Unauthorized use of personal data by organizations could result in arrest and prosecution, the Data Protection Commission has warned.
Ms. Immaculate Kassait, the Commissioner of the Office of Data Protection Commission (ODPC), has issued the warning to organizations that misuse individuals’ personal data for their own gains, emphasizing that such actions constitute a breach of the Data Protection Act of 2019.
She said offenders could face severe consequences, including a fine of up to Sh5 million, imprisonment for six months, or both.
Ms. Kassait made the remarks in a speech read on her behalf by Ms. Rose Mosero, Deputy Data Commissioner-In-Charge of Enforcement and Compliance, during a sensitization forum on the Data Privacy and Protection Act 2019 in Kirinyaga County.
Kassait stressed the importance of obtaining consent from individuals before their personal data is utilized by any organization, individual, or group within or outside Kenya. Furthermore, she emphasized that those who handle personal data must be registered with the Commission.
She appealed to county commissioners and other law enforcement officers to assist her office in identifying individuals or organizations breaching the Act so the office could take action.
“The categories allowed to manage personal information should be registered with ODPC; they are data controllers and data processors,” she said.
She said that since the Commission was established in November 2020, they have received more than 2,800 claims from people who feel their data was wrongfully handled.
Kirinyaga County Commissioner, Mr. Tobiko Nayioma, further warned the public to be aware of what they post on social media platforms because, in social media, information is treated as if subjects have consented.
He said some social media information was sensitive but the public was not taking it seriously since even international organizations may use it for bad intentions.
Members of the public lamented that betting companies and financial apps were abusing their Data Protection Act rights since they received messages from these organizations even when they did not sign any documents with them.
At the same time, the public were advised to report any organization misusing their information, even religious ones, since the government will not act where there is no complainant.
Religious leaders said that they should be given an exemption on the registration fee since some of their groups were too small to raise the Sh. 4,000 annual fee.
Currently, the officers from the Data Commission are conducting sensitization forums in different parts of the country.
