The National Integrated ICT Policy White Paper South Africa 2016-Commentary on the Internet.

The recently published White paper focuses on convergence of modern and traditional modes of communication which is a big step in connecting the present to the future ICTs. The use of data in formulating policies and monitoring the progress is also a great step towards an evidence based policy that measures progress within set timelines. Furthermore, the policy acknowledges data gaps and in particular, gender gaps in the use and access to ICT and the need to address this.

Universal access

 While deliberate policy interventions for universal access to help achieve universal service have been provided for, the focus has been on densely populated areas where investments in infrastructure can serve the greatest number of people. This leaves the sparsely populated rural areas under-served as they are not attractive to investors due to the low return expected.  To deal with this issue there is need for deliberate measures that are tailored for such areas like government subsidies and tax incentives offered to investors and public-private partnerships to finance infrastructure development in such areas to secure long term investments. There is also need for Provision for unlicensed spectrum bands for local innovators to allow for innovations at lower costs. There is also need for a coherent strategy with timelines on capacity development at all levels from access to the actual use of internet.

 Open Internet

Focus has been shifted to net neutrality at the expense of a competitive technology marketplace which has played a great role in encouraging innovation and improving quality. There is need for a balance as they are equally important in ensuring universal access and quality is maintained.

Internet intermediary liability

The policy provides for a uniform approach to be adopted for Internet Intermediary Liability. This is a restrictive approach as one size doesn’t fit all given the dynamic nature of Intermediaries and the distinguishing actors in intermediary liability regimes.

 Internet Exchange Points (IXPs)

The policy has provided for government measures to promote and facilitate the establishment of additional IXP’s in provinces currently not covered in South Africa and to facilitate peering, lower network operating costs and improve network performance which is a great  step towards improving interconnection locally.

There is need for deliberate measures to establish and sustain a competitive market that improves the local and regional interconnection. The sector regulator will be required to develop a regulatory framework to facilitate peering within two years. The polices need to create an enabling environment that provides for flexibility for interconnecting networks while removing artificial barriers. Furthermore, there is  need to promote a balance between the economic, business, technical, and operational aspects of Internet interconnection.

Address Protocols

The policy failed to capture a strategic plan to facilitate capacity building on network security threats in order to encourage adoption of IPv6 which most South African operators are yet to embrace due to security concerns emerging from its public nature.

Emerging Issues and technologies

There is need to focus on creating a competitive market environment for emerging technologies including but not limited to synchronizing the policy with the education system to encourage production of new technologies from an early age which has worked well for many economies including Korea.

Internet Governance

While the paper has adopted the World Summit on the Information Society (WSIS) principle for Internet governance which is centered around consensus among stakeholders internationally on governance issues. It has failed to incorporate this by focusing on the regulator as the sole administrator nationally  instead of adopting a governance model based on a public private partnership to improve the Internet and business landscape. There is also need to establish policies that provide for clear dispute resolution mechanisms that are easily accessible and affordable.

 

 

Foreign Accounts Tax Compliance Act [FATCA] vs Right to Privacy- Kenya

Background

On 17 January 2013, the US Treasury Department issued final regulations implementing the US Foreign Account Tax Compliance Act of 2010 (FATCA), a statute principally designed to reduce offshore tax evasion by ‘US persons’ by making foreign financial institutions (FFIs) information gathering agents of the U.S Internal Revenue Service (IRS) and  wielding a threatening stick in the form of 30% withholding of all US source payments received by non-compliant FFIs. The expansive definition of FFI provided by the law means that these changes are of concern not only to banks, but also to investment funds, hedge funds, private equity funds, securitization vehicles and many other forms of financial intermediary.

The rule requires all FFI’s to search their records for data indicating U.S. person-status and to submit their names, account numbers, and account balances directly to the IRS.

FATCA is a one-way street with information flowing to the US from all other nations, and nothing whatsoever flowing back the other way as the Congress has not authorized this and it is highly unlikely that it will though in the inter-governmental agreement IGAs the US Treasury assures signatory nations that the U.S  will do its best to reciprocate. Even if reciprocity is instituted, it will not be a fair exchange because except for Eritrea which also practices citizenship -based  taxation(CBT),all other countries practice residence-based taxation (RBT). Therefore have no need for information about the finances of their citizens who no longer live within their borders. This is because taxes are paid to cater for the cost of services that the government provides to is residents and not as a prerequisite for citizenship or residence.

