻ Freedom of information q Laws that address this include the Kenya

I’dlike to see/know what information the Data Protection Act (2019), Europe’s General
government/public authorities have Data Protection Regulation (GDPR) and the
California Consumer Privacy Act (CCPA) in
■subject to certain exemptions
the United States.

2
 10/3/2023

Privacy: Key Concepts Privacy: Key Concepts

◻ Privacy Laws ◻ Ethical Considerations
 Various countries and regions have enacted privacy laws to q Privacy is not just a legal issue but also an ethical
protect individuals' rights.
one.
 These laws define what constitutes personal data, how it can
q It involves respecting individuals' autonomy and
be used, and the penalties for violations.
■ E.g. they empower individuals with rights over their
their right to control their personal information.
personal data: q Essential ethical principles in this context include
■ Kenya’s Data Protection Act, 2019, empowers Kenyan q consent
citizens to request access to their personal data held
q transparency
by a company.
■ The EU’s GDPR empowers European citizens to request q data minimisation ...
that a company deletes their stored data.

Privacy: Key Concepts Privacy: Key Concepts

◻ Informed Consent ◻ Technological Advances/New Technologies
 Individuals should be informed about what data is  Big Data, AI, the Internet of Things (IoT), 5G etc
collected and how it will be used. increase data accessibility and pose challenges to
privacy.
■ E.g., an app asks for permission to access your
 They can collect and analyse vast amounts of
location and explains why it's needed.
personal data.
◻ Data Minimisation
■ E.g., predictive algorithms analysing your online
 Collect only the data necessary for a specific behaviour to make recommendations.
purpose.  Ensuring privacy in these contexts is an ongoing
■ E.g., an online shopping site only asks for your concern.
name and address during checkout.

3
 10/3/2023

Privacy: Key Concepts Privacy: Key Concepts

◻ Other major concerns due to the ◻ Other major concerns due to the proliferation of the
internet:
proliferation of the internet: ◻ Social Media Privacy
◻ Online Privacy  Posting personal information on social media
platforms can expose individuals to privacy risks.
Includes issues lik e tracking, data  Users often reveal personal information without
col lec tion by w ebs it es an d o n l ine considering the consequences.
■ Sharing geolocation data on social media while
services, cookies, and the use of on vacation.
personal information for targeted ■ Posting vacation plans on social media can
make you a target for burglars.
advertising.

Privacy: Key Concepts Privacy: Key Concepts

◻ Social Media Privacy (cont...) ◻ Healthcare Privacy

 Platforms' data collection practices and their  Laws such as the US’ Health Insurance
use of personal information are subjects of Portability and Accountability Act
debate.
(HIPAA) govern the privacy of medical
 Third-Party Apps connected to social media
records and personal health information.
can access user data, sometimes without users
realising. ■E.g., a healthcare provider cannot

■A quiz app collecting users’ Facebook data

disclose a patient's medical history
and selling it to advertisers. without their consent.

4
 10/3/2023

Privacy: Key Concepts Privacy: Key Concepts

◻ Workplace Privacy ◻ Consumer Privacy

q Companies often collect and use customer data
E m p l o y e e s h a v e c e r t a i n for marketing and analysis.
expectat ions of pri vacy i n t he ■ E.g., concerns about the security of personal
information when using mobile banking apps.
workplace, but employers may ▪ Safaricom collecting and using customer data
monitor activities to varying degrees. for targeted marketing.
q There are legal and ethical considerations around
 Balancing these interests is essential.
how they handle this data and whether individuals
have consented to its use.

Privacy: Key Concepts Privacy: Key Concepts

◻ Cultural Considerations ◻ Surveillance

 Government surveillance programs and the use of
q Community and Family surveillance technologies (e.g., CCTV cameras,
q Kenyan culture has traditionally placed facial recognition) raise privacy concerns.
 Balancing national security needs with individual
importance on communal living and family privacy rights is a complex ethical and legal
ties. challenge.
q This affects the boundaries of personal ■ Examples:

privacy. ■The debate over the use of facial

recognition technology by law enforcement.
q E.g.,family members may expect access to each ■ Unauthorised interception of text messages.
other's personal information more readily than in
some Western cultures.

5
 10/3/2023

Mass surveillance
Scope creep  mass surveillance

Mass/state/goverment surveillance: they can surveil certain

persons for certain purposes...
Scope creep – now it seems to be ALL information about
ALL people ALL the time.

The Panopticon

Mass Surveillance
◻ The Panopticon
◻ La te 1 8th Cen t ury i de a by J er emy B e nt ha m ( En gl i sh
philosopher and social theorist).
 One invisible warden in a central tower watches many
individuals separated from each other.
 To help manage correctional facilities by inducing good
behaviour
■ the more people are watched, the better they behave.
■ the prisoners do not know who is being watched, thus
they modify their behaviour accordingly.
◻ Inspired George Orwell’s big brother’s all seeing eye in
Prison San Vittore – Milan (built in 1880)
“1984”. 24
Source: thefunambulist.net

6
 10/3/2023

Mass Surveillance Mass Surveillance

◻ Bentham’s Panopticon, and novels by HG Wells ◻ Organisations monitoring your communication

and Orwell, were futuristic fiction. ◻ What determines the content of what you

◻ Today it is a reality. share o n y o u r fav o u rit e soc i al me di a

◻ Today both the state and individuals can use network?
technology for mass surveillance: ... Probably influenced by the assumption
 easy due to the prevalence of smart phones, that people are watching and judging you.
CCTV in the malls and streets, speed cameras Others also assume you are watching and
on the highways, Digital TV sets, ipads ... judging them.
So you all self-censor.

