The Evolution of Privacy and Data Protection in Kenya

Abstract

The contribution looks at the right to privacy within Kenya’s legal system by setting out the constitutional, legislative and jurisprudential framework on this right, as well as the right to data protection. The evolution of the rights to privacy and data protection in Kenya have been marked by significant milestones, reflecting global trends and local imperatives. The right to privacy in Kenya has featured in the constitutional text since Kenya gained independence from colonial rule. Conversations during the clamour for constitutional reforms shaped the current constitutional text that provides for an individual right to privacy and has been the springboard for the promulgation of legislation regarding data protection rights. The enactment of the Data Protection Act, 2019 was a pivotal moment, providing a legal framework for the protection of personal data. The Act emphasises the rights of individuals regarding their personal data, including the rights to be informed about the processing thereof, to access it and to its rectification. The Act also provides for baseline data protection principles and grants the Office of the Data Protection Commissioner powers to enforce data subject rights and data protection principles. Other legislation, such as the Children Act and the HIV and AIDS Prevention and Control Act, also provide privacy safeguards. For decades, the Kenyan courts have ruled in favour of the right to privacy. However, despite legislative developments, some statutes regulating national security organs still contain provisions limiting the right to privacy. This contribution describes the past and present status of the rights to privacy and of data protection in Kenya.