The Treasury Department has been unable to cite any constitutional, statutory, or regulatory authority which allows it to compel FFIs to collect and share the financial information of U.S. citizens.  Due to Privacy Laws in most foreign countries, the Treasury Department has entered into numerous IGAs whose legality  is also in question as this wasn’t provided for in the FATCA and the congress has not consented to the IGA approach despite it falling under the tax treaties or amendments to tax treaties, which require ratification by the US Senate.

Regardless, many governments have signed FATCA IGAs, agreeing to alter their own privacy and banking laws to accommodate the United States. They have signed out of fear of the institution of the 30% FATCA sanctions against their banks.  These IGA’s render the signatory countries helpless in protecting their own tax payers and further exposing the state to litigation from tax payers who demand protection from the state.  There is currently no FATCA IGA between Kenya and the U.S.

Of interest is that  the U.S is not a signatory to OECD Common Reporting Standards (CRS) so basically the U.S is bullying the rest of the world, but in a very one-sided way.

Kenya’s financial institutions and especially banks are exposed. This is because diaspora remittance inflows from North America are very high accounting for 49.3 percent of total inflows in June 2016.   All the US dollars sent from whichever part of the world have to go through a US correspondent bank before they are routed to a local bank in Kenya. As such they are exposed and will have to comply.

Financial Institutions [FIs] in Kenya  find themselves between a rock and a hard place as they owe a special duty of confidentiality to their customers with respect to information concerning customer transactions and customer credibility. In addition, Data Protection principles  generally restrict both disclosure of personal data to third parties (including tax authorities), and the cross-border transfer of personal information from one country or economic area to another. Furthermore, the right to privacy in article 31 of the Kenyan constitution 2010 restricts the transfer of personal data and seizure of personal property.

Balancing Privacy  laws with FATCA compliance

FFIs such as banks operating in Kenya must balance the right to privacy and protection of property under article 31 and 40 of the constitution 2010 with the FATCA’s reporting requirements in order to avoid breaching Kenyan laws when disclosing customer data to third-persons.

To circumvent this, banks in Kenya are making it mandatory for their account holders with any connection to the U.S to sign a “voluntary general consent” for data sharing, seizure of funds and transfer of liability without further referral to the account holder (paragraph 6-12 of the consent). This consent is not specific, neither is it informed or voluntary and it is further irrevocable contrary to the general rules of data protection which don’t allow for data subjects to waive their right to withdraw consent. No proper tax and legal advise is provided for by banks to the account holders, banks only send an email to the client with the consent form attached for their signature. The clients consent without knowing the impact as the alternative includes threats of tax liabilities and penalties, freezing and closure of the account. This is done despite there being no Kenyan legal grounds for an FI to close a customer’s account information or terminate a contractual agreement simply because the customer fails to consent or fails to provide the information needed for the FFI’s FATCA compliance.

The consent further exposes account holders to the risks associated with data sharing without parameters as the consent allows the bank and its affiliates to share data and allow for seizure of account funds not just to or with the IRS but also any other tax authority [paragraph 5]. This means that the FI can share personal data with any tax authority in the whole world which violates the principles of legality, proportionality and necessity. Data collection must be specific and consent must be obtained directly and furthermore, data can only be transferred to territories with adequate data protection. Worse still Kenya has not specific data protection laws in place.

Conclusion

Despite Kenya being  a sovereign state which means that it has the right to determine the laws applicable within its own borders, the importance of US dollar denominated investments in global financial markets gives the US government enormous bargaining power making it impossible to ignore in total violation of our laws including the Constitution.

FATCA forces FIs to treat Kenyans with roots or connections with the U.S as foreigners thus reducing  them to second-class citizens by violating their financial privacy, their right to a full range of investment options, and even their right to have a bank account. Some FIs are rejecting US Persons because of the expensive burdensome regulations and cost of implementation associated with the law. This is  discrimination  based on national origin or association being legalized in total violation of our constitution.

FATCA also highlights the need to enact proper data protection laws to breathe life into  article 31  on the parameters for data sharing within and outside Kenya.