Mass Surveillance Mass Surveillance

◻ State surveillance ◻ The surveillance:

◻ Acts as a deterrent

◻ Justification? Insidious
(like the panopticon)
■If we feel we are probably being
To curb terrorism watched we modify our behaviour
To tackle crime … accordingly.
◻ Provides information for investigation
◻ How? … purposes.

7
 10/3/2023

Mass Surveillance Examples Mass Surveillance Examples

◻ 2013: The NSA's mass surveillance programs, revealed by ◻ China’s Social Credit System
whistleblower Edward Snowden. ◻ A nationwide system that assigns scores to individuals
◻ The programs, such as PRISM and XKeyscore, involved the and businesses based on their behaviour.
collection of massive amounts of electronic communications
data, including emails and phone records (plus the ability to ◻ Collects data from various sources, including financial
record and replay phone calls), from both U.S. citizens and transactions, social media activity, and public records,
non-citizens. to assess citizens' trustworthiness.
◻ Without judicial warrants; ◻ Individuals with high scores receive benefits, while
◻ Using phones + the internet to carry out mass surveillance and those with low scores face restrictions.
data mining. ◻ Basically mass surveillance and social control
 E.g. based on your internet searches and social networking data.
 it involves extensive data collection and monitoring
of citizens' activities.

Mass Surveillance Mass Surveillance

Kenya Kenya

◻ In strategic areas in Nairobi; ◻ To help the police force tackle

◻ cameras that can recognise motor crime, cameras installed in
vehicle number plates Nairobi city
capture number plates of vehicles ■The Nairobi Integrated Urban
involved in traffic offences or crime Surveillance System project.
(stolen/carjacked) Mombasa

8
 10/3/2023

Mass Surveillance Mass Surveillance

Kenya Kenya

◻ Data is being collected, centralised and ◻December, 2012

shared.
◻The Integrated Population
◻ March, 2012: CCK (today’s CA):

Announced an increase in cyber security threats.

Registration System (IPRS)
Declared the need for authorities to monitor ◻Developed for the Kenyan
digital communications.
government by EDAPS, a
◻ Service providers required to install NEWS
(Network Early Warning System) Ukrainian firm.
i.e. equipment used to monitor internet traffic.

Mass Surveillance Surveillance Activities

Kenya Other Examples

◻ IPRS function: to collect and combine data from ◻ March, 2013

databases owned by various government agencies: ◻ The Ministry of Information PS announces that mobile
◻ All the following registers: service providers were blocking at least 300K “hate”
 Birth & death, citizenship, ID card, aliens, passport,
SMSs daily.
marriage & divorce, elections, tax, drivers, NSSF, ◻ Ostensibly to prevent violence in the 4th of March
NHIF, the Kenya National Bureau of Statistics. elections;
(Privacy International, 2019) ◻ service providers had installed software to
 detect messages containing particular words (e.g. kill)
◻ The running of this system was allegedly subcontracted
 automatically flag them off for further scrutiny and
to a foreign country. potential blocking.
◻ PS: It was hacked...

9
 10/3/2023

Surveillance Activities Surveillance Activities

Other Examples Other Examples

◻ April 2014 ◻ Aims:

◻ The Kenyan government proposes the Umoja Kenya ◻ To identify people with fake identification
Initiative, a universal single registration system
documents.
 Activated when a child is born
◻ To provide one digital ID
 Stored in a national digital database.
◻ Collect: to streamline registrations
 Individuals’
biometric details ■E . g.
vo t er , n at i o n al I D, NH IF , NS S F, KR A,
 other personal information collected
commercial/business related.
■E.g.name, age, relatives’ identities, location and assets rather than have different cards for each.
owned.

Surveillance Activities Surveillance Activities

Other Examples Other Examples

◻ July 2015: Wikileaks allegations: ◻ A presidential directive that names of people

◻ The Kenyan government wanted to procure a living with HIV, including school age children be
collected.
Remote Control System tool;
◻ The Kenya Legal & Ethical Issues Network and
 to remote hack and control target devices.
others sued the government in December
◻ R e q ues ted a f or ei gn i n tr u si on ma l w ar e 2016…
company (HackingTeam) to shut down a blog. ◻ December, 2016
◻ This would serve as a Proof of Concept. ◻ Th e High Court in Nairo bi declared th is
◻ If successful they would win the contract to directive unconstitutional.
supply surveillance tools.

10
 10/3/2023

Surveillance Activities Surveillance Activities

Other Examples Other Examples

◻ Argued such a list violated the q January 2017, CA announced their plan to
Constitution’s: implement a device management system:
◻ Article 31 q Ostensibly to identify fake and stolen devices.

the right to privacy q In reality: a spy system to monitor digital

◻ Article 53(2) communications:

the "child’s best interests are of paramount q a third party (a foreign firm) connects to mobile
importance in every matter concerning the service providers’ routers
child." q To snoop on private communication data
q SMS, call and mobile money transfer data.

Surveillance Activities Surveillance Activities

Other Examples Other Examples: Huduma Number
q The Consumer Federation q January 2019
q The president signed into law amendments
denounced it as:
to the Registrations of Persons Act.
qagainst the Constitution q Basically about introducing the National
Integrated Identity Management System
qexposing service providers to
(NIIMS)
lawsuits for breach of q i.e.,a biometric ID card with a unique ID
confidentiality. number
q aka the “Huduma Namba”.
For all Kenyans and all foreign residents.

