Kassait: Making data protection a national conversation was my key achievement

Immaculate Kassait, the outgoing Data Commissioner in Kenya, has highlighted her most significant achievement as her role in transforming data protection from a niche regulatory concern into a nationwide conversation. During her six-year tenure at the Office of the Data Protection Commissioner (ODPC), Kassait emphasized the importance of ensuring that organizations are accountable for the collection and handling of personal information.

Kassait recounted the initial resistance her office faced when engaging organizations for compliance but noted a significant shift in attitude towards data protection over time. She pointed out that the ODPC had to confront organizations directly and demand adherence to data protection requirements, a stance that marked a pivotal change in how institutions approached personal data.

The commissioner detailed the multifaceted responsibilities of the ODPC, which include handling complaints, investigating alleged breaches, and determining penalties for violations. Kassait explained that these actions are taken after assessing the nature of complaints to ensure they fall within the office's mandate. Penalties are determined based on various factors, including the frequency of offenses, the severity of the breach, the number of individuals affected, and the steps taken by the organization to rectify the issue.

Looking ahead, Kassait cautioned about the growing challenges posed by emerging technologies, especially artificial intelligence (AI). She questioned the adequacy of informing individuals about the potential repurposing of their data in AI systems, a critical issue that requires ongoing attention from regulators. Kassait also outlined the ODPC's efforts to issue guidance on AI, emphasizing the need for organizations to be aware of acceptable practices and to avoid unethical data usage.

Furthermore, she pointed out Kenya's dependency on foreign technology infrastructure, which undermines the country's ability to control and regulate personal data. Kassait argued that such reliance creates an imbalance in negotiations with international tech companies, suggesting that genuine data protection discussions require local capacity.

Kassait stressed the importance of integrating data protection considerations into the design phase of digital products and services, advocating for the principle of data minimization—collecting only the information necessary for the intended purpose. Despite acknowledging the progress made, she stressed that there is still substantial work to be done, particularly in strengthening Kenya's legal and institutional framework for cross-border data protection matters.

Kassait highlighted the need for the ratification of the Malabo Convention on Cyber Security and Personal Data Protection, alongside legal reforms to facilitate mutual legal assistance, as part of an ongoing agenda. She emphasized that while digital data flows cannot be halted, the priority should be to ensure that personal information is handled responsibly and protected through appropriate safeguards.

As she steps down from her role, Kassait urged her successor to define their own priorities while building upon the foundation laid by the ODPC.