Intermediary Liability and its implication on Open Journalism in Kenya 2016

Background

Innovation has seen the emergence of communication platforms including search engines and social media take over as key platforms that facilitate access to information and free speech. Most of the key platforms and communication networks are owned by private individuals and companies who are under constant pressure from the government, individual users and civil society to regulate undesirable user content in a bid to ensure human rights i.e. right to privacy, copyright, hate speech and the like are not violated by users as they exercise their freedom of expression.

Below is a highlight of the current legal framework and the litigation developments with regards to intermediary liability and the implication on Open Journalism in 2016.

Policy and Regulatory Environment

Kenya does not have specific laws, policies or procedures that address the issue of intermediary liability hence a generalist approach to this issue which means the general rules of civil, criminal law and common law apply.

 The Constitution- the Constitution of Kenya 2010 secures the freedom of expression in  Article 33  which includes freedom to seek, receive or impart information or ideas.  Article 34 guarantees the freedom and independence of electronic, print and all other types of media. However, these freedoms are limited as they don’t extend to “Propaganda for war; incitement to violence; hate speech; or advocacy of hatred that constitutes ethnic incitement, vilification of others or incitement to cause harm or based on discrimination as provided for in article 33(2). Furthermore respect to the rights and reputation of others must be taken into account and weighed against public interest as provided in article 33(3). The limitations are vague and open to misinterpretation that threatens the freedom of expression.

In applying provisions of the bill of rights, courts are required to among others to adopt interpretations that favour the enforcement of the rights or fundamental freedoms.

Article 21 (4) imposes on the State the obligation to enact and implement legislation to fulfill its international obligations in respect of human rights and fundamental freedoms.

Kenya Information & Communications Act CAP 411A- responsible for regulating and issuing licenses to ISP’s.Creates offences relating to electronic media and provides for heavy penalties for the same. Some of the offences are vague and unconstitutional as declared recently when the court annulled section 29 for creating an offence without creating the mens rea therefore threatening the freedom of expression.

 Access to Information Act 2016 –gives effect to the right to access to information in the constitution. Provides for protection of persons who disclose information in the interest of public and in good faith.

The National Cohesion and Integration Act of 2008- holds liable any newspaper, radio station or media enterprise for publishing any utterance which amounts to the offence of ethnic or racial contempt. The act does not mention content published online though several bloggers and media stations have been charged under this act.

The Prevention of Terrorism Act No 30 of 2012- allows interception of communication for purposes of prevention of terrorism without setting measures to determine what amounts to terror threat . It further creates the offence of incitement and  hoaxes without setting measures for the definition of the same . This threatens to gag the media from reporting as there are no set parameters to determine whether thwarted terror threat amounts to hoaxes. These offences can be carried out online.

The National Intelligence Service Act, 2012 –gives security agencies the powers to monitor  which definition of that term includes to intercept communications as well as to listen to, record or copy using any device.” The powers are vague as it does not state in detail what kinds of communications may be monitored. This is open to misuse by the state and government agencies.

The Media Council of Kenya (MCK) Act 2013-Journalist not defined-open to interpretation to include online end users like bloggers.  

Consumer protection Act 2012-Provides for Safe habour for ISPs with regards to unsolicited electronic communications and the processing of the customers personal information for the purposes of direct marketing.

The Copyright Act-creates liability for distribution of protected works without a license.

The Trademark Act- provides for exclusive right to use and control of trademarks. Section 58F makes it an offence to counsel, aid, abet or be an accessory to the commission of an offence under the Act therefore intermediaries can be held liable for aiding as they provide the platform for distribution by third parties.

The Sexual Offences Act- criminalizes child pornography and the manufacture or distribution of anything that falls under that category.

The Penal Code (Act )- criminalizes publishing by print of any defamatory matter concerning another person with the intention to defame that other person.

Preservation of Public Security Act- gives the president sweeping powers to make regulations on grounds of national security.This was applied during post election violence in 2007/2008 in Kenya , the state interfered with the media by banning live broadcasts.

Official Secrets Act Cap 187-this  act also allows the government to search without warrants and wiretap on communication systems in circumstances that are not well defined therefore subject to misuse by officials.

Common Law– provides for remedies for tortuous actions – defamation, copyright infringement, negligence, nuisance, invasion of privacy. Claims based on vicarious liability can also be made leading to liability of intermediaries for the acts or omissions of employees and agents. 

Proposed Legislation 

Kenya has several bills that refer to intermediary liability. However, while the bills are silent on, and do not directly define internet intermediaries, they do give rise to new rights and duties the breach of which would in effect, amount to the introduction of new forms of liability.