11
 10/3/2023

Surveillance Activities Surveillance Activities

Other Examples: Huduma Number Other Examples: Huduma Number

◻ Previously all that was needed as a ◻ March 2019

unique identifier was finger/thumb prints. ◻ The National Integrated Identity Management
◻ This amendment added DNA information; System (NIIMS) launched.
E.g. hand and ear lobe geometry, retina, ◻ Aim: one card merging information from
iris and voice patterns in digital form. multiple documents.
◻ Also more location info ◻ These numerous implementations of modern
e.g.land reference number, plot and house technology are a good thing.
number and GPS coordinates. ◻ Right?

Surveillance Activities
Data Processing vs Privacy
Other Examples: Huduma Number
q Once more, massive amounts of personal ◻ The constitution enshrines our right to
data was being collected, centralised and privacy.
shared. ◻ But pre-November, 2019 there was

q YET!... no law to specifically give it effect.

q Kenya had yet to adopt data protection ◻ No data pro t e ct i on l aw  an
legislation around these activities. individual’s personal information can
q The project lacked adequate data be abused by those that obtain it.
protection measures and oversight.

12
 10/3/2023

Data Processing vs Privacy Surveillance Activities

◻ A Data Protection Bill has existed in ◻ Previously :

various forms since… No data protection law
◻ 2012…!! No data protection agency/authority.

◻ The Kenyan Dat a Pro tection Bi ll ◻ Yet all this data about an individual
(2019) was the latest version. stored in one database.
◻ At long last (November 8, 2019) the ◻ The problem being there was no law

president signed it into law. to protect it.

Surveillance Activities
Other Examples: Huduma Number (cont) … India
◻ Also: ◻ The Aadhaar number was initially
◻ Is the practice and spirit of it such

initiatives as the Huduma No. from a

publicised as a voluntary service.
genuine place? ◻ Ho wev er citize ns wi tho ut t his

◻ If we are not t o find this system n u m b e r w e r e d e n i e d c e r ta i n

suspect, we must be assured that the crucial services
government has our interests at heart. E.g.collection of payments for those
◻ cf the Aadhar Number…
on welfare.

13
 10/3/2023

Privacy vs Secrecy/Surveillance Privacy vs Secrecy/Surveillance

◻ Data privacy is a right. ◻ Do we need data protection laws?

◻ Data protection laws are not normally seen as ◻ If a man in the middle attack happens

important then your data is open to everyone.

 isdata privacy as important as violation of your Turkey – 2016. Super sensitive information
human rights or freedom of expression?
about its citizens (names, their locations etc)
◻ In many countries, privacy and surveillance found on a torrent file.
rarely seen as important in the larger context.
 We are inured by the oft repeated message:
◻ So what? You have nothing to hide, right?
■Surveilling us is beneficial to us due to increasing security
threats.

Privacy vs Secrecy/Surveillance Privacy vs Secrecy/Surveillance

◻ National IDs registration requires information ◻ E.g. 2016:

on our location of origin. personalised text messages sent to citizens in
◻ Enables whoever is interested to figure out your some counties asking them why they had not
tribe/ethnicity. registered as voters.
chiefs had people’s numbers and their
◻ Your data can be weaponised (used against
locations and would visit them to enquire and
you) e.g. it can be used to track you down. encourage them to vote.
 E.g. voter registration
■toverify that you are on the voter roll, type in your ID no.
◻ Implication: personal data is not secure
■You get your name and voting locale.
and mass surveillance is carried out.
■Nice but then so does anyone else with your ID number

14
 10/3/2023

Privacy vs Secrecy/Surveillance Privacy vs Secrecy/Surveillance

◻ Should someone working at one ◻ Wanting privacy is NOT akin to you

parastatal have access to your data at having something to hide.
another parastatal? Privacy is NOT Secrecy.
◻ How about KRA having across the board
◻ It is the ability to control the collection,
information about you?
use, sharing etc of your personal
E.g. KRA attempts to access M-Pesa
data …
transaction records “to catch tax cheats”.

Privacy vs Secrecy/Surveillance Privacy vs Secrecy/Surveillance

◻ You probably have nothing to hide. ◻ In most countries, governments are

◻ However, you desire the ability to have your allowed to
own space, free thoughts, free speech etc. …
tap private conversations and
◻ … without surveillance.
access personal data
◻ Governments may not want this, as they wish to
prevent dissidence. ◻ As long as
◻ S el f cen so rsh ip also k il ls creativi t y and thereis a valid reason and
innovation. permission from the courts.

15
 10/3/2023

Privacy vs Secrecy/Surveillance Data Protection Issues

◻ However some seem to require ◻ Having nothing to hide shouldn’t justify

citizens to give up their rights in the lack of data protection legislation.
name of national security. ◻ As a human, you have autonomy...

◻ Judicial oversight discourages the ◻ This is a fundamental right.

government from abusing this Basically, do what you want, when you
privilege wa nt, wi tho ut hin drance / feel i ng
even if fighting terrorism. watched.

Why should we care? Why should we care?

◻ The information / digital age is powered by ◻ We have little/no ability to control what is
information d o n e to o u r da ta i f t h e r e ar e n o l e g a l
◻ Technological advances have led to massive mechanisms in place.
amounts of our data being out there. ◻ Your digital persona can easily affect your
◻ Corporations and governments worldwide physical persona negatively
hunger for this information  Persuasion through ads
 This data is sorted and you are profiled based on  Harassment e.g. cyberbulling/stalking

the data.  Blackmail eg ransomware

 Worse: automated decisions could be made based  Discrimination

on this data. ■Information in the wrong hands can be dangerous

16
 10/3/2023

Why should we care? Why should we care?

