NAIROBI, Kenya May 9 – Parliament has been urged to strengthen the independence of the Office of the Data Protection Commissioner (ODPC) by amending the Data Protection Act to make the ODPC autonomous and separate it from the Ministry of Information, Communications and Telecommunication (ICT).
In a recent report by KICTANet, a multi-stakeholder Think Tank for ICT policy and regulation, parliament should also increase the ODPCs budgetary allocation to enable it to effectively discharge its mandate across the country.
The report reflected Kenya’s progress, challenges, achievements and opportunities in its journey towards the implementation of the Data Protection Act.
“ODPC should issue relevant guidelines, codes, and frameworks to fully operationalize the Data Protection Act(DPA), including publishing guidance for lawful data-sharing between state agencies, and adequacy rules to facilitate lawful cross-border data transfers,” said KICTANet.
The report dubbed ‘Five Years of Kenya’s Data Protection Act’ noted that the government should formulate a comprehensive national data governance framework to holistically address complimentary data protection issues, including interoperability, data classification, and data security.
It called for ODPC to intensify efforts to regulate and oversee the data processing operations of all data handlers, especially state entities, Big Tech, as well as the financial sector.
The report, however, indicated that limited funding, low staffing, legal structure, political interference, and the existence of competing data protection roles with other sector regulators threatens the independence of the ODPC.
“While it is important to enable responsible international data transfers to enhance trade and economic opportunities, there is pressure from other jurisdictions for alternative data protection regimes which could affect the sovereignty of ODPC and the effectiveness of the DPA in protecting personal data,” it added.
Victor Kapiyo a trustee at KICTANet stated that the country is enjoying strong policy and regulatory framework with laws, guidelines and regulations on data protection since the commissioning of the ODPC.
“There is a strong policy and regulatory framework with laws, guidelines, regulations and guidelines accompanied by an active ODPC which has undertaken a wide range of measures to operationalize and enforce the Act. This has led to the willingness by other jurisdictions such as the European Union to offer Kenya equivalency status which can enhance trade, investment, cooperation and job opportunities,” said Kapiyo trustee KICTANet.
This year Kenya is marking five years since the enactment of the Data Protection Act (DPA), including the establishment of the ODPC, a comprehensive privacy and data protection framework for the country.
DPA was enacted in November back in 2019.