The ICT Practitioners Bill 2016– seeks to regulate the training, registration, licensing, practice and standards of ICT practitioners. This bill threatens threatens innovation and entrepreneurship in Kenya as it seeks to regulate without taking into account the unique nature of ICT and stakeholders have called for its withdrawal.

Computer and Cyber Crimes Bill 2016 – seeks to equip law enforcement agencies with the necessary legal tools to handle computer and cyber crimes. Vague and broad speech offences  that could be subject to misinterpretation to limit the freedom of expression online.

The Data Protection Bill 2013 – to give effect to right to privacy  by providing for the security of every person’s personal data. The Bill  requires some improvement to breath life into article 31. 

National ICT Draft Policy 2016-to set the pace for ICT sector development. The policy needs amendments to reflect enhanced production of ICTs  as opposed to the current focus on consumption and government support for the same.

Cases

There have been major gains made in court with regards to draconian pieces of legislation threatening to limit the freedom of expression.This has been reflected in the following recent cases:

Law declared unconstitutional for threatening to limit the freedom of expression Nation Media Group Limited & 6 others v Attorney General & 9 others [2016]-section 3(2)(a) of  the Media Council Act, to the extent that it requires that in exercise of the right to freedom of expression, the persons specified under section 4 of the Act “shall reflect the interests of all sections of society”  is an unjustifiable limitation of the right to freedom of expression and is therefore unconstitutional and section 6(2)(c) of the Media Council Act is unconstitutional for being couched in a manner that is vague and broad and that is likely to limit the freedom of expression. Geoffrey Andare v Attorney General & 2 others – section 29 of the Kenya Information and Communication Act, which criminalises publication of certain information in vague terms and creates an offence without creating the mens rea element declared unconstitutional for being vague and unjustifiably limiting freedom of expression.

One the other hand, there has been a general shift of liability as a result of undesirable user content to communication intermediaries which is essentially censorship- by- proxy as liabilities threaten the growth and sustainability of these entities. Furthermore, inadequate laws on safe harbors and the general shift of law enforcement burden on communication intermediaries further threatens the synergy between technology and the law in the quest to further user rights. In addition, there have been take down orders  for materials posted on social media issued before hearing of suit and disproportionate amounts in damages for civil defamation continue to be awarded in court.  This trend creates a chilling effect on open journalism. This has been reflected in the following cases:

Duty  to regulate user content on Intermediaries – Uhuru Muigai Kenyatta v Muchemi Wachira and Nation Media Group (NMG) –NMG,  found liable for defamation by virtue of its role in publishing the comments on its site and for not exercising control in removing the defamatory comments posted by the public.

Duty to regulate breach of copyright on Intermediaries- John Boniface Maina v Safaricom Limited– Take down orders issued against the mobile service provider to remove all the protected musical works from the website.

Download of works amounts to public performance –David Kasika & 4 others v Music Copyright Society of Kenya Limited & another [2016] -a series of repeated transmissions of the same  works to a number of recipients constitutes communication to the public therefore liable for payment of royalties.

Liability  of intermediaries for material  posted by third parties –Anne Waiguru v Google Inc & 2 others [No 333 of 2014] –the petitioner, a government official seeks orders compelling  Google Kenya  to reveal the identities of the owners of the Daily Post in order to facilitate the legal action for defamation against them. The presiding judge, declined to strike Google Kenya from the suit, arguing that it was too early to tell whether the firm was aware of the offensive material and if it could have been able to prevent its publication. The matter is set for full hearing.

Third party found liable for defamatory material published on social media –   Arthur Papa Odera v Peter O. Ekisa [2016]– due to the refusal/failure by the defendant to apologize or pull down the offending words from the Facebook platform, the court made an award of Kshs. 2 million general damages, Kshs. 1.5 Million exemplary damages and Kshs. 1.5 Million aggravated damages making a total of Kshs. 5 million.

Take down orders issued before hearing of defamation suit- Duncan Muriuki V. Baobab Resort–Interlocutory take down orders issued requiring the respondent to remove infringing content posted even before the matter was heard.

Publishing  image without consent violates the right to privacy– T O. S v Maseno University & 3 others [2016]-publication or use of the images of an individual without his consent violates that person’s right to privacy.

 

Data Protection Bill 2013 Analysis.

