Request for Feedback: 5-Year Reflections on Kenya’s Data Protection Act.

The following are my comments on this topic:

We have seen increased use of consent for taking photos in educational
institutions to protect students’ privacy. There is also parental consent,
where educational institutions seek consent from parents to process their
children’s data. In this case, appointing a DPO in state and non-state
institutions should be encouraged.

The best technology advancement could be privacy-enhancing technology(PET),
which can enhance the utility of the data while simultaneously fulfilling
the entity’s key data protection obligations. In that case, the use of
privacy by design could be embedded into the design specifications of
various technologies, including the adoption of PETs such as homomorphic
encryption.

On Thu, May 2, 2024 at 8:17 AM Linda Wairure via KICTANet <
kictanet@lists.kictanet.or.ke> wrote:

> *Day 4: **Data Subject Rights, Emerging Issues and Best Practices.*
>
> *Dear Listers,*
>
> Thank you for providing your expert insights and feedback regarding the
> suggested alterations and recommendations concerning the legal framework
> for data protection. Please review the attached document to confirm that
> all of your perspectives of prior discussions have been incorporated. Your
> contribution is greatly appreciated.
>
> Day 4 of our discussion will center on *data subject rights, emerging
> issues *and *best practices*. We invite you to share your insights
> and reflections on the following questions:
>
> 1. *Have you experienced any changes in the way state/non-state
> organizations handle your personal data since the implementation of the
> Data Protection Act, 2019?*
>
> 2. * What are some international best practices or benchmarks in
> data protection regulation and enforcement that the ODPC should consider
> emulating?*
>
> 3. * What recent technological advancement or practice do you
> believe presents the greatest data protection and privacy opportunity in
> Kenya?*
>
> Your expertise and input are essential in this endeavor, and we value your
> contribution to this vital conversation.
>
> Please feel free to respond directly to this email with your insights.
> Alternatively, you can reach out to Linda Gichohi (lgichohi@kictanet.or.ke )
> if you have any questions or additional comments.
>
> Thank you for your time and consideration.
>
> We look forward to your participation.
>
>
>
> Kind regards,
>
> Linda Gichohi.
>
> *Kenya ICT Action Network.*
>
>
>
> On Mon, 29 Apr 2024 at 20:30, Linda Wairure <lindagichohi@gmail.com>
> wrote:
>
>> *B.* *Day 2: Data Controllers & Processors *
>>
>> *Dear Listers,*
>>
>> Thank you for providing your expert insights and feedback regarding the
>> suggested alterations and recommendations concerning the legal framework
>> for data protection. Please review the attached document to confirm that
>> all of your perspectives of yesterday’s discussion have been incorporated.
>> Your contribution is greatly appreciated.
>>
>> *Day 2* of our discussion will center on *data controllers and data
>> processors*. We invite you to share your insights and reflections on the
>> following questions:
>>
>> 1. *In your opinion, what has been the key impact (positive/negative)
>> of the Data Protection Act, 2019, on state and private entities’
>> organizational policies, procedures, practices, and compliance levels from
>> 2020 to date?*
>> 2. *Poll: **Do you believe that the penalties imposed on
>> organizations for data breaches or non-compliance are sufficient to deter
>> future violations?*
>> <www.livepolls.app/result/6622dd8c0d1d3f4c690d6c01>
>>
>> Your expertise and input are essential in this endeavor, and we value
>> your contribution to this vital conversation.
>>
>> Please feel free to respond directly to this email with your insights.
>> Alternatively, you can reach out to Linda Gichohi (
>> lgichohi@kictanet.or.ke ) if you have any questions or additional
>> comments.
>>
>> Thank you for your time and consideration.
>>
>> We look forward to your participation.
>>
>>
>>
>> Kind regards,
>>
>> Linda Gichohi.
>>
>> *Kenya ICT Action Network.*
>>
>> On Sun, 28 Apr 2024 at 22:03, Linda Wairure <lindagichohi@gmail.com>
>> wrote:
>>
>>> *A. **Day 1: Legal Framework on Data Protection*
>>>
>>>
>>> Day 1 of our discussion will center on the Legal framework surrounding
>>> Data Protection. We invite you to share your insights and reflections on
>>> the following questions:
>>>
>>> 1. *What areas of Kenya’s legal and policy framework on data
>>> protection require improvement or updating? Please provide supporting
>>> justification/rationale.*
>>> 2. *Please provide three (3) recommendations for amendments to the
>>> Data Protection Act, and its attendant regulations.*
>>>
>>> Your expertise and input are essential in this endeavor, and we value
>>> your contribution to this vital conversation.
>>>
>>> Please feel free to respond directly to this email with your insights. Thank
>>> you for your time and consideration.
>>>
>>> We look forward to your participation.
>>>
>>>
>>> Kind regards,
>>>
>>> Linda Gichohi.
>>>
>>> * Kenya ICT Action Network.*
>>>
>>>
>>>
>>> On Fri, 26 Apr 2024 at 02:28, Linda Wairure <lindagichohi@gmail.com>
>>> wrote:
>>>
>>>> Dear Listers,
>>>>
>>>> As part of our ongoing efforts to assess the effectiveness and impact
>>>> of Kenya’s Data Protection Act (2019) over the past five years and in
>>>> anticipation of the NADPA Conference being held from 7 – 9 May 2024, we are
>>>> reaching out to gather your valuable insights and reflections. To this end,
>>>> KICTANet will be moderating an online discussion on the KICTANet mailing
>>>> list from *Monday 29 April 2024 – Friday 3 May 2024.* We want to draw
>>>> special attention to the contributions of the Data Governance and Emerging
>>>> Technologies Working Group on the ICT legislative reform process and in
>>>> particular the recommendations on data governance.
>>>>
>>>> To chart the progress, challenges, and considerations for the future of
>>>> data protection in Kenya, KICTANet shall be exploring the following topics
>>>> over the course of next week through targeted daily questions for your
>>>> reflections.
>>>>
>>>> *TOPICS:*
>>>>
>>>> *A. **Day 1: Legal Framework on Data Protection*
>>>>
>>>> *B. **Day 2: Data Controllers & Processors *
>>>>
>>>> *C. **Day 3: Data Subjects’ Rights*
>>>>
>>>> *D. **Day 4: Emerging Issues and Best Practices*
>>>>
>>>> *E. **Day 5: Recommendations and Shaping the Future.*
>>>>
>>>> Please feel free to respond directly to this email with your insights.
>>>> Alternatively, you can reach out to Linda Gichohi (
>>>> lgichohi@kictanet.or.ke) if you have any questions or additional
>>>> comments.
>>>>
>>>> Thank you for your time and participation.
>>>>
>>>> Regards,
>>>>
>>>> *Linda Gichohi.*
>>>>
>>>> *Kenya ICT Action Network.*
>>>>
>>>