Kenya Parliament Approves Progressive Draft Data Protection Policy and Bill

Amidst the hue and cry from Kenyans who have since faulted the Government’s plan to create a universal database for citizens under the NIIMs program that is popularly known as Huduma Namba, the State through its Twitter handle @StateHouseKenya revealed that Parliament had approved a progressive draft Data Protection Policy and Bill. The announcement was made by President Kenyatta.

I assure Kenyans and all people residing in our beautiful country that we are taking additional measures to ensure the information they give is safe. Yesterday, the Cabinet approved a progressive draft Data Protection Policy and Bill ~President Uhuru Kenyatta | #HappyEaster

— State House Kenya (@StateHouseKenya) April 19, 2019

The declaration was necessary because the Huduma Namba registration exercise had and is still marred by misinformation, which the government has not clarified so far. A couple of days ago, the registration process was flagged off after the High Court of Kenya ruled that the activity was not mandatory after all. It also ruled against the collection of biometric data (DNA, among other personal details), and this is perhaps the major issue with NIIMs.

It is worth noting that the progressive draft Data Protection Bill’s Part IV examines the principles and obligations of personal data protection. The chapter lays down the conditions on which personal data, sensitive personal data such as DNA information that was to be part of the NIIMs database cannot be abused or misused.

What is more, the chapter clearly carves out discretion powers to the Government by allowing some exemptions in Part VII, which covers the collection, processing, and storage of personal data. Also, the Bill allows the Government to perform some actions that do not necessarily align to other similar provisions in the draft.

The broad premises for the interpretations of personal data continue to be faulted by people who have more grasp about the definitions of the data protection bill. In fact, it can be argued that a lack of conciseness will be detrimental as it will allow the state to adopt protectionist interpretations of terms such as ‘critical personal data.’ Some people have also argued that the Bill if approved, can operate as an effective check on the Kenya Government’s discretion to expand the scope of ‘personal data’ when it deems it appropriate.

To this end, these are some of the issues that the Bill does not explain exhaustively, and have only been amplified by the Huduma Namba registration exercise.