Right to Privacy

The Right to Privacy enshrined in Article 31 of the constitution of Kenya  restricts the transfer of personal data and seizure of the same. The constitution further imposes an obligation to enact laws that uphold this right.

Data Protection and Privacy as distinct rights

While Privacy and Data Protection are very closely interconnected, they are not synonymous. Data protection is about securing data against unauthorized access, essentially a technical issue while privacy is about authorized access, a legal issue. Simply put, Data Protection is the tool the law uses to ensure privacy as a fundamental human right is protected. Sadly, technology alone cannot ensure privacy; most protocols remain vulnerable to misuse of information by an authorized user. Example; When you transact through Mobile Money, you are trusting the merchant and mobile money transfer system with your data’s protection; to make sure, among other things, cyber-criminals can’t access your account information and secondly, you are trusting them to honor your data privacy by not misusing the information even though you gave it to them. This imposes not just a technological burden but a legal one as well on the authorized user to guarantee privacy hence the Data Protection Laws.

Below is a brief analysis on the adequacy of the draft Kenya’s Data Protection Bill 2013 currently with the AG in imposing a legal burden/responsibility on authorized users while conferring rights on persons to uphold the right to privacy as provided for in article 31 of the constitution of Kenya.

Definitions

Personal data has been defined to include information about both living and juristic persons and the bill provides an extensive list to include, age, gender, race etc. Though extensive, this definition fails to capture data subject who can be identified not just directly but also indirectly from the information; for example, information related to remuneration, earned incomes and assets and IP addresses.

The Bill doesn’t recognize sensitive personal data relating to financial information, racial or ethnic origin, political opinions, trade union membership, religious or philosophical belief, health or sex life of a natural person.

The definition of “disclosure” exempts the data controller from indirect identification, this needs to be revised to include indirect identification.

Data subject has been defined as a person who is the subject of personal data. The definition needs to extend to those that can also be identified indirectly from the data.

The term “Private Body” and “Exempt Information” need to be defined as there is presently no law on Access to Information

The term Informed consent has not been defined; this is crucial in establishing whether the data subject ties the consent to the purpose by clearly understanding purpose of collection of personal information, who it will be shared with, the possible consequences of the consent.

Objectives

The bill should seek to regulate, in harmony with the constitution and international standards the collection, processing and storing of personal information by public and private bodies in a manner that upholds the right to privacy subject to the limitations provided for by article 24 of the Constitution of Kenya that are aimed at protecting other rights and important interests. To achieve this, the objectives of the bill should be:

• To set out the rules and practices which must be followed when collecting, processing and storing personal information;
• To grant rights to persons in respect of their personal information;
• To provide sanctions for non-compliance; and
• To create an independent supervisory body with prosecuting powers to enforce these rights and established rules.

Limitations

Section 3(c) is inconsistent with article 24 of the constitution which provides for the limitations and no statue can impose any other limitations.

Principles of processing data

Section 4 provides for the principles of processing data. These should be simplified as below:

• Personal data may only be processed lawfully
• Processing must be carried out in good faith and must be proportionate
• Personal data can only be processed for the purpose indicated at the time of collection, that is evident from the circumstances or that is provided for by law.
• Consent for collection of personal data must be obtained directly.
• The collection of personal data and in particular the purpose of its processing must be evident to the data subject
• Data subject has right to access the information and correct/delete inaccurate information.
• Personal data shall not be transferred to a country or territory outside Kenya unless the country/territory ensures adequate level of protection of the rights and freedoms of data subjects in relation to the processing of personal data.
• In addition, proper processing requires:
• The processed personal data to be accurate and correct.
• The personal data to be protected against unauthorized processing by appropriate organisational and technical means.

Duty to Notify

Section 7 imposes a duty on the agency to notify the data subject of the intended collection but fails to provide for the duty to obtain informed consent from data subject. This is important to place a burden on the agency to make sure the data subject is well aware of what is being consented to and the possible ramifications of the consent especially in relation to sensitive data.

Collection of Personal Data

Section 8(3) provides that the Agency may collect the information “indirectly”; this is a very dangerous provision that can be misused and further negates the principle 4(b) that provides that information shall be collected “directly”.

