Kenya’s contested election and the implications for digital integrity, privacy.

From whether to use a digital or manual voter register to the final vote tallying process that Raila Odinga is challenging in the Supreme Court, data has been at the heart of Kenya’s general election.

Whoever forms the next government inherits an urgent and important responsibility—to safeguard data integrity and privacy, including managing access to and use of citizen’s personal information on the internet.

Kenya is party to the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, and the African Charter on Human and Peoples’ Rights, which all provide for the right to privacy.

The Data Protection Act, 2019 regulates and protects the general use of personal data. It provides for, among others, the rights of data subjects; obligations of whoever determines the means and processes personal data; and establishes the office of Data Commissioner. Some of the principles enshrined in the Act are compulsory registration of data controllers and processors; reduction in collection of data of citizens; restriction in further processing of data; maximisation of data quality; and constant application of strong security safeguards that protect collected data.

However, a chasm remains between the law and practice. For instance, the Act prohibits cross-border transfer and/or sharing of data of citizens outside Kenya. But foreign firms— including Smartmatic, the firm that supplied the Kenya Integrated Elections Management System—have been heavily involved in managing private citizen data and it is not clear if the law has been complied with in that. Exceptions include where the Data Commissioner has satisfied herself that the appropriate safeguards to ensure the security and protection of data are in place, and the performance of a contract mandates the transfer of a person’s data. Yet there is little evidence to show that the most important safeguard—to ensure a person whose data is to be shared is informed of any dangers and to obtain their express consent before the transfer of their data—has been complied with.

Loopholes

The loopholes in private data were highlighted in 2021 when Justice Julius Ngaah quashed the rollout of Huduma cards for their being intrusive, unnecessary and in contravention of Section 31 of the Act.

Under the new National Integrated Identity Management System (Niims), the cards were to contain all personal information for citizens and resident aliens for them to access services.

The High Court found that the government had collected sensitive personal information without carrying out a data protection impact assessment or putting in place safeguards to protect the data despite the risks to rights and freedoms it posed to the citizens.

Last month, the Office of the Data Commissioner (ODC) issued a guidance note on the registration of data controllers and data processors.

But that relies on self-reporting and it’s not clear how much compliance has happened, particularly among foreign firms that collect data from Kenyans and resident aliens.

And while the law requires impact assessments to be submitted 60 days before the collection of data, many entities still collect and process personal data outside the process. To increase confidence and transparency in the data protection impact assessment protocols, the ODC should provide public access to the register of data controllers and processors. It should also publish a list of countries that meet the adequacy requirement for the transmission of data from Kenya, including the criteria used to assess them. Also, the government should sign the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention), which is specific about digital data protection. Access to personal data can facilitate the delivery of tailor-made services and the Covid-19 pandemic accelerated the need for the digitalisation of data and the rollout of eGovernment services. But personal data in the wrong hands can be used to facilitate crime or to discriminate against activists, government critics or minority communities.

The new regime must ensure the lessons from the 2021 court ruling are not wasted.

Img Src: kittyfy | depositphotos.com