Technology service providers and a human rights group have proposed changes to the Data Protection Bill 2019.
Google, Amnesty International and Technology Service Providers of Kenya (Tespok) made their submissions yesterday to the National Assembly ICT committee.
The bill, which has been sponsored by Baringo Senator Gideon Moi, seeks to protect personal data from misuse by State and private agencies.
Amnesty International (AI) opposed a proposal in the bill that allows State security agencies to extract individuals' data without restrictions, for purposes of maintaining public order or national security.
AI said such a proposal can be abused to hurt citizens. "The proposal is prone to abuse by State. Its wording is ambiguous and does not satisfy the principle of legality," said Irungu Houston, AI Executive Director .
"The wording does not clearly define national security and public order. We propose that State agencies responsible for national security and public order be bound by the general rules of data protection such as security of data, collection limitation, purpose limitation among others.”
Google and Technology Service Providers of Kenya (Tespok) opposed the mandatory registration of data controllers and processors as proposed in the bill.
Michael Murungi, Google’s Public Policy and Government Relations head, told the committee chaired by Marakwet West MP William Kisang that the registration should only involve controllers and processors dealing with sensitive data.
“The scope of those who have to register will be so broad that it will not be practical to register all of them," said Mr Murungi.
"It is not a business model and data processors will have a long queue of those seeking to register.”
Tespok Chief Executive Officer Fiona Asonga said mandatory registration of data controllers will bring a barrier to the ease of doing business in Kenya.
"It will discourage enterprises from engaging in the digital economy in Kenya,” said Ms Asonga
She also recommended that collection of data under the Registration of Persons Act be subjected to data protection principles under the bill.