Exemptions

• Section 9(c) shifts the burden of proof on the data subject which goes against the principles laid out in section 4. The agency should always have the responsibility of proving that the principles laid out on section 4 have been met regardless of the prejudice or lack thereof on the data subject.
• Section 9(d) (iii) provides the exception “for the protection of public revenue and property”; this clause is a loophole subject to misuse by the government agencies to tap into financial information i.e. M-Pesa, in the name of ensuring tax compliance.
• Section 9(e)-“compliance would prejudice purpose of collecting the information” and (f) “compliance is not reasonable practicable” are big loopholes that agencies can easily use to circumvent this whole act and are further contrary to the principles laid out in section 4 of the Act.
• Section 9(g) seeks to exempt the agency when a person can’t be identified directly. This exempts the agency from indirect identification which is against the principles set out in section 4 as all personal data must be obtained with consent regardless of the use and outcome of the use. The consent should not be tied to the purpose as the right to privacy must be upheld regardless. This clause also highlights the need to amend the definition of personal data to include that which can be identified indirectly.
• Clause H “information is collected pursuant to an authority granted under this act or any other written law”; again this clause is subject to misuse as the whole purpose of this act is to govern processing of data and all other laws should be subject to this act to the extent of data protection. The fact that Kenya unfortunately still has draconian laws that give sweeping powers to the government to obtain information without consent of data subject or warrants i.e. the Official Secrets Act Cap 187 and Preservation of Public Security Act goes on to show how this section can be misused.

Collection & Processing

This should be guided by the eight internationally accepted information protection conditions which are key in ensuring that the Act prescribes the minimum requirements for lawful processing of personal information namely; accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. These have been well laid out in South Africa’s Protection of Personal Information Act  that we can borrow from.

Section 10 provides for access to information by the data subject regarding the nature of the information being collected, the identity of the agency and the purpose of the collection of the information.

Section 11 provides for security safeguards by the agency that only extends to protection against destruction and negligent disclosure by unauthorized persons, this provision (Section 11 (a) (ii)) needs to be amended to include negligent disclosure by both authorized and unauthorized persons as long as the data is collected by the Agency as they are liable in both instances where there are technical or organizational lapse.

Section 12(2) regarding access to data limited to exempt information is against the principles set out in section 4 and specifically the principle of openness and data subject participation. The data subjects’ access to their personal information should not be tied to the purpose of collection. Section 12(3) further quotes a law that is yet to come in place, the act cannot be tied blindly to any law without its enactment and verification. The procedure for obtaining the information should be properly laid out in this act or should be provided for in subsidiary regulations to be enacted in accordance with the act.

Section 13 attempts to provide for the correction and deletion of information by data subject but then waters it down to essentially be a qualified right that is dependent on the agency. A data subject should have the unqualified right to correct or delete personal information that is inaccurate, irrelevant and excessive, or which the agency is no longer authorized to retain. Furthermore, clear timelines for this must be provided and minimum penalties for the Agency should be provided and further tied to the damage caused on the data subject where not complied with.

Section 14 provides for use of information; it should be current, up-to-date and not misleading.

Section 15 ties down the timelines for stored information to purpose for collection.

Section 16 ties down the use of data to the purpose the data subject consented to. This is also highlights the need to have informed consent that is tied to the purpose.

Section 17 (b) waters down the provisions regarding misuse of information in section 16 by allowing use of personal data for commercial purposes without obtaining consent as long as it is allowed by any other law. This clause provides a loophole that can be exploited to evade the principles provided for in section 4. Furthermore, there is no provision prohibiting supply and sale of i.e electoral registers, registration of persons records for political and commercial purposes having regard to the nature of the data contained in the registers, including in particular that it is personal data compulsorily obtained for the specific purpose of enabling  Kenyans transact and qualifying electors to vote.

Transfer

The Act doesn’t provide for provisions regarding transfer of personal information to foreign jurisdictions. This should be allowed only if the recipient is subject to a law which upholds principles of reasonable processing of the information that are substantially similar to the principles contained in the Act, and includes provisions that are substantially similar to those contained in the Act relating to the further transfer of personal information from the recipient to third parties. Furthermore, the data subject needs to consent to the transfer.

Breach Notification

The Act doesn’t provide for situations where there are reasonable grounds to believe that a data subject’s personal information has been assessed or acquired by an unauthorized person. The Agency, or any third-party processing personal information under the authority of the Agency, must notify the data subject as soon as reasonably possible after the discovery of the breach. The notification should include such detail as to allow the data subject to take protective measures. This is especially vital when it is sensitive information that can potentially pose a threat to the data subject.

