•The public advisory body says that the ability to collect and use large volumes of personal data in an efficient manner has become an important component in today’s data-driven world.
•KIPPRA emphasizes the need for Kenya to develop local infrastructure, such as data centers, to support domestic data processing and bolster data sovereignty.
Image: SCREENGRAB
Kenya’s ability to control its critical data is increasingly at risk due to insufficient funding of data protection initiatives and less strict regulations, according to the Kenya Institute for Public Policy Research and Analysis (KIPPRA).
KIPPRA says that the budget allocation for Kenya’s data protection regulator is significantly less compared to other jurisdictions.
The public advisory body says that the ability to collect and use large volumes of personal data in an efficient manner has become an important component in today’s data-driven world.
However digital disruption that has led to unrestricted and unregulated processing of personal data outside a given jurisdiction popularly known as cross-border data transfers raises concerns of privacy, trust, and sovereignty across many countries.
“Despite having relatively new legal and policy instruments for data localisation in Kenya, there is need to assess the level of preparedness in the country and determine the key considerations in building data sovereignty for successful personal data governance in Kenya,” said principle policy analyst at Kippra Humphrey Njogu.
“With few to no research carried out in this relatively new policy arena in the country, Kenya is in dire need to address the growing privacy and sovereignty concern over personal data”
In the finding of a report titled Building Personal Data Sovereignty in Kenya, Kippra highlights the absence of a comprehensive national data management policy, alongside supporting strategies and procedures, as a major hindrance to establishing a robust data economy.
Data sovereignty refers to the concept that digital information is subject to the laws and governance structures within the country where it is collected, processed, or stored.
This essentially means that the country has control over data generated within its borders, including who can access it, where it can be stored, and how it can be used.
The findings show that the budget allocated to Kenya's Data Protection Commissioner is significantly short compared to other nations, leaving critical gaps in the regulatory framework.
While the Office of the Data Protection Commissioner is currently focused on raising awareness of the Data Protection Act and registering entities that handle personal data, it has yet to enforce mechanisms that ensure data localisation.
However, the country has not set aside a specific pool of funding for data protection, with different state entities hosting their data in different parts of the world.
In 2022/2023 financial year the office of the data controller was only allocated Sh270 million for its operations, which is way, lower than other departments in the ICT ministry.
For instance, in the 2023-24 financial year the government allocated only Sh15.1 billion to the ICT ministry, of which Sh4.8 billion was allocated for the Horizontal Infrastructure Phase I, Sh1.2 billion for Konza Data Centre and Smart City Facilities.
A further Sh 5.7 billion was for the Construction of Kenya Advanced Institute of Science and Technology (KAIST) at Konza Technopolis, Sh 1.3 billion for maintenance and rehabilitation of the National Optic Fibre Backbone Phase II Expansion Cable.
The construction of Konza Complex Phase 1 B was allocated Sh475 million and Sh 583 million went to the Last Mile County Connectivity Network.
KIPPRA further notes that the diverse range of actors dealing with personal data across public, private, and community-based sectors demands a stronger regulatory approach to safeguard data within the country.
“Most of the personal data is being processed outside of the country because of superior data products offered at a lower cost, and therefore favourable for most businesses,” said Njogu in the survey.
KIPPRA emphasises the need for Kenya to develop local infrastructure, such as data centres, to support domestic data processing and bolster data sovereignty.
"Despite the introduction of new legal and policy instruments for data localisation in Kenya, there is a pressing need to assess the country's preparedness and address key considerations for achieving data sovereignty," KIPPRA noted.
The advisory body says that the global data creation is projected to exceed 180 zettabytes by 2025, and with the expectation that by 2030, nine out of ten people aged six and above will be digitally active, Kenya must act swiftly to strengthen its data governance framework.
According to the e-Conomy Africa 2020 report, Kenya currently accounts for 7.7 per cent of Africa's Internet economy, with projections suggesting this could rise to 15.17 per cent by 2050.