◻ Information is a priceless commodity that ◻ Big data firms seem to have more power than
we give out for free. governments.
◻ Governments want to regain their power
◻ Why not sell it?
◻ A country may have exponential growth in e-
Watch Stuart Lacey’s TEDxBermuda talk commerce (as Kenya does).
titled: “The Future of Your Personal Data -  Manycitizens run their businesses on FB, Instagram,
Privacy vs Monetization” e-commerce platforms like Jumia and Amazon.
https://www.youtube.com/watch?v=JIo- ◻ No legislation to protect data means people’s
V0beaBw sensitive data is online but unprotected.

Why should we care? Why should we care?

◻ Data breaches ◻ EU countries have the power to hold

E.g.instances of millions of FB accounts being corporations to account
hacked.
e.g. telling FB that it’s standards are not
FB has a lot of data about a lot of people…
up to par with their legal requirements
◻ GDPR: To transact with businesses based
◻ This protects their citizens’
in EU countries/trade we must have data
protection laws. data/privacy.
W i t h o u tthem we miss out on trade ◻ Governments without such legislation

opportunities. may have no standing to do the same.

17
 10/3/2023

Data Protection Issues

Data Protection ◻ Having massive amounts of

Legal, Ethical and Human Rights Issues
personal information 
profiling  denial of services.
◻ Concerns:

Legal
Ethical
Human rights

Data Protection
Legal Issues

◻ For a long t ime the re h as been no data

Data Protection protection law/legal framework to support the
go v e rn m e n t c o ll e cti n g hu ge am o u n t s o f
Legal Issues personal data.
 Fortunately the constitution did protect citizens
(Article 31).
◻ E.g. as of 2019, a popular Kenyan service
provider + a local bank teamed up to provide
overdrafts to subscribers …

18
 10/3/2023

Data Protection Data Protection

Legal Issues Legal Issues

◻ When you opt in, one of the T&Cs is: ◻ How and why did private entities have access
You allow them access to the information the to such potent data?
Integrated Population Registration System ◻ B e c au se the r e wa s n o l e ga l f r am ew o r k
(IPRS) system holds about you. governing the IPRS.
■IPRS was developed for the Kenyan
◻ Th e Reg ist ration of Pers ons Act all ows
collection of data but doesn’t discuss it’s
government (NOT private corporates!!).
protection.
◻ Ditto other businesses with apps that offer ◻ The government should not serve private
credit services … business interests; it should serve the citizens.

Data Protection Data Protection

Legal Issues Legal Issues

◻ Can malicious entities get access ◻ Danger of private communication data

held by CA being exposed;
to this information then? ◻ January, 2017: The CA website hacked by

◻ With access even to DNA info? AnonPlus who placed their manifesto on the
homepage
◻Can I be tracked using my
Th ey prom i se d to “d ef en d free d om o f
eye/facial recognition data from information, freedom of the people and
emancipation of the latter from the oppression
all the CCTV cameras? of media”.

19
 10/3/2023

Data Protection Data Protection

Legal Issues Legal Issues

◻ Errors in personal data q Privacy violations

 From e.g. data storage/transfer glitches or hacks q A lender app accesses your phone book and sends
◻ If my data (e.g. DNA data) is corrupted: messages shaming you to your contacts
q Today Apple notifies you when an app wants to access
 wrongful arrest (mistaken id)?
your contacts, location, photos etc.
 denial of services?
q It wasn’t always so.
■both by government or private entities
q Without your consent apps would:
■E.g. your credit history is ruined due to automated
q access your address book (almost 1/5 of all its apps),
decisions
q track your location (2/5 of the apps) and
■living in a certain neighbourhood …
q have this data stored unencrypted (> 2/5 of the apps).

q identity theft aka identity fraud

Data Protection
Ethical Issues

Data Protection ◻ How ethical are the following:

◻ Compulsory collection of sensitive personal

Ethical Issues data (DNA, GPS coordinates etc) for the

sake of collection?
◻ State “honesty” in explaining its data

collection?
Is the passing of amendments to certain laws
done with transparency / accountability /
integrity in mind?

20
 10/3/2023

Data Protection Data Protection

Ethical Issues Ethical Issues

◻ How ethical are the following: q How ethical are the following:
Treating humans as their data (am I my data)?
◻ The state having considerable
q
q “ok” and profitable for businesses but…
insight into our lives? q … governments actions should not be driven by
commercial interests/profit margins
◻ The state enabling others (private
q Cambridge Analytica – data used to breach
corporations/individuals) to have the democracy of at least two developed
insight into our lives nations.
e.g. through security breaches)? q How sovereign are we?

Data Protection
Human Rights Issues

Right to privacy
Data Protection q

q The state/its official organs having massive

Human Rights Issues amounts of data can be dangerous

q Your information can be weaponised

q E.g. genocide is made easy…

q Marginalisation (resource allocation)
q Wrong profiling – you are of religion X
therefore you are a terrorist
q (automated decision making)

21
 10/3/2023

Data Protection Data Protection

Human Rights Issues Human Rights Issues

Right to privacy
◻

◻ The data collector may not be a government

◻ Right to privacy
officer ◻ Once more:
 they may simply be hired contractors trained
with no notion of privacy ◻ Privacy is a fundamental

◻ cf human right.
 Huduma namba;

 p o l i t i c al SM S s s e n t t o y o u r “ pr i v a te ”
cellphone number

Data Protection Data Protection

Human Rights Issues Human Rights Issues

◻ Right to Dignity q Right to Equality

◻ Violation of dignity:
qArticle27 of the constitution.
The state + private corporations too
aware of your activities/life qNo discrimination …
◻ Your have a right to your freedom qR e g a r d l e s s o f
and security gender/ethnicity …
■Beingtreated as a human.
■Automated decision making violates that.

