21 Nov 2019
KENYA: Data Protection Law Passed Targeting Tech Investment
Kenya has passed a European Union-compliant new data protection law. The law sets outs restrictions on how personally identifiable data obtained from firms and government entities can be handled, shared, and stored, as part of its efforts to attract foreign investors into the technology space.
The government’s Departmental Committee on Communication, Information, and Innovation released its report on the draft Data Protection Bill, 2019 on 17 October, following a period of public consultation. The bill proceeded swiftly through its readings in parliament, and Kenyan President, Uhuru Kenyatta, approved the law on 8 November.
In addition to setting out the conditions for the transfer of personal data outside Kenya, the Act provides for exemptions to data processing and outlines data handling offences and attendant penalties. The legislation requires companies to get consumers’ consent before selling their data to third parties. Any infringements will be investigated by an independent office, with violators facing two-year prison sentences or fines of up to KES3 million (US$29,400).
Significantly, the new law also complies with the European Union's General Data Protection Regulation (GDPR), which came into effect in May 2018. GDPR requires any country that wishes to conduct business with the European Union, and that handles personal data in its business dealings, to have compliant protection mechanisms and legal safeguards of that data. As such, a data protection law that is GDPR-compliant is considered crucial for encouraging more investment into Kenya’s technology sector.
The Kenyan technology sector has enjoyed vibrant development and is already attracting foreign investment, with innovations such as Safaricom’s M-Pesa mobile money services. However, the lack of safeguards in handling personal data is now holding back the sector’s development.
With the introduction of the new law, Amazon Web Services, the web computing arm of the global online retail giant, announced plans to set up its cloud infrastructure in Kenya. Teresa Carlson, Vice President of Amazon Web Services, said that the new law paves the way for the company's planned investment in Nairobi. In a Reuters interview on the new law, Joe Mucheru, Kenya’s Minister for Information, Technology and Communication, said: “Kenya has joined the global community in terms of data protection standards.”