Electronic Marketing

The Act fails to provide for restriction of unsolicited electronic communications and the processing of the data subject’s personal information for the purposes of direct marketing without the data subject’s consent.

Sanctions

Section 19 creates the offence of interference with personal data and provides for a maximum fine of Kshs. 100, 000 or/ and two years imprisonment. This should be the minimum not the maximum and the sanction should be tied to the extent of damage inflicted on the data subject.

Custodian

The Act bestows custodial powers on the Commission on Administrative Justice established by section 3 of the Commission of Administrative Justice Act 2011. Section 8 Commission of Administrative Justice Act 2011 lays out the functions of the Commission as essentially to investigate conduct and complaints of state organs and public officers therefore limiting the scope of their powers and functions. The Data Protection Act applies to both public entities and private bodies therefore making the commission not suitable for the job as its scope is limited. This essentially makes Parts III, IV and V of the Data Protection Act null.

The above paragraph notwithstanding, the nature of Data Protection such that it requires a specialized regulator established for the purpose of data protection with extensive powers to assist the Cabinet Secretary in-charge come up with regulations to govern the procedural aspect of the act, advise the Parliament on laws and matters touching on data protection, ability to bring criminal proceedings, to conduct audits on agencies and check compliance, to act as mediator where there is a dispute, to receive and investigate complaints relating to alleged violations and enforce sanctions as laid out in the Act for non- compliance and publish periodic reports the same. The regulator should be drawn from experts in ICT, Law, and Civil Society sectors.

Miscellaneous Provisions

Section 28 provides for a immunity for the agency if the information is provided for in good faith. This essentially renders the whole act useless to the extent that the agency can get away with anything as long as the defence of good faith is pleaded. Right to privacy cannot be limited by good faith as provided for in Article 24 of the Constitution, same should apply to this act. Furthermore, this provision is contrary to the principles laid down in section 4 of the act. Section 28 is therefore a null provision.

Jurisdiction; it is important for the act to spell out who the act applies to i.e is it limited to Kenyan residents only or does it extends to any agency handling personal information within Kenya or/and Regarding a Kenyan in any part of the world.

Right to Legal Action

The Act needs to provide for a right of appeal against a decision of the Regulator by an Agency to the court and an unfettered right to institute legal action by the data subject in a court against the agency for breach of any provision of the Act.

Delegated Powers

The Cabinet secretary should make regulations to govern the procedural aspect of the act in consultation with the regulator.

Conclusion

It is clear the current draft Data Protection Bill 2013 offers no solid protection to  the data subject and doesn’t reflect the current best practices globally. With the current Bill, data subjects remain at the mercy of the data processors and controllers (agencies) as the legal burden/responsibility the act imposes on the authorized users is not sufficient and further the rights of the data subjects have not been adequately provided for.

It is therefore vial to revise the Bill extensively so that it can breathe life to Article 31 of the Constitution of Kenya and Article 17 of the 1948 Universal Declaration of Human Rights; which Kenya is among the more than 160 signatories.

M-Akiba -Direct Investment in Treasury Bonds through mobile phones.

M-Akiba initiative by the National Treasury in Kenya provides an avenue for direct-investment in Treasury bonds conveniently through mobile phones by investors. M-Akiba leverages on mobile technology to provide creative, cost efficient and convenient fundraising for ongoing infrastructure projects while still creating economic value for investors and the government.

Mobile money has continued to revolutionize the financial services landscape in Kenya with over 26.8 million mobile subscriptions transacting a total of Kshs 2,816 billion in 2015. These figures indicate a firm mobile money platform which is accessible to millions of Kenyans, an enabling environment for M-Akiba.

M-Akiba initiative is a great step towards democratization of investment in treasury bonds as it allows for structuring and placement of securities at a much lower cost hence re-capturing the value of the bonds that gets lost in the abyss of the financial system by getting rid of middlemen i.e. brokers. Much of the money in the government debt market gets eaten in broker-dealer channels before reaching the investors. M-Akiba will provide the Government with its own disbursement platform to connect directly with investors instead of paying the middlemen. This means better returns and lower transaction costs for investors and the government.