22
 10/3/2023

Data Protection Data Protection

Human Rights Issues Human Rights Issues

q Right to Equality ◻ Right to Equality

q No discrimination … Regardless of gender/ethnicity …
q Locationinformation: ■W h y fill these details in
q We are told information is collected to
government forms then?
provide services.
■Provision of DNA information can
q What about the homeless? Refugees?
People living in domestic violence shelters? be used to trace your ancestors’
q No services for them? origins.

Data Protection Data Protection

Human Rights Issues Human Rights Issues

◻ Right to Equality ◻ Right to Equality

◻ Not being treated equally = torture ◻ Not being treat ed e qually =

A database for People Living with HIV. torture

■To serve what purpose?
Say you are not in the database …
A u t o m a t e d decision making  ■No government services?
■Infringes on your right to welfare payments,
profiling  discrimination right to health care, right to vote …
■cf Aadhaar number

23
 10/3/2023

Is Data Protection Legislation Necessary? Is Data Protection Legislation Necessary?

q Mass surveillance implies data on individuals q When individuals are under constant surveillance, there
is gen erat e d, col lect ed and pro cesse d may be a presumption of guilt or suspicion, shifting the
burden of proof from the prosecution to the defense.
re gar dl ess of t he i r be i ng i nv o l ve d (o r
q Mass surveillance can create an environment where
suspected to be involved) in criminal activities. individuals are treated as potential suspects until they
q This “distorts the burden of proof principles, can prove their innocence.
leads to an unaccountable increase in power, q This chilling effect on freedom of expression
and has a chilling effect on individual action q Knowing that they are being monitored, individuals

and the exercise of free speech.” may self-censor their online activities and
communications out of fear of being targeted or
(Kiprono, 2018) ... labeled as a potential threat.

Is Data Protection Legislation Necessary?

◻ Good governance requires the state to respect its

citizens right to express their opinions freely.
96 Data Protection Legislation
 E.g.in exposing corruption, injustice and malpractices against
consumers
■Buyer Beware.
 Fighting terrorism shou ld not be an excuse for bad
governance.
■ Not the right way to fight terrorism.
■ Identify the root problem.
■ What makes someone become a terrorist/radicalised?
■ Could it be marginalisation/discrimination?

24
 10/3/2023

The Data Subject What should a DPL look like?

◻ Most probably you. ◻ Scope
◻ The EU’s General Data Protection Regulation (GDPR) defines  Individual right to privacy - protect the data subject (the
a ‘data subject’ as an “identified or identifiable natural Kenyan citizen)
person” from whom or about whom information is collected.  The protections offered should be at par with/better
 Natural person: a company or organisation cannot be a than those offered internationally
data subject ■e . g .
th e o b l i g at i o n s of co m me r c i a l e n ti ti es w h en
◻ A person who can be identified, directly or indirectly, in generating/collecting, processing, storing the data.
particular by reference to an identifier such as a name, an ■What the state does with your data
identification number, location data, an online identifier or to
■Data sovereignty – data is subject to the laws and
one or more factors specific to the physical, physiological,
governance structures within the nation it is collected. Data
genetic, mental, economic, cultural or social identity of that
natural person.
sovereignty comes into play when the data is stored
outside the country and is subject to that country’s laws.

What should a DPL look like? What should a DPL look like?

◻ Specific limitations on the rights ◻ Data categories

as per the constitution e.g. how to collect/store/process
◻ Clear definition of consent e.g.: sensitive personal data …
Does silence assume consent? i.e. information that can be used to

Should I be opted in without my

discriminate against you e.g.:
■information about minors, race, tribe,
knowledge?
trade union membership, gender,
marital status.

25
 10/3/2023

What should a DPL look like? Players

◻ Remedies/modes of ◻ Two entities/persons:

redress Data controller
◻T h e da t a p r o t e c t i o n
Data processor
oversight authority and its
independence

Players Players

◻ Data controller ◻ Data processor

The person or entity that determines ◻ A person/entity that, on behalf of the data
controller,
■the purpose for which personal data is
 collects
personal data
collected and processed
 processes this data
■the means and method of processing it ◻ Does not own or control the data they process
◻ i.e., dictates how and why data is going to  They can’t change the purpose and the means in
be used by the organisation. which the data is used.
 They are bound by the instructions given by the
data controller.

26
 10/3/2023

Players Players
◻ Basically, a data controller determines why and ◻ Example (cont...):
how personal data should be processed while
◻ a data processor carries out these tasks on behalf of
◻ The uni is the data controller and
the controller. ◻ The security firm is the data processor.

◻ Example: ◻ The uni could also act as both when

◻ Say the university has hired a security firm. collecting other data
◻ The uni determines what information is to be e.g. student registration data.
gathered at the gate about the students/staff/other
visitors.

Data Privacy Laws

◻ M a n y c o u n t r i e s / r e g i o n s h av e l a w s 108 Data Privacy Laws

protecting individual’s privacy.
◻ What varies is the comprehensiveness and
The EU Context
enforcement of these laws.
◻ The EU’s GDPR is often seen as the gold

standard in privacy laws due to its wide

scope and stringent enforcement
mechanisms.

27
 10/3/2023

The EU’s GDPR The EU’s GDPR - Penalties for Violation

◻ The EU has a comprehensive data privacy law known ◻ Severe and designed to be effective, proportionate
as the General Data Protection Regulation (GDPR). and dissuasive for each individual case.
◻ A data subject has rights under the GDPR that aim to ◻ For especially severe violations, listed in Article 83 (5)
protect their privacy and right to self-determination. GDPR, the fine framework can be up to 20 million
◻ The GDPR euros, or up to 4% of the organisation’s total global
q enhances individuals’ control and rights over their
turnover of the preceding fiscal year, whichever is
higher.
personal information
q simplifies regulations for international business.
◻ Less severe violations in Article 83 (4) GDPR sets forth
fines of up to 10 million euros, or up to 2% of the
q governs the transfer of personal data outside the
organisation’s entire global turnover of the preceding
EU and the European Economic Area (EEA). fiscal year, whichever is higher.

