Hurdles to key data law require a legal remedy

When the Constitution was promulgated 10 years ago, part of its hallmarks was that it strongly buttressed the Bill of Rights, which for the first time concisely laid out Kenyans’ human rights and freedoms.

It set out which ones can never be derogated or limited such as the right to habeas corpus, freedom from torture, cruel, inhuman and unusual treatment or punishment and freedom from slavery.

The Bill of Rights further laid which rights could be limited, and how and when they may be limited, and conferred every person or their representatives the right to approach the courts to enforce all their rights if they were violated or under threat of violation.

Parliament was accorded the mandate of following up with laws that would enable the realisation of these rights such as the Prevention of Torture Act, Access to Information Act and Data Protection Act (DPA), which secured freedom from torture, right to access information and the right to privacy.

The DPA, which was passed in November 2019, was enacted to ensure personal data is not misused or mishandled.

It established rights for individuals and created obligations and responsibilities for all entities that collect, store or deal in personal data. It contains rules and procedures dictating how personal data should be collected, stored, processed, transferred and protected and establishes criminal liability for those who offend the law. Importantly, it sets out exemptions allowing certain data sets to be handled for public interest, national security or for journalistic, literature and research purposes.

Since its passage, the DPA has met several setbacks regarding the process of the selection of the important Office of the Data Commissioner (ODPC), which has been halted by the High Court and a petition challenging the constitutionality of the entire law on various grounds, including a contention that ODPC under the DPA is not properly constituted.  

As it stands, the DPA creates the ODPC as an entity designated as a State Office under 260(q) of the Constitution, meaning it is under the Ministry of ICT specifically, and the National Executive generally.

One major bone of contention is whether the DPA, which is meant to fulfill the fundamental right to privacy through the protection of personal data, should be placed under the Article 59 framework as a constitutional commission or under a constitutional commission, or whether it should be a State Office under the control of the executive.

Article 59 establishes the Kenya National Human Rights and Equality Commission (KNHREC) mandated to promote respect for rights and develop a culture of human rights, to promote the protection and observance of human rights in public and private institutions; and, to act as the principal organ of the State in ensuring compliance with obligations under treaties and conventions relating to human rights.

It is noteworthy that the Constitution, under Article 59 (4) and (5) mandates Parliament to determine the number of commissions under Article 59 and to add or remove commissions as it deemed fit.

Currently, there is a Bill before the National Assembly sponsored by Jeremiah Kioni to merge the Kenya National Commission on Human Rights (KNCHR) with the National Gender and Equality Commission (NGEC) premised on the opinion that their respective mandates can be fulfilled by one entity.

Those who insist that the DPA should fit into the Article 59 fold as a matter of law point out to the fact that the Access to Information Act, which enforces the right to information enshrined under Article 35 in the Bill of Rights, was placed under the Commission on Administrative Justice, which is part of the three sister commissions under KNHREC.

State interference

They rationalise that the ODPC, which enforces data protection and right to privacy under Article 31, should also fit into KNHREC as an independent constitutional office which is functionally, financially and operationally protected and independent from State interference.

Further evidence lies with the placing of the Prevention of Torture Act under the KNCHR for purposes of monitoring and oversight, thereby complying with the rationale that the enforcement, monitoring, investigations and oversight of all fundamental human rights is the sole province of the KNHREC.

Should this point of view prevail in the courts of law, the whole DPA may be invalidated.

Be that as it may, all parties will be bound by the decision of the courts which have been instrumental in shaping the realisation of rights and checking executive and legislative overreach since August 2010 when the Constitution was promulgated.  

-The writer is a constitutional and human rights lawyer