New rules seek to prohibit sale of personal data to third parties

The office of the data protection commissioner is seeking to prohibit the sale of personal data to third parties.

A draft guidance note published on Tuesday indicated that Data Commissioner Immaculate Kassait requires entities to issue consent forms to individuals before embarking on collection of personal data.

“Under no circumstances should the data collected be sold to third parties or transferred out of the country, unless the concerned individual consents to the transfer. The transfer of personal data to another country shall only take place where sufficient proof has been given on the appropriate safeguards with respect to the security and protection of the personal data,” the draft guidance policy reads.

At the same time, mobile applications requesting access to personal data shall publish policies on the information being collected.

A person requesting for personal data is expected to enter into a data protection and sharing agreement with the entity or person having the control of data.

Public entities are meanwhile expected to channel all personal data requests with their respective ministries all state agencies.

The draft guidance note is geared at responding to the increased need for personal data under the COVID-19 pandemic.

This includes the mushrooming of tech-based applications collecting data to aid government in the coronavirus response.

“For instance, health data and geo-location may be necessary for contact tracing. Innovations built in response to pandemic including apps and related services, may request some access to personal data from a government or private entities to enable the development of a product,” added the note.

The new policy is set to assure the privacy of individuals through the protection of their personal data as guided by the Data Protection Act.

Further, the commissioner requires entities to endeavor to collect personal data in an anonymized format ensuring that individuals cannot be re-identified.

The Act which marked Kenya’s first piece of legislation on personal came into force at the end of 2019.