The EU’s GDPR - Penalties for Violation

Severe Penalties Examples

◻
112 Data Privacy
◻ Facebook’s parent company Meta was fined a
record-breaking €1.2 billion for transferring The Kenyan Context
data collected from Facebook users in the
EU/EEA to the US, violating GDPR international
transfer guidelines.
◻ Amazon was fined €746 million for tracking
user data without acquiring appropriate
consent from users or providing the means to
opt out from this tracking.

28
 10/3/2023

Web & Mobile Presence

Data Availability
Kenya
Both mobile and internet penetration is very high.
◻

 According to the Communications Authority (CA,

Technological advances
the Kenyan telecommunications industry regulator),
in March 2017: 
■ 39.1 million mobile subscriptions (86.2% mobile
penetration) Massive amounts of data
■ 40.59 million internet users (89.4% internet
penetration)
 Millions active on social media daily.

Data Availability Kenya’s Privacy Laws

Enshrined in
Massive amounts of data
◻

 Kenya’s constitution and

 the Data Protection Act
 ◻ The constitution protects the right to privacy,
including protection against unnecessary revelation
Need for data privacy ◻
of information or infringement of communication
The Data Protection Act regulates the processing of
personal data, provides for the rights of data
subjects, and outlines the obligations of data
controllers and processors

29
 10/3/2023

1. Constitutional Privacy Protections Further…

◻ The right to privacy is enshrined in Article ◻ Article 2: should Kenya sign/ratify international
31 of the Kenyan constitution: treaties/ conventions they become part of the
Kenyan domestic law.
Every person has the right to privacy.
◻ Kenya is a signatory to
This includes the right not to have  the Universal Declaration of Human Rights (UDHR)
■their person, home or property searched; ◻ and has ratified
■their possessions seized;
 the International Covenant on Civil and Political
■information relating to their family or private Rights (ICCPR)
affairs unnecessarily required or revealed; or ◻ They include privacy rights.
■the privacy of their communications infringed.
(Kenyan Constitution: Chapter Four, Part 2, Article 31)

Limitations to Privacy Rights Limitations to Privacy Rights

(Kenya) (Kenya)
E.g. don’t just say you are fighting terrorism
◻ A rt i cl e 2 4 ( 3) r e qu i re s ◻

q Terrorism should be no excuse for poor governance

anyone wishing to limit any ◻ P r o v i de a s p e ci f i c re a s o n f o r t h e dat a
collection:
fundamental right to justify q Avoid data collection for the sake of data collection
themselves. ■ E.g. only take my DNA information only after I
commit a crime
◻ They must identify the ◻ Reason usually given is “to provide government
services”
need… q To business entities?

30
 10/3/2023

Limitations to Privacy Rights Limitations to Privacy Rights

(Kenya) (Kenya)

◻ Remember: ◻ Our personal information may be collected/

processed/shared etc …
◻ A Kenyan’s right to privacy includes the ◻ …only if article 24 of the Constitution is
r i g h t N O T to h av e “ i n f or m a t i o n adhered to.
 Justify/id the need.
relating to their family or private
◻ Our rights and fundamental freedoms may be
affairs unnecessarily required or limited "for the purposes, in the manner and
revealed; …” to the extent" set out in Article 24 of the
Constitution…

Limitations to Privacy Rights

(Kenya) Data Privacy Laws
Limited for the purposes...
◻

 E.g. such restrictions may only be imposed for purposes of

q A data protection law serves to
respecting others’ rights/reputations, or national security, public act as a framework that provides
order, public health or morals.
◻ ...in the manner... guidelines on personal data:
 Restrictions/limitations to our right to privacy must be legal and qWho the data controller is
follow due process
■ e.g. acquisition of warrants. qWho processes the data.
◻ ...to the extent... qH o w / w h y / w h e r e t h e d a t a i s
 s u ch r e st r i ct i ons m ust n ot o n ly be n e ce ssa ry bu t a l s o
proportionate. processed.
■ NOT some people sh ot u p a mall , let’s gat he r ALL
information about ALL people

31
 10/3/2023

2. The Kenya Data Protection Act,

Data Privacy Laws
2019
◻ Data is a right; a human right … ◻ Governs how personal data is
◻ i.e. it is a right attached to a human; collected, processed, and transferred,
◻ not property/a business asset both within Kenya and internationally.
You are a person, you are not your data. ◻ Expedited following concerns raised
■Sure, I can extract patterns from your
over the Huduma Namba registration
data and make decisions based on them
but you’re human, not a game of chess. exercise.
■Decisions should not be automatically the safety of citizens’ personal data
made based on your data. collected by the Government.

