The Data Protection Act, 2019 (“Act”) was passed into law on 8 th November, 2019. This item of legislation has shaken up the landscape of intellectual property and information and communication technology in Kenya.
The purpose of this Act is to give effect to Article 31(c) and (d) of the Constitution of Kenya which enshrines privacy as a fundamental human right. It has led to a positive adoption and implementation of data protection laws, principles and best practice frameworks by persons
handling data in different capacities such as collection, processing, holding and dissemination of personal information.
The standard of care has been elevated especially since the establishment of the office of the Data Protection Commissioner (ODPC). Previously, any matter touching on data privacy could be automatically brought before a court of first jurisdiction, heard and determined on merit. However, times are changing. The Act establishes the proper channels for a data subject to follow when seeking restitution in the event of a data breach.
The High Court of Kenya ruled that complaints brought under the Data Protection Act, 2019 (DPA) are to be handled by the Data Commissioner at the first instance.
This has been affirmed in decisions such as:
Mwangi & Another vs. Naivasha County Hotel t/a Sawela Lodges in Petition E003 of 2021 (http://kenyalaw.org/caselaw/cases/view/237212)