Kenya’s Data Protection Act which came into effect on 25 November 2019, provides for the establishment the office of the Data Protection Commissioner to be headed by the Data Commissioner. The Public Service Commission had undertaken a shortlisting exercise and published names and interview schedules for the 10 shortlisted candidates on 7 July 2020. However, on the same morning, the Employment and Labour Relations Court, through an order issued by Judge Hellen Wasilwa and directed to the Commission to suspend the ongoing recruitment of the Data Commissioner pending the hearing and determination of a petition filed by lawyer Mr Adrian Kamotho. Mr. Kamotho sought to quash the recruitment process on the basis that the process is defective and irredeemably tainted with illegality. He stated that the Commission disregarded queries about the recruitment process and that the methodology and system used to shortlist applicants is unknown to law as it contravenes the rules of natural justice. He argued that the scheduling for interviews more than two months after the statutory deadline exceed legal jurisdiction and amounts to abuse of power. Section 6(3) of the DPA mandates the Commission to conclude its statutory role within 21 days. A hearing date for the petition had been fixed for 14 July 2020.
Recent developments indicate that the Commission and Mr. Kamotho reached an agreement that the Commission would start the recruitment process anew, in compliance with the DPA requirements. Whereas the DPA remains the law on all data issues in Kenya, promulgation of the rules bringing into effect the substantive functional provisions of the DPA, such as the registration of data controllers and data processors, oversight over data processing operations and investigation of any alleged breach of the DPA, rests upon the appointment of the Data Commissioner.
