A draft strategic plan by the Office of the Data Protection Commissioner (ODPC) in Kenya was taken through a validation forum by stakeholders under public participation.

The ODPC and the UK Embassy held a day’s workshop during which the ODPC Draft Strategic Plan (FY 2021/2022- 2023/2024) was subjected to stakeholders’ validation in a hybrid workshop held on Wednesday, October 27, 2021, at the Crowne Plaza Hotel & Resort in Upper Hill, Nairobi, and online via Microsoft Teams. 

Officials from both the Public and the Private Sector attended the workshop to provide valuable input to the Strategic Plan, whose implementation will determine the policy direction in the regulation of personal data in the country. The draft Strategic Plan is expected to provide a roadmap to improve institutional effectiveness and efficiency as relates to personal data protection, as Kenya embarks on its transition into a digital-based economy.

The Strategic Plan was developed in collaboration with financial support from the UK Government through the existing UK-Kenya Strategic Partnership 2020 – 2025 under the Universal Digital Access Pillar.

The Data Protection Commissioner made a presentation focusing on the highlights of the ODPC Strategic Plan. Below is an overview of the presentation:

• A situational analysis of achievements realised since the inauguration of the ODPC, and the strategic issues that formed the basis for the formulation of the strategic key result areas, strategic objectives and strategies. 
• The model that will aid the formulation and implementation of the decisions about the ODPC’s future direction in the next three years, putting into consideration the strategic objectives, key result areas, enablers, and the underlying strategic foundation.
• Key Result Areas (KRAs) are the critical cornerstones that address the strategic challenges identified in realization of ODPC mandate, mission and values. KRAs for the Strategic Plan include:
  • Institutional capacity development – Build the capacity of the data protection institution and promote partnerships to enhance data processing operations;
  • Regulatory services – Establish policy frameworks to safeguard private data; and
  • Awareness creation – Equip stakeholders with adequate information/knowledge on data protection to promote compliance. 
• Key enablers towards promotion of effective personal Data Protection regime identified within the Strategic Plan: 
  • Legal and policy framework – Progressively develop and review data protection laws to respond to the changing technologies in the processing of personal data.
  • Institutional framework – Establish an efficient organization that is responsive to stakeholders’ expectations in the provision of services. 
  • Partnership and collaboration – Develop and implement a synergistic data protection foundation that realises valuable partnerships and collaborations.
  • Research – Leverage on research to achieve a growing, dynamic and innovative environment able to assimilate and respond to emerging trends and concepts of data protection.
• Implementation strategies for the Strategic Plan:
  • Phasing and Sequencing: Acknowledging the limited resources available, the ODPC shall prioritize programmes with the greatest contribution and impact to the office’s core mandate.
  • Results based management: The ODPC shall focus on the key outputs and impacts relevant to the needs of the general public, including facilitating quality service delivery.
  • Institutional Strengthening: The ODPC pledges to continuously improve in order to align with the complexity and diversity of data protection programs and emerging issues;
  • Human Resource development: The ODPC envisions a lean but effective staff. Current staff is 12 but ODPC seeks to establish a staff of 222 (118 Technical and 104 Support services);
  • Financial resource development: Kshs 3.612 Billion budget required for implementation of the Strategic Plan;
  • Resource mobilization: Financing options include the Government of Kenya, internally generated income, innovative funding models (i.e.resource mobilization through partnerships, and strategic alliances with key sector players), and support from the international community. 
• Monitoring and evaluation obligations that shall examine the relevance, effectiveness, efficiency, impact, and sustainability of the strategies on a monthly, quarterly, and annual basis. 

The second half of the workshop was an open session, providing an opportunity for the physical and virtual stakeholders in attendance to submit their input on the draft Strategic Plan. Below is a summary of the comments, concerns, and queries raised by the various stakeholders:

• Critical need to ensure the provision of adequate human and financial resources to the ODPC to facilitate and promote data protection laws. Concerns were raised regarding obtaining the necessary budget for the 3 year strategic plan through the proposed funding sources.  
• Praise for the development of a data protection curriculum in collaboration with the Kenya School of Government.
• Reservations about the high cost of training ODPC staff, with the alternative solution being hiring data privacy professionals currently practicing in the private sector. 
• Awareness programmes to focus on educating the public on the redress measures that may be relied upon for breaches of their personal data rights. 
• Development of registration requirements for public data controllers and data processors. 
• Explicit recognition of arbitration as an alternative dispute resolution mechanism for data protection disputes to prevent courts from being overwhelmed.

The ODPC is presently receiving written submissions from the public on the draft Strategic Plan via info@odpc.go.ke until close of business Wednesday, November 3, 2021.