Kassait Warns: Kenya Risks Losing Digital Infrastructure Control

• Outgoing Data Commissioner Immaculate Kassait warned Kenya risks losing data leverage due to reliance on foreign technology infrastructure.
• She noted that negotiations with multinational tech firms are often unequal because Kenya lacks its own digital platforms.
• The growing use of AI poses new challenges, particularly when personal data is repurposed without individuals' knowledge.
• Kassait urged for data protection by design, integrating privacy safeguards from the start of technology development.
• The ODPC has issued guidance on AI use, and stronger data governance structures, including digital public infrastructure, are proposed.

People might not always be seen as commodity.

Outgoing Data Commissioner Immaculate Kassait has issued a stark warning regarding Kenya's digital autonomy, indicating that the nation risks losing significant control over its data due to its heavy reliance on foreign technology infrastructure. This dependence, according to Kassait, places Kenya at a disadvantage when negotiating with multinational technology companies, often resulting in lopsided discussions. Despite efforts to establish regulatory frameworks, including a national cloud policy, Kenya largely remains a consumer of technologies developed externally, perpetually "playing catch-up" in the rapidly evolving digital landscape.

Kassait, who is concluding her six-year tenure at the Office of the Data Protection Commissioner (ODPC), highlighted that while Kenya has made strides in developing policies for data processing, its limited local technical capacity and reliance on external platforms undermine its ability to assert control. When questioned about the extent of Kenya's control over data managed by foreign entities, her response was equivocal, suggesting a complex reality where full command is not yet achieved. The ongoing acceleration of digital transformation across both government services and the private sector further amplifies the critical importance of how personal information is collected, stored, transferred, and processed within this foreign-dominated infrastructure.

The increasing adoption of artificial intelligence (AI) introduces additional complexities and challenges for data protection regulators in Kenya. A primary concern articulated by Immaculate Kassait is the practice of repurposing personal information to train AI systems without the explicit knowledge or consent of the individuals involved. She pointed to scenarios where organizations might collect personal data for one purpose, only to subsequently feed it into AI tools for product development, raising serious questions about accountability and whether data subjects were adequately informed about these secondary uses.

This challenge is compounded by the intricate movement of information between various data controllers, processors, and AI platforms, making it difficult to track and manage. Kassait emphasized the critical need for organizations to establish robust and transparent accountability structures to navigate these evolving data flows. The potential for personal data to be treated solely as a commercial asset, rather than respecting individual rights and human dignity, was also a key caution from the outgoing data commissioner, who asserted that "People might not always be seen as commodity."

To proactively address these emerging risks and strengthen Kenya's data protection posture, Kassait advocated for the integration of data protection principles from the very initial stages of technology development. This approach, known as "data protection by design and by default," mandates that developers embed privacy and security safeguards throughout the entire development process, rather than attempting to retrofit them after products or applications are already built. A core tenet of this principle is data minimization, which dictates that organizations should only collect information strictly necessary for clearly defined purposes, avoiding the routine acquisition of extensive user data such as contacts or health records.

In response to the immediate challenges posed by AI, the ODPC, under Kassait's leadership, has already issued specific guidance on the ethical and acceptable use of artificial intelligence. This guidance outlines the responsibilities of organizations handling personal information within AI contexts, serving as an interim measure while regulators continue to examine the broader implications of AI, with the expectation of more comprehensive regulation in the future. Kassait also proposed the development of stronger data governance frameworks, including the creation of digital public infrastructure designed to support public services through centrally managed and anonymized information, thereby reducing reliance on external systems and enhancing national data control.

Lawyers and compliance officers in Kenya must advise clients, particularly those utilizing foreign technology infrastructure or AI, to meticulously review their data governance frameworks and contracts. The outgoing Data Commissioner's warning highlights significant compliance exposures related to data control, lopsided negotiations with multinational tech firms, and the repurposing of personal data by AI. Organizations should proactively implement data protection by design principles and adhere to ODPC guidance on AI to mitigate risks and ensure accountability.

Source: Original reporting via Kenyan news outlet