Finally, the President has nominated the Data Commissioner of Kenya putting into motion the operationalization of the office of the Data Commissioner. The office of the Data Commissioner in Kenya is established by an Act of Parliament commonly referred to as The Data Protection Act, 2019. The Act operationalizes Article 31(c) and (d) of the 2010 Constitution. The Office of the Data Commissioner is designated as a State Office as per Article 260(q) of the Constitution.
Article 31(c) and (d) aims to establish the Office of the Data Protection Commissioner, to make provision for the regulation of the processing of personal data, to provide for the rights of data subjects and obligations of data controllers.
The Data Commissioner as provided for in the Act, has been nominated and the name forwarded to Parliament for vetting by the Communication Committee. The Committee recommendations are to be tabled before the Plenary for adoption or rejection. The President will then, if passed fit to serve by the Parliament, appoint the Data Commissioner.
Challenges of the Data Commissioner’s Office
The main challenge of the Office of the Data Commissioner shall be theindependence of the Data Commissioner. The Drafters of the Act, either willingly or unwillingly, did not deem it fit to include the office of the Data Commissioner amongst the Chapter 15 Constitutional Commissions or Independent Offices. It is for this reason that the Data Protection Commissioner does not have protection of Article 249(2)(b) of the Constitution which protects commissions and independent offices from direction or control by any person or authority. This in effect means that the holder of the Office of Data Commissioner shall be susceptible to external interference which weakens the functionality and authority of the Data Commissioner.
Another constraint in the Act is the intended consultations between the Data Commissioner and the Cabinet Secretary. Section 5(5) of the Data Protection Act directs Data Commissioner to consult the Cabinet Secretary in establishing directorates, as may be necessary for the better carrying of the functions of the Office. The staff of the Commission are also to be appointed by the Public Service Commission after a declaration of vacancy in the directorates. This in effect means that the Cabinet Secretary and the Public Service Commission have a role in the operations of the Office of the Data Commissioner. A conflict might arise when the Data Commissioner will want to establish and maintain the autonomy of the office and the Cabinet Secretary will refer to Section 5(5) of the Act indicating that he or she has to be involved through consultations.
Funding of the office is another issue that the Data Commissioner will have to contend with. Like any other new statutory office in Kenya, funds are rarely provided for in advance. The Office of the Data Commissioner may take a long time to get funding from the National Treasury to operationalize their functions. It becomes even a bigger challenge when the funding is hinged on approval of funds by the State Department. With limited funding, Data Commissioner’s Office will be constrained in attracting qualified and experienced personnel such as legal experts, forensic investigators, ICT experts and data analysts.
Formulating of regulations under the Act will also pose a challenge. It is of major importance to note that Section 71 of the Act mandates the Cabinet Secretary to make regulations generally for giving effect to this Act. No statutory role is contemplated for the Data Commissioner in the formulation of Section 71 regulations. This might lead to conflicts between the Data Commissioner and the Cabinet Secretary.
The volume of complaints made to the Data Commissioner may pose a challenge. The volumes might overwhelm the Data Commissioner’s office. It will be crucial the Data Commissioner and of importance how complaints presented to the Commission are handled. Section 9 of the Act gives powers to the Commissioner to facilitate reconciliation, mediation and negotiation on disputes arising from the Act. There is however no guarantee that parties will be satisfied with decisions of the Commissioner. This may precipitate a barrage of Court against the decisions of the Commission cases that the Commission may find. With no sufficient funds to hire competent legal personnel the operations of the Officer of the Data Commissioner may be affected.
Another constraint is how the Data Commissioner will deal with Section 51 of the Act that provides for various exemptions to regulation for processing of data for national security or public interest. This is a challenge as the Cabinet Secretary will be the one to make most of the regulations under the Act. The fact that exemptions in processing of data for public interest purposes is widely accepted, a data protection authority is mandated to provide guidance to public institutions. The big question is whether the Data Commissioner will provide the intended guidance on processing of data for national security or public interest purposes and if such processing will comply with policy guidance and guidelines from the Data Commissioner.
Still, the creation of the office is a step forward and amendments can be made later on to improve the operations of the office.
*If parliament adopts the report by the National Assembly Committee on Communication, Ms. Immaculate Kasait will become the first Data Commissioner in Kenya. Her term is a non-renewable 6yr one