Kassait warns Kenya is playing catch-up as foreign firms control digital infrastructure

NAIROBI, Kenya Nov 10 – Outgoing Data Commissioner Immaculate Kassait has warned that Kenya risks losing leverage over its data as reliance on foreign technology infrastructure leaves the country struggling to negotiate with multinational companies on equal terms.

Kassait said although Kenya had made progress in establishing policies to regulate data processing, its dependence on external technology platforms and limited local technical capacity continued to weaken its position in negotiations with global technology firms.

“It’s a yes and no,” Kassait said when asked whether Kenya had sufficient control over data held and processed by foreign companies.

She noted that while the country had introduced policies, including a cloud policy, to guide the sector, it remained largely a consumer of technologies developed elsewhere.

“Many times, we are adopters of technology, and we rarely have… we are always playing catch-up,” she said.

Kassait added that negotiations with multinational technology companies could be unequal when countries lacked their own digital infrastructure and technical expertise.

“Some of those negotiations are always lopsided because if you don’t have a platform, if you don’t have a cloud, if you’re relying on other countries’ infrastructure, what conversation can you possibly have?” she posed.

Her remarks come as Kenya accelerates digital transformation across government services and the private sector, increasing the importance of how personal information is collected, stored, transferred and processed.

Kassait, who is leaving office after six years at the Office of the Data Protection Commissioner (ODPC), said the growing use of artificial intelligence was creating additional challenges for data protection regulators, particularly where personal information is repurposed to train AI systems without the knowledge of the individuals concerned.

She cited instances where organisations collecting personal information could subsequently feed it into AI tools to develop products, raising questions about accountability and whether individuals had been informed that their information would be used for a different purpose.

“Did they tell the data subject that the data will be repurposed?” she asked.

She said the challenge was becoming more complex as information moved between data controllers, processors and AI platforms, making it necessary for organisations to establish clear accountability structures.

To address emerging risks, Kassait said the ODPC had issued guidance on the use of artificial intelligence, outlining acceptable practices and the responsibilities of organisations handling personal information.

The guidance, she said, was intended to provide direction as regulators continued examining the implications of AI, with more comprehensive regulation potentially coming in the future.

Kassait also called for data protection to be incorporated into technology development from the beginning rather than treated as an issue to be addressed after products and applications had been built.

She pointed to the principle of data protection by design and by default, which requires developers to integrate privacy and security safeguards throughout the development process.

“As we develop things, we need to have data minimization. We cannot collect what you see — people’s contacts, their health data,” she said.

She argued that organisations should only collect information necessary for clearly defined purposes instead of routinely seeking access to users’ personal information.

Kassait further cautioned against treating personal information purely as a commercial resource, saying technological innovation must also respect individual rights and human dignity.

“People might not always be seen as commodity,” she said.

She proposed stronger data governance structures, including the development of digital public infrastructure that could support public services through centrally managed and anonymized information rather than exposing individuals’ personal details to commercial exploitation.

Reflecting on her six-year tenure, Kassait said one of her main achievements had been establishing data protection as a national conversation and strengthening accountability among organisations handling personal information.

“I think we’ve made data protection a conversation in this country,” she said.

She recalled that when the ODPC was established, organisations were accustomed to collecting and repurposing personal information with little scrutiny, making the introduction of data protection requirements a difficult cultural shift.

“There was pushback. Some of the cases I remember, we initially would write to institutions, and then they would probably ask, ‘Who are you?’” she said.

Kassait said building the institution required establishing its human resource capacity, mobilizing resources and creating systems to oversee compliance.

She also disclosed that unfinished business included the ratification of the Malabo Convention on Cyber Security and Personal Data Protection, alongside legal reforms to strengthen the commission’s ability to pursue cross-border cases through mutual legal assistance.

On enforcement, she said the commission assessed complaints based on its legal mandate, the seriousness of violations, the number of people affected and whether organisations had taken steps to address breaches.

She maintained that government institutions were also subject to scrutiny, saying the commission had made recommendations to public bodies over identified data protection weaknesses.

As she exits office, Kassait said artificial intelligence would remain one of the major areas requiring attention from regulators, particularly as countries seek to balance technological development with the protection of personal information.

She said she intends to continue working in the sector, including through further studies in cybersecurity and data governance.

Kassait said she also hopes to document her experience establishing the ODPC in an autobiography, which she expects to publish by the end of January.

She urged public servants to view government institutions as platforms for creating lasting impact, saying her experience demonstrated that public service could contribute to building institutions and shaping national conversations.