M-Akiba further utilizes technology to simplify storage and management of data related to the treasury bonds.  In addition, this technology helps standardize the process and improve the workflow from origination to maturity. The use of this mobile technology is not without its challenges which include:

1. Increased risk of cyber attacks due to the obvious lucrative nature of M-Akiba.
2. Lack of proper Data Protection regulatory framework in-place and systems to allow the regulators to implement the regulations and monitor compliance with privacy laws by operators.
3. Laxity in use of mobile security solutions like Mobile Connect, facilitated by GSMA which provides for universal identity solution to protect unauthorized persons from accessing consumer’s information.

Proper Data Protection regulatory framework backed with effective mobile security solutions will greatly reduce the risks associated with the use of mobile technology such as loss of investment by consumers. A secure system will allow for growth of M-Akiba both locally and globally.

National ICT Draft Policy 2016[Kenya] Commentary

The Ministry of ICT published its 2016 National ICT Draft Policy for public comment in June 2016. This note highlights areas of improvement as submitted to the committee for consideration.

1. Vision

The vision failed to capture a balanced approach in expanding consumption as well as production. The draft  focused on increasing demand for ICTs in the country, while this is vital, focus on increased demand as opposed to supply of ICTs merely creates an ICT powerhouse in terms of consumption, not production which is not sustainable for national development. There is need to shift our focus to meet the demand locally as opposed to the current reliance placed in imports and expand regionally by developing locally made high-end technologies to meet the demand locally and also focus on expansion of ICT Exports particularly in hardware and the software sector. This has not been reflected in the policy in E-Health Services, Agriculture, Health and Human Capital etc.

 2.  Creating demand and supply

Initiate free Internet and computer literacy programs targeting at least 50% of the population with priority given to; primary and secondary schools, women, military personnel, rural areas, the disabled citizens and farmers.

Encourage consumption of locally made high-end technologies by offering tax incentives and subsidies to reduce production costs of local ICTs and maintain healthy competition with imports. This issue was witnessed recently when Jomo Kenyatta University of Science and Technology (JKUAT) forced parents to purchase locally made laptops [Taifa Laptops] which cost double the market price of other imported laptops as a way of  “having Kenyans embrace locally assembled products which even though may cost a few extra dollars, they pave the way for us to enter into manufacturing,” said Prof Romanus Odhiambo, DVC Academics. http://www.businessdailyafrica.com/Freshers-query-compulsory-purchase-of-JKUAT-laptop-/539546-3355562-g8b4vcz/

3. Institutional arrangements

Restructure government institutions responsible for the ICT policy implementation to reduce overlapping of functions for accountability purposes: i.e. Ministry of ICT and Information and Communications Technology Authority of Kenya (ICTA) functions.

National Cyber Security Agency; mandate should extend to private sector not just Protection of government communications and information systems as the cyber security threat is eminent in both sectors.

Ministry of Education; the education sector largely dictates the direction of local ICTs production by developing skills that encourage innovation through integration of ICTs in the education system. Therefore this is one of the key institutions in implementing the ICT policy.

4. Financing mechanisms

 Create the system of letting the profits from ICT fields be reallocated into ICT sector to enable focused investment in ICT.

 ‘invest first, settle later’, policy to attract private sector investments.

5. Inducing market competition

 Maintain minimal regulatory measures especially licensing and pricing in the broadband Internet service market to encourage investment and facility-based competition among existing and new service providers and further put downward pressure on tariffs.

Protect local innovations by maintaining minimum registration procedures and minimum registration fees for patents to encourage patent registration by local innovators to give them an edge both locally and globally as exporters of ICTs.

6. Research and development

 The policy needs to focus on expanding ICT education in the early stages to shift the focus of ICT education from quantitative to qualitative improvement for practical application in research and development to spur innovation.

7. Digital Divide

 Deliberate measures to close the connectivity gaps between and within counties in rural areas that have remained in digital exclusion with focus on women, children and persons with disabilities through:

• special programmes including: installation of public cyber cafes in remote rural areas;
• supplying free computers to students from low-income households;
• developing devices and software for the physically disabled; and
• strengthening ICT education for the physically disabled, women and other groups alienated from information services.

8. E-Environment

 Enhance climate change adaption, mitigation and disaster management efforts through ICTs.

The Draft National ICT Policy 2016 is available on: http://www.information.go.ke/wp-content/uploads/2016/06/Draft-National-ICT-Policy-20June2016.pdf