Ms. Immaculate Kassait has been appointed as the first Data Commissioner of Kenya! 

As the Data Commissioner, she will be responsible for the enforcement of the Data Protection Act with duties such as exercising oversight on data processing operations, promoting self-regulation among data controllers, promoting international cooperation in data protection related issues, and conducting research on data processing development.

Kassait who is currently the Director for Voter Education, Partnership and Communication at the Independent Electoral and Boundaries Commission (IEBC) was vetted and endorsed by the National Assembly.

The Data Protection Act gives the Office the following powers to execute its mandate:

• To conduct investigations on their own initiative, or on the basis of a complaint
• To obtain necessary professional assistance, consultancy or advice when necessary
• To facilitate dispute resolution on disputes arising from the Data Protection Act
• To issue summons to a witness for the purposes of an investigation
• To require any person to provide it with explanations, information and assistance
• To impose administrative fines for failures to comply with the Data Protection Act

Other duties imposed by the law include:

• Joining associations and organisations in furtherance of the Act.
• To issue a data sharing code which will contain a practical guidance on the sharing of personal data according to provisions of the Data Protection Act between government departments or public sector agencies.
• To issue guidelines or codes of practice for the data controllers, data processors and data protection officers
• To offer data protection certification standards and data protection seals and marks in order to encourage compliance of processing operations with the Data Protection Act
• To require certification or adherence to code of practice by a third party
• To develop sector specific guidelines for areas such as health, financial services, education, social protection and any other areas where there is data processing.

Important to note is that, on the day her nomination was announced, the Huduma Number laws were gazetted. The Registration of Persons (National Integrated Identity Management System) Rules, 2020 and the Data Protection (Civil Registration) Regulations, 2020 are now law in compliance with the Nubian Rights Forum case judgement. 

With the government having announced plans to proceed with the Huduma Number project, the Data Commissioner’s role will be to ensure that the process is in compliance with the data protection Act while building public confidence in the whole system.

Other challenges the Data Commissioner is going to deal with is how to establish and maintain a register of data controllers and data processors in a way that it does not affect Kenya’s ease of doing business.