The Office of the Data Protection Commissioner (ODPC) and the Kenya ICT Action Network (KICTANet) in a recent report revealed the main challenge facing data privacy in the country.
In the report, ODPC noted that most Kenyans were complaining of unlawful collection of personal data without consent. The government agency noted that this was seen in various cases where the victim got compensation.
"This illustrates that consent is one of the most frequently relied on legal bases for the processing of personal data but is also the most common reason for the violation of data subjects rights," read part of the report.
This violation was listed as contravening the Data Protection Act (DPA) 2019 which issues guidelines on the collection and use of data in the country.
According to the report, ODPC also revealed that some companies use unlawfully collected data for commercial services such as advertising without the consent of the person involved.
In one of the instances given by the government agency, a marketing company was sued for using a woman's photos and those of her children without consent leading to them getting Ksh1.9 million in compensation.
ODPC emphasised that it was necessary to get consent whether data is collected directly or indirectly even when the information is in the public domain or social media.
"Data handlers must obtain consent prior to the processing of a child’s personal data from a person who has parental authority or by a guardian," reads part of the report.
All organisations were urged to prioritise transparent data collection practices to avoid lawsuits or contravening the law.
Notably, WolrdCoin was listed as one of the organisations which collected and processed data. In the last six months of 2023, Worldcoin was a topic of discussion after the organisation paid Kenyans up to Ksh7,000 to scan their eyes.
Meanwhile, the report KICTAnet also issued a few recommendations to ensure the autonomy of the ODPC in a bid to increase its efficiency.
One of the recommendations is that Parliament should strengthen the independence of the ODPC by amending the DPA to make the office separate from the ICT Ministry.
It was also recommended that Parliament should also increase the agency's budgetary allocation to enable it to effectively discharge its mandate.
Additionally, ODPC was urged to intensify efforts to regulate the data processing operations of all data handlers, especially State entities, big tech and the financial sector.
