Immaculate Kassait: Elevating Kenya Data Protection to National Conversation

• Outgoing Data Commissioner Immaculate Kassait views making data protection a national conversation as her key achievement during her six-year tenure.
• The Office of the Data Protection Commissioner (ODPC) raised public awareness and enforced accountability for data handling practices.
• Kassait highlighted challenges posed by artificial intelligence and Kenya's reliance on foreign technology infrastructure.
• The ODPC has issued guidance on AI data protection and advocates for data minimization in digital product design.
• Future priorities include ratifying the Malabo Convention and strengthening legal frameworks for cross-border data protection.

Outgoing Data Commissioner Immaculate Kassait recently reflected on her six-year tenure, highlighting a significant achievement: elevating data protection from an obscure regulatory concern to a prominent national conversation in Kenya.

Outgoing Data Commissioner Immaculate Kassait recently reflected on her six-year tenure, highlighting a significant achievement: elevating data protection from an obscure regulatory concern to a prominent national conversation in Kenya. During her leadership at the Office of the Data Protection Commissioner (ODPC), Kassait spearheaded efforts that dramatically increased public awareness regarding the critical importance of safeguarding personal information. This period also saw the ODPC actively challenging institutions that had previously operated with minimal oversight concerning their data handling practices, fostering a new era of accountability.

The initial phase of engagement was met with considerable resistance, as some organizations questioned the regulator's authority when first contacted about compliance with data protection requirements. However, Kassait noted a palpable shift in attitude over time, with institutions increasingly compelled to justify their methods for processing personal data. Beyond public advocacy, the ODPC's operational achievements under Kassait included diligently addressing complaints from individuals, thoroughly investigating alleged data breaches, and determining appropriate enforcement actions against entities found to be in violation of established data protection regulations.

Before initiating investigations, the ODPC meticulously assesses whether received complaints fall within its defined mandate. When determining penalties for non-compliance, the office considers several critical factors. These include whether an organization has committed repeat offenses, the severity of the breach, the total number of individuals affected, and the proactive steps taken by the organization to rectify the violation. These measures underscore the robust enforcement posture developed during Immaculate Kassait's leadership in data protection in Kenya.

Looking ahead, Kassait identified emerging technologies, particularly artificial intelligence, as a significant area demanding ongoing regulatory attention. She raised pertinent questions about the adequacy of informing individuals whose personal data is utilized to train or develop AI systems, specifically questioning whether data subjects are made aware if their information will be repurposed for such uses. In response to these evolving challenges, the ODPC has already issued comprehensive Kenya AI data protection guidance, which delineates acceptable practices, outlines organizational responsibilities, and identifies activities that should be avoided in the context of AI development and deployment.

Another critical challenge highlighted by Kassait is Kenya's substantial reliance on foreign technology infrastructure. This dependence, she argued, could potentially undermine the nation's ability to control its citizens' personal data and weaken its negotiating stance when dealing with powerful international technology companies. The lack of robust domestic technological capacity, she explained, often creates an uneven playing field in discussions with global tech giants.

Kassait strongly advocated for integrating data protection principles at the foundational design stage of all digital products and services. This proactive approach emphasizes data minimization, ensuring that organizations collect only the information strictly necessary for their intended purposes. This strategic focus aims to embed privacy by design, rather than treating data protection as an afterthought.

Despite the considerable progress made, Kassait acknowledged that substantial work remains to be done, particularly in fortifying Kenya's legal and institutional frameworks for managing cross-border data protection matters. A key item on this unfinished agenda includes the ratification of the Malabo Convention on Cyber Security and Personal Data Protection. This international treaty is seen as crucial for enhancing regional cooperation and standardizing data protection measures across the continent.

Alongside the Malabo Convention, Kassait emphasized the necessity of implementing legal reforms designed to facilitate mutual legal assistance in data-related cases. While recognizing that the flow of digital data cannot realistically be halted, the paramount priority, she asserted, must be to ensure that personal information is handled responsibly and secured through appropriate safeguards. This ongoing commitment to strengthening the framework for cross-border data protection in Kenya is vital for the nation's digital future.

Lawyers and compliance officers in Kenya should note the established enforcement posture of the ODPC and the continued focus on data protection, particularly concerning emerging technologies like AI and cross-border data flows. Clients must be advised on the necessity of robust data minimization and compliance strategies, anticipating further regulatory developments and potential liabilities as the legal framework for international data transfers strengthens.

Source: Original reporting via Bruhan Makong