Kassait: Making data protection a national conversation was my key achievement

NAIROBI, Kenya, Nov 10-Outgoing Data Commissioner Immaculate Kassait says one of her biggest achievements during her six-year tenure was moving data protection from a largely unfamiliar regulatory issue to a national conversation.

Reflecting on her time at the Office of the Data Protection Commissioner (ODPC), Kassait said the office had helped raise public awareness about the importance of protecting personal information and challenged institutions that had previously operated with little scrutiny over their data-handling practices.

“I think we’ve made data protection a conversation in this country,” she said, citing efforts by the office to make organisations more accountable for how they collect and handle personal information.

Kassait recalled the resistance the office encountered when it began engaging organizations and demanding compliance with data protection requirements.

“Who are you?” she recalled some institutions asking when the regulator started writing to them.

She said the change in attitude towards data protection was among the developments that defined her tenure, as organizations increasingly had to account for how they processed personal information.

The outgoing commissioner said the work of the office also involved addressing complaints, investigating alleged breaches and determining appropriate action against organizations found to have violated data protection requirements.

She explained that complaints received by the office are first assessed to establish whether they fall within its mandate before investigations are undertaken.

In determining penalties, Kassait said the office considers factors including whether an organisation has repeatedly committed an offence, the seriousness of the breach, the number of people affected and whether the organisation has taken steps to remedy the violation.

Beyond enforcement, she pointed to the growing challenges posed by emerging technologies, particularly artificial intelligence, as an area requiring continued attention.

Kassait questioned whether people whose personal information is used to train or develop artificial intelligence systems are adequately informed about how their data may be repurposed.

“Did they tell the data subject that the data will be repurposed?” she posed.

She said the ODPC had issued guidance on artificial intelligence, outlining acceptable uses, responsibilities and practices that organizations should avoid, as regulators seek to keep pace with technological developments.

Kassait also identified Kenya’s reliance on foreign technology infrastructure as a challenge to the country’s control over personal data, arguing that limited domestic capacity could weaken its negotiating position with international technology companies.

“Some of those negotiations are always lopsided because if you don’t have a platform, if you don’t have a cloud, if you’re relying on other countries’ infrastructure, what conversation can you possibly have?” she said.

She argued that data protection must also be considered at the design stage of digital products and services, with organisations collecting only information necessary for their intended purpose.

“As we develop things, we need to have data minimisation,” she said.

Despite the progress made, Kassait acknowledged that important work remains, including strengthening Kenya’s legal and institutional framework for dealing with cross-border data protection matters.

She identified the ratification of the Malabo Convention on Cyber Security and Personal Data Protection, alongside legal reforms to facilitate mutual legal assistance, as part of the unfinished agenda.

Kassait said digital data flows could not be stopped, but the priority should be ensuring that personal information is handled responsibly and protected through appropriate safeguards.

As she leaves office, she said her successor should be allowed to define their own priorities while building on the work already undertaken by the regulator.