1. DATA PRIVACY AND PROTECTIONTM
DATA PRIVACY AND PROTECTION
Telecommunication, Media & Technology Dept.
Presentation at IHUB
2nd August 2019

2. KENYA’S LEGAL LANDSCAPE
1. THE CONSTITUTION OF KENYA (2010)
The Constitution highlights key general provisions of the right to privacy at Article 31.
2. THE CONSUMER PROTECTION ACT (2012)
The Consumer Protection Act touches on privacy by defining personal information and given its mandate to protect consumers against unfair trade practices.
3. THE COMPUTER MISUSE AND CYBERCRIMES ACT
Although has a majority of its sections suspended, it list major offences related to processing information
4. DATA PROTECTION BILL VS THE EUROPEAN UNION GDPR 2016

3. KEY DEFINITIONS
Data subjects – the natural person to whom the personal data relates
Personal Data- any information relating to an identified or identifiable data subject-such as a name, an identification number, location data etc.
Processing – broad concept that includes almost anything that you can do with personal data, including collection, storage, use and destruction.
Data controller – a person who (either alone or jointly or in common with other persons) determines the purpose for which and the manner in which any personal data are, or are to be, processed.
Data processor- any person (other than the employee of the data controller) who processes the data on behalf of the data controller.

4. DATA PRIVACY AND PROTECTION
Data Privacy is concerned with proper handling of information i.e consent, notice, regulatory compliance, transfer and sharing;
Data Protection involves safeguarding information i.e technical measures, outsourcing;

5. Six privacy principles under the DP/gdpr
Lawfulness, fairness and transparency- informing data subjects of the kind of processing that will take place; consent
Purpose limitations – data collected for specified and legal purpose; and if it is being used for the reason it was collected
Data minimization - No more than the minimum amount of data should be kept for specific processing- adequate, relevant.
Accuracy - Data stored or processed must be accurate and kept up to date
Storage limitations- Data retention considerations
Integrity and confidentiality - Requirements on how data is processed, stored, protected, transferred outside, to third parties

6. Rights of data subjects under dp/ gdpr
access their own personal data
rectify inaccurate data
right to object to processing; direct marketing
right to be forgotten (DP-deletion of inaccurate)
the right to data portability

7. Other aspects covered Consent Data Security e.g encryption
Data breach reporting
Privacy Impact Assessment
Awareness and Policies
Penalties-British Airways; Safaricom

8. HOW TO ACHIEVE COMPLIANCE
Legal and Regulatory provisions
Best Industry Practise
Organisational Structures- Awareness; Policies
Contractual Clauses
Self- regulation

9. FOR EXAMPLE:-
UBER APP KE:-Terms and Conditions 2017

10. FOR EXAMPLE:- LITTLE CAB KE AND GLOVO KE

11. FOR EXAMPLE; AMAZON US

12. FOR EXAMPLE; AMAZON US

13. FOR EXAMPLE;ALI BABA

14. FOR EXAMPLE; ALI BABA

15. FOR EXAMPLE; JUMIA

16. FOR EXAMPLE; JUMIA

17. FOR EXAMPLE; JIJI (dispute resolution)

18. ANY QUESTIONS?
THANK YOU FOR YOUR TIME