Thesis title: Adequacy in Data Protection Regulation in Kenya Citation: This thesis aimed to determine whether the Kenyan Data Protection Act of 2019 (KPDA) provides “adequate” legal protection. A novel adequacy framework was created, considering the problems of state surveillance, surveillance capitalism, and the need for effective remedies for data breaches. Privacy theory, the laws of South Africa, and the laws of the European Union informed this new adequacy framework. After weighing up the KDPA against the new adequacy framework, twenty recommendations for law reform were made. Download ..read more

Over the last few years, I have been working in freedom of expression and press work in different forms. Last year I published a book chapter titled ‘Constitutions, freedom of expression, internet shutdowns, social media and defamation laws in Africa’. The chapter covers contemporary means of exercising freedom of expression and explores how internet shutdowns, social media regulation and defamation laws pose threats to the freedom, and how they could be tackled. One of the countries that I often use as an example of enhanced freedom of expression is the United States (U.S.). The First Amendme ..read more

With the digitisation of government services and unique personal identifier (UPI) projects in motion, the Government of Kenya is presented with an opportunity to do things right. As you may recall, in the previous government, Huduma Namba was successfully challenged in court and up to date, E-Citizen is still regulated through a Gazette Notice. The current situation points to a weak regulatory framework. There have been numerous debates on what the Government can do to ensure that digitisation of government services and the unique personal identifier do not fall at the altar of constitutional ..read more

Every other Kenyan has been demanding answers as to why mobile phone service operators have put in place a requirement that they re-register their SIM-cards or else they get disconnected from the service. The details required for re-registration include a photograph and a signature. Many mobile phone subscribers had already registered their SIM-cards years ago. The demand for new registration details was met with a lot of apprehension. Being an election year, there are lots of conspiracy theories as to why the operators are making such demands from their subscribers. Registration of SIM-cards ..read more

Two years ago, the Kenyan Data Protection Act, 2019 (DPA) came into operation. The DPA gives effect to Article 31(c) and (d) of the Constitution that relate to the right to privacy. The DPA establishes the Office of the Data Protection Commissioner; it sets out principles of data protection; it outlines the rights of data subjects; and mandates data controllers and data processors to comply with certain basic organisational and technical measures when processing personal data. Since enactment of the DPA there have been a few significant events on the protection of the right to privacy in Kenya ..read more

You have probably received unsolicited text messages marketing some goods or services. The most common of these include texts marketing mobile loans, offers in supermarkets, offers to subscribe to pay TV and offers for food delivery among others. The texts may be one off or periodic. The situation is more curious during an electioneering period where candidates for various political positions within your constituency spam you with campaign messages. Truly, some of the texts are obnoxious and irritating. To your recollection, you have never shared your phone number with the aim of receiving thi ..read more

Is compliance with the Data Protection Act, 2019 worth it? This is one of the fundamental questions data controllers and data processors have been asking themselves. In my experience this is partly due to the cost of compliance. Because of economic downturn, many data controllers and data processors have been plagued with cash flow challenges. However, there are data controllers and data processors around the country who are not taking data protection compliance with the seriousness it deserves. Due to this, some data controllers and data processors have found themselves at crosshairs with the ..read more

Nomalanga Mashinini and Mugambi Laibuta discuss the Image Rights legal framework in Kenya. They scrutinize the legitimate expectation of privacy and the lack of the latter requirement in image rights protection requirements. Check out byNMashnini podcast  ..read more

Strathmore’s CIPIT Acting Director, Dr. Melissa Omino and Mugambi Laibuta discuss the recently published data regulations under the Data Protection Act 2019 of Kenya ..read more

Download ..read more