In Kenya, personal data protection is governed by the Data Protection Act, 2019, which establishes rigorous rules to protect individuals’ privacy. However, not all data processing activities require strict adherence. Sections 51 to 54 outline key exemptions that cater to specific purposes. Here’s an overview:
I. General Exemptions
Section 51 provides a few broad exemptions:
- Personal or household activities: Data processed purely for personal use, such as maintaining a private CCTV system to monitor one’s home, is exempt.
- National security and public interest: Processing necessary for safeguarding national security or public interest, such as intelligence gathering by security agencies, is exempted, provided it’s done lawfully.
- Legal requirements: For instance, when a court issues an order for data disclosure during a criminal investigation.
II. Journalism, Literature, and Art
Section 52 acknowledges the role of freedom of expression. Data used for journalism, literature, or artistic purposes is exempt if:
- The data controller reasonably believes the publication is in the public interest, such as investigative reporting on corruption.
- Compliance with the Act would conflict with the nature of the work, such as documenting cultural practices through photography that involves public scenes.
However, data processors must follow ethical codes or self-regulation mechanisms relevant to their field.
III. Research, History, and Statistics
Section 53 provides exemptions for data processing used solely for research, historical, or statistical purposes, provided:
- The data is anonymized or not published in identifiable forms, such as in university-led health studies.
- Adequate safeguards are in place to prevent misuse, like securing data from unauthorized access.
IV. Exemptions by the Data Commissioner
Section 54 allows the Data Commissioner to grant exemptions on a case-by-case basis.
Final Thoughts
While these exemptions provide flexibility, they are not a free pass for misuse. Entities must ensure their practices align with lawful processing principles and protect the rights of individuals where possible. Understanding these exemptions helps organizations balance compliance with operational needs while respecting privacy rights.
Struggling with data privacy challenges? Let our expert team navigate the complexities of compliance for you. Focus on your priorities while we ensure your data protection needs are met with precision. Contact us at [email protected] for bespoke solutions tailored to your requirements.