2.1 Purpose of the Act 2.1 Purpose of the Act

◻ gives effect to Article 31(c)and (d) of the ◻ provides for the

Constitution  rights of data subjects (individuals whose
 (the right every person has not to have (c) data is being processed)
information relating to their family or private  obligations of data controllers (those who
affairs unnecessarily required or revealed; or d e t e r m i n e th e p u r p o s e an d m ea n s o f
(d) the privacy of their communications processing of personal data) and
infringed.)  the obligations of data processors (those that
◻ establishes the Office of the Data Commissioner process personal data on behalf of the data
◻ regulates the processing of personal data controller)

32
 10/3/2023

2.2 Data Protection Principles The Data Protection Act of 2019

◻ Data Controllers and Processors must: q Law to safeguard citizens’ personal data.
q Sets out comprehensive provisions for the collection,
process data lawfully;
use, storage, and handling of personal data.
minimise collection of data; q seeks to promote and protect the privacy of

restrict further processing of data; personal data and ensure that data controllers,
data processors, and data subjects adhere to the
ensure data quality; highest standards of data protection.
e s t a b l i s h a n d m a i n t a i n s e c u r i t y q sets out stringent requirements for data controllers

safeguards to protect personal data. on what to do with the personal data they collect...

The Data Protection Act of 2019 The Data Protection Act of 2019
q They must provide data subjects with a notice explaining ◻ The Data Protection Act also gives data
how their data will be collected, processed, and stored. subjects the right to access their personal data
q They must include details on the purpose of the data held by data controllers.
processing, the legal basis for the data processing, and
the party to whom the data will be disclosed. ◻ Data subjects can request data controllers to
q Data controllers must also obtain explicit consent from provide them with a copy of their personal
data subjects before they can process their personal data, and data controllers must respond to
data. these requests within thirty days.
q They must ensure that they only collect and process data ◻ Data subjects can also request data controllers
that is necessary for the purpose they seek to achieve. to rectify, delete, or restrict the processing of
their personal data.

33
 10/3/2023

The Data Protection Act of 2019 The Data Protection Act of 2019
Data controllers must comply with these requests, except
◻

under specific circumstances set out in the Act. ◻ The act establishes the office of the Data
◻ The Act also provides for the protection of data subjects’ Protection Commissioner, who is
rights against unauthorized processing, loss of data, or
destruction of data. responsible for overseeing and enforcing
◻ Data controllers must take appropriate measures to data protection regulations in Kenya.
safeguard personal data, including measures to prevent
unauthorised access, modification, disclosure, or destruction ◻ Th e Commiss ion er has th e powe r t o
of personal data.
◻ Data controllers must also put in place adequate technical investigate data controllers and
and organisational measures to ensure the security of processors suspected of violating data
personal data.
protection laws and to impose sanctions on
violators of the law.

The Data Protection Act of 2019 The Data Protection Act of 2019

q Regulates the processing of personal data q You have the right to know how your information
is handled.
and information. q You have the right to request your personal data
q GDPR principles informed the bill on the be deleted/edited if it is inaccurate.
q The right to data portability is enforced.
governance of this information
q A data subj ects can obt ain dat a th at a data
q How it is handled, stored and shared. controller holds on them and reuse it for their own
purposes.
q Illegal processing of personal data is q You now have the right to refuse an organisation to
punishable by law. transfer your personal data to another organisation.
q Should be a relief to cellphone users.
q Upto 3,000,000/= fine or a maximum of 2
years in jail.

34
 10/3/2023

2.3 Registration of Data Controllers

The Data Protection Act of 2019
and Processors
◻ To paraphrase an ICT CS: ◻ All data controllers and data
◻ KQ, tourist hotels etc must comply processors must be registered with
when handling personal data from the Data Commissioner.
clients. ◻ They must register themselves and
◻ Also phone-based lenders such as
renew their registration every 3
Safaricom, who gather tons of
years.
p e rs o n a l d at a t h r o u gh se r v i c e s
offered jointly with local banks.

2.4 Transfer of Personal Data Outside Kenya 2.4 Transfer of Personal Data Outside Kenya

◻ All data controllers/data processors must ◻ The following conditions ensure that cross-border data
ensure at least one copy of personal data to processing is carried out with proper safeguards and
which the Act applies is stored on a server or consideration for data subjects' rights and privacy.
data centre located in Kenya 1. Adequate Protection
2. Consent
◻ Cross-border processing of sensitive personal
data is prohibited 3. Legal Obligations
4. Vital Interests
 the transfer of personal data to foreign countries or
international organisations is only allowed when 5. Public Interest
ce rtain cond it ions are met or unde r cert ai n 6. Legal Claims
circumstances specified in the Act...

35
 10/3/2023

2.4 Transfer of Personal Data Outside Kenya 2.4 Transfer of Personal Data Outside Kenya

◻ Adequate Protection: if the foreign ◻ Consent: if the data subjects have

country or organisation ensures an provided explicit and informed
adequate level of protection for the consent for their data to be
data. transferred abroad.
the receiving entity must have data
This consent must be obtained
protection laws or mechanisms in
place that are equivalent or similar
before the data transfer takes
to those in Kenya. place.

2.4 Transfer of Personal Data Outside Kenya 2.4 Transfer of Personal Data Outside Kenya

Example:
◻ Legal Obligations: if such transfers ◻

◻ A cloud service provider, hosting sensitive data for various

are necessary for the performance of clients, is legally obligated to implement strict security measures
to protect the confidentiality and integrity of the data.
a contract between the data subject ◻ To comply with these legal obligations, the provider regularly
and the data controller or for the conducts security audits, encryption of stored data, and access
control measures.
implementation of pre-contractual ◻ They must also report any data breaches promptly to both their
measures taken at the data subject's clients and relevant authorities, as required by data protection
regulations.
request ... ◻ These legal obligations ensure the safety and privacy of client
data stored on their servers.

36
 10/3/2023

2.4 Transfer of Personal Data Outside

2.4 Transfer of Personal Data Outside Kenya
Kenya
◻ Vital Interests: if the data transfers are necessary ◻Vital Interests Example:
to protect the vital interests of the data subject,
particularly in life-threatening situations. ◻If you are unconscious and

◻ The processing of personal data may be necessary admitted to a hospital, medical

to protect the person's life or physical health in e.g.
 medical emergencies,
professionals may process your
 natural disasters, or personal data without consent if it
 si tua tions wh ere an i ndi vidual 's l i fe is i n is necessary to provide life-saving
immediate danger.
treatment.

