Kassait warns Kenya is playing catch-up as foreign firms control digital infrastructure

Outgoing Data Commissioner Immaculate Kassait, in her final days at the Office of the Data Protection Commissioner (ODPC) in Kenya, has cautioned that the nation risks losing its negotiating power in data matters due to its reliance on foreign digital infrastructure. Kassait highlighted that despite Kenya's progress in regulating data processing, the country continues to lag behind in negotiations with multinational technology firms due to limited local technical capacity and a continued dependence on external platforms.

She noted that while Kenya has implemented policies such as a cloud policy, the nation remains largely dependent on technologies developed elsewhere. "We are always playing catch-up," Kassait emphasized, stressing that many negotiations with global technology companies remain lopsided and unequal when a country lacks its own digital infrastructure and technical expertise.

Kassait's comments come as Kenya accelerates its digital transformation across both government services and the private sector, increasing the significance of data collection, storage, transfer, and processing practices. With the rise of artificial intelligence, Kassait pointed out additional challenges for data protection regulators, particularly the repurposing of personal information without individuals' knowledge to train AI systems.

She raised concerns about accountability and informed consent, questioning whether organizations inform data subjects when their information is used for different purposes. To tackle these emerging risks, Kassait urged the ODPC to issue guidance on AI usage, outlining acceptable practices and organizational responsibilities. She also advocated for integrating data protection principles into technology development from the onset rather than addressing them post facto.

Kassait further called for stronger data governance structures, including the development of digital public infrastructure that supports public services through centrally managed and anonymized information, rather than exposing personal details to commercial exploitation. Reflecting on her tenure, Kassait noted that one of her primary achievements was establishing data protection as a national conversation and enhancing accountability among organizations handling personal information.

She expressed her intention to continue working in the sector, focusing on cybersecurity and data governance, and hoped to document her experience.