Gideon Moi Bill seeks to protect vital personal data

Senate ICT committee chairman Gideon Moi has proposed a law targeting government and private agencies in the war against data misuse. [Boniface Okendo, Standard]

Heads of private and public institutions who share personal data of their employees or clients risk being jailed or paying steep fines, if a bill currently before Senate becomes law.

The Data protection Bill, 2018 seeks to protect personal data from misuse by government and private agencies.

Sponsored by Baringo Senator Gideon Moi, the bill was tabled in the House on Tuesday. It proposes that a person who collects and later discloses personal data has committed a crime.

According to the proposed law, agencies should not collect and process data on a person’s special information, his race and ethnic origin, religious beliefs, political persuasions and health status unless there is a special reason to do so.

“An agency shall not transfer personal data of a data subject outside the territory of the Republic of Kenya, unless the subject consents the transfer and it will be beneficial to the subject,” say the bill.

The outlawing of sharing of personal information comes months after it was reported that data belonging to millions of Facebook users in the country was collected by a British firm and used to influence the last election.

Facebook CEO Mark Zuckerberg in April admitted that indeed Cambridge Analytica, the consulting firm in question, had access to data belonging to millions of users of the popular social media platform.

In the bill, Mr Moi wants a new commission that will ensure that agencies adhere to data law created. Among other duties, the commission will receive complaints on violation of data and adjudicate over such disputes.  

“A person who collects and processes data in any manner that is contrary to the provisions of this act commits an offence and is liable, upon conviction, to a fine not exceeding Sh500,000 or a jail term not exceeding five years,” reads the bill.

“Where an offence has been committed by a body corporate with the consent or connivance of or to be attributed to any neglect on the part of any director, manager or secretary, that person as well as the body corporate shall be guilty of  that offence,” adds the bill.

However, the bill, if enacted, will not apply to the processing of personal data for purposes of national security, prevention, detection and punishment of a crime, safeguarding the right of the data subject and public interest.