2.4 Transfer of Personal Data Outside Kenya 2.4 Transfer of Personal Data Outside Kenya

◻ Public Interest: if the data transfers are ◻ Legal Claims: Transfers of data may be
necessary for the performance of a task allowed if they are necessary for the
carried out in the public interest or in the establishment, exercise, or defense of legal
claims.
exercise of official authority.
 E.g. a law firm processes personal data
e.g., to conduct a public health survey
without consent to pursue a legal claim on
during a disease outbreak. behalf of a client in a court case.
This is done in the public interest to  This processing is necessary for the
protect the health of the population. establishment, exercise, or defense of legal
claims ...

37
 10/3/2023

2.4 Transfer of Personal Data Outside Kenya 2.5 Exemptions

◻ Legal Claims Example: ◻ The processing of personal data is exempt
A software company is facing a legal dispute with a former
from the provisions of the Data Protection
◻

employee who claims they were wrongfully terminated.

◻ To defend themselves, the company needs to gather evidence Act;
related to the employee's performance, attendance records,
and communication logs during their employment.  for national security or public order
◻ This involves collecting personal data, such as the employee's reasons;
work-related emails, attendance records, and performance
evaluations.  when disclosure is required by or under
◻ The company processes this personal data without the explicit any written law or by an order of the
consent of the former employee, as it's necessary for the court.
defense of their legal claim against the wrongful termination
allegation.

How DPL Is Enforced in Kenya How DPL Is Enforced in Kenya

◻ Through the Data Protection Act and q A Data Protection Commissioner
various regulations that operationalise the serves as the Data Protection
provisions of the Act.
Authority that:
◻ The Data Protection (Compliance and

Enforcement) Regulations, 2021 outline qr e g i s t e r s o r g a n i s a t i o n s /

the compliance and enforcement businesses that own, manage, or
provisions for the Data Commissioner, control data.
Data Controllers, and Data Processors.
qinvestigates data infringements

38
 10/3/2023

How DPL Is Enforced in Kenya How DPL Is Enforced in Kenya

◻ The Act requires that any person who acts as a ◻ Cross-border processing of sensitive
data controller or data processor must be
personal data is prohibited and only
registered with the Data Commissioner.
 ... and renew their registration every 3 years.
allowed when certain conditions are
◻ Every data controller or data processor is
met or under certain circumstances
required to ensure the storage, on a server or specified in the Act.
data centre located in Kenya, of at least one ◻ In case of non-compliance with these
serving copy of personal data to which the Act
applies.
regulations, penalties may be
imposed.

The Kenyan Data Commissioner’s Roles The Kenyan Data Commissioner’s Roles

◻ The ODPC (Office of the Data 1. Oversee the implementation of

Protection Commissioner) ensures and be responsible for the
that personal data is handled enforcement of the Data Protection
responsibly and that individuals’ Act.
privacy rights are upheld. 2. Establish and maintain a register

◻ They do this via the following 11 of dat a co nt ro ll e rs and data

roles ... processors.

39
 10/3/2023

The Kenyan Data Commissioner’s Roles The Kenyan Data Commissioner’s Roles

3. Exercise oversight on data 5. Conduct an assessment, on its own initiative

processing operations, either of own or at the request of a private or public body,
for the purpose of ascertaining whether
motion or at the request of a data
information is processed according to the
subject, and verify whether the provisions of this Act or any other relevant
processing of data is done in law.
accordance with the Act. 6. Receive and investigate any complaint by
4. Promote self-regulation among data any person on infringements of the rights
controllers and data processors. under this Act.

The Kenyan Data Commissioner’s Roles The Kenyan Data Commissioner’s Roles

7. Take such measures as may be 9. Promote international cooperation in matters

necessary to bring the provisions of this re lat i n g t o dat a prot e ct i o n an d en su re
country’s compliance on data protection
Act to the knowledge of the general
obligations under international conventions and
public. agreements.
8. Carry out inspections of public and 10.Undertake research on developments in data

private entities with a view to evaluating processing of personal data and ensure that
the processing of personal data. there is no significant risk or adverse effect of
any developments on the privacy of individuals.

40
 10/3/2023

The Kenyan Data Commissioner’s Roles Enforcement of DPL: Kenya vs EU

11. Perform such other functions ◻ T h e D at a Co m m i s s i o n e r i n

as may be prescribed by Kenya plays a crucial role in
any other law or as enforcing data protection laws.
◻ In comparison, EU’s GDPR is
necessary for the promotion
enf orce d by e ac h m e m be r
of the object of this Act.
state’s national data protection
authority ...

Enforcement of DPL: Kenya vs EU Enforcement of DPL: Kenya vs EU

These authorities are independent public
q
◻ Like Kenya’s Data Commissioner,
authorities that supervise, through investigative
and corrective powers, the application of the these authorities have powers to
data protection law. qcarry out investigations in the form
q They provide expert advice on data protection of data audits,
issues and handle complaints lodged against
qissue warnings for non-compliance,
violat ions of the GDPR and the relevant
national laws. qissue corrective measures such as
q There is one such authority in each EU Member bans on processing and fines.
State.

41
 10/3/2023

Enforcement of DPL: Kenya vs EU

◻ Unlike Kenya where there is

a single Data Commissioner,
GDPR enforcement can vary
by member state as each
state has its own national
data protection authority.

42