31/08/2022
-The Data Protection Act in Kenya and how it affects businesses- by Jane Wambui Maina (Advocate)
With the age of internet and data collection, as well as use of people’s personal data for marketing purposes, it has become increasingly important to protect data. Data refers to any information relating to a person, some of which could be sensitive for example if it reveals a person’s race, health status, biometrics or family details.
Data breaches have occurred across the world leading to losses, reputation damage, identity theft among others. For example, in March 2021, hackers hacked into Facebook and about 533 million user records from 106 countries were posted into a hacking forum
In our daily life we find ourselves giving personal information to companies, hospitals, investment firms, banks, among others Hence data protection is something that affects everyone and every business.
The Data Protection Act came into place to ensure peoples personal information is protected. Organizations that collect people’s data will now require to have a Data Protection Officer who will ensure that the organization complies with the Act. The Act provides that organizations that do not comply will face heavy fines of up to 1% of the previous year’s turnover or a fine of up to five million shillings, whichever is lower. Significant data breaches will also have to be reported to regulators. Organizations will also have to ensure they know what data they hold, ensure it is secured, and ensure it is not shared to unauthorized people. Children’s data should also not be processed without a parent or guardian’s consent. Where children’s data is actually processed it should be done with the best interest of the child. Personal data relating to health will also have to be protected more keenly as the Act provides that it can only be processed by or under the responsibility of a health care provider or by a person obliged to keep professional secrecy. Data relating to health can only be processed if it is in public interest
