Office of the Data Protection Commissioner (ODPC): Announce in KE Matter

Kenya's data protection landscape has matured significantly since the enactment of the Data Protection Act, 2019 (DPA), and the subsequent operationalization of the Office of the Data Protection Commissioner (ODPC). The ODPC has transitioned from an awareness-building phase to active enforcement, issuing substantial penalties for non-compliance. This article provides a comprehensive overview of the DPA, its subsidiary regulations, the ODPC's mandate, and recent enforcement trends. It highlights the critical obligations of data controllers and processors, the enhanced rights of data subjects, and the increasing scrutiny on consent, data security, and cross-border data transfers, offering essential insights for legal practitioners navigating this evolving regulatory environment.

Kenya has firmly established its commitment to safeguarding personal data with the enactment of the Data Protection Act, No. 24 of 2019 (DPA), which came into force on 25 November 2019. This landmark legislation gives effect to Article 31 of the Constitution of Kenya, 2010, which guarantees every person the right to privacy. The DPA introduced a robust legal framework for the collection, processing, storage, and sharing of personal data, aligning Kenya with global data protection standards such as the EU's General Data Protection Regulation (GDPR).

The operationalization of the Office of the Data Protection Commissioner (ODPC) in March 2021 marked a pivotal moment, providing the institutional mechanism for enforcing these privacy rights. Initially focused on public awareness and registration drives, the ODPC has now demonstrably shifted towards stringent enforcement, issuing penalty notices and making determinations on a growing number of complaints. This article delves into the core tenets of Kenya's data protection regime, examining the statutory framework, the ODPC's evolving role, and the practical implications of recent enforcement actions for legal professionals and entities operating within the jurisdiction.

The foundation of data protection in Kenya rests primarily on the Data Protection Act, 2019. The DPA is complemented by three key subsidiary regulations published in January 2022: the Data Protection (General) Regulations, 2021; the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021; and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. These regulations provide detailed procedures for implementing the DPA's provisions, clarifying obligations for data controllers and processors and outlining the rights and remedies available to data subjects.

The Office of the Data Protection Commissioner (ODPC) is the primary regulatory body responsible for overseeing and enforcing data protection laws in Kenya. Its comprehensive mandate includes regulating the processing of personal data, ensuring adherence to the data protection principles outlined in Section 25 of the DPA, protecting individual privacy, establishing legal and institutional mechanisms for data protection, and providing data subjects with rights and remedies. The ODPC also conducts audits, issues compliance orders, imposes penalties, and promotes public awareness regarding data protection. A crucial obligation for many entities is the mandatory registration with the ODPC as a data controller or processor, with specific thresholds and exemptions outlined in the Registration Regulations.

The DPA, 2019, establishes core data processing principles, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality. Data controllers and processors are required to adhere to these principles, ensuring that personal data is collected with informed consent, processed securely, and retained only for necessary periods. Data subjects are empowered with a suite of rights, including the right to be informed, the right to access, rectify, or erase their data, the right to object to processing, and the right to data portability. The General Regulations, 2021, further elaborate on these rights, setting tight deadlines for data controllers and processors to respond to data subject requests, such as 7 days for access requests and 14 days for erasure requests.

A significant development in Kenya's data protection landscape is the ODPC's shift from a purely advisory role to active enforcement. The ODPC has demonstrated its willingness to impose administrative fines, which can reach up to KES 5 million or 1% of annual turnover for data controllers, and KES 3 million or 0.5% for data processors. Notable enforcement actions include penalties against digital lenders for processing contact lists without consent and using debt-shaming tactics, and against schools for publishing images of minors without parental consent. The ODPC's determinations, such as the KES 700,000 fine against Liquid Telecommunications Kenya for unlawfully processing data and violating purpose limitation, underscore the importance of explicit consent and adherence to processing principles.

The ODPC is increasingly scrutinizing the lawful basis for processing, particularly consent. Recent determinations highlight a categorical rejection of implied or informal consent, emphasizing that consent must be clear, affirmative, and provable by the data controller. This stricter interpretation aligns with global best practices and necessitates a review of consent mechanisms by all entities. Furthermore, obligations such as conducting Data Protection Impact Assessments (DPIAs) for high-risk processing, notifying data breaches within 72 hours, and ensuring appropriate safeguards for cross-border data transfers are under sharper focus. The requirement for mandatory registration of data controllers and processors, with penalties for non-compliance, remains a baseline expectation.

While the DPA and its regulations provide a comprehensive framework, challenges remain in ensuring universal compliance, particularly among smaller entities and those new to data protection obligations. The ODPC's proactive audits and sector-wide investigations, such as those targeting digital credit providers, indicate a strategic approach to enforcement, addressing systemic issues. The emphasis on operational compliance, beyond mere policy documentation, is a key takeaway from recent ODPC activities, requiring organizations to embed data protection into their daily operations.

The Kenyan data protection regime, spearheaded by the Data Protection Act, 2019, and rigorously enforced by the Office of the Data Protection Commissioner, presents a dynamic and increasingly demanding compliance landscape for legal practitioners and their clients. The era of grace periods has concluded, replaced by a clear trajectory of active enforcement, significant penalties, and a heightened focus on demonstrable accountability. Practitioners must advise clients to move beyond superficial compliance, ensuring that data protection principles are deeply integrated into their operational processes, particularly concerning consent mechanisms, data subject rights requests, data security, and international data transfers.

Looking ahead, the ODPC's continued focus on sectors prone to data misuse, such as digital lending and marketing, signals areas of sustained regulatory attention. Legal professionals should proactively guide clients in conducting thorough data protection audits, updating privacy policies, and implementing robust internal training programs to mitigate risks. The cost of non-compliance, encompassing financial penalties, reputational damage, and potential legal action, far outweighs the investment in robust data governance. Staying abreast of ODPC guidance and enforcement trends will be paramount for ensuring continued adherence and fostering trust in Kenya's digital economy.