DRAFT – Public Notice of Prescription of Additional Categories of Sensitive Personal Data Pursuant to Section 47 of the Data Protection Act, 2019

Download PDF

Curious to learn more? The full document is available for download below. We invite you to explore the document and share your comments, observations and recommendations as we continue to strengthen our approach Download

The Data Commissioner, having carefully considered the criteria set out in Section 47(2) and being satisfied that the prescription is necessary for the protection of the fundamental rights and freedoms of data subjects and in exercise of the power conferred by Section 47(1) of the Act, hereby prescribes as follows:

1.  Additional Categories of Sensitive Personal Data

The following categories of personal data are hereby prescribed as sensitive personal data only where categorized as such in the Jurisdiction of Origin:

(a) Political affiliation – any information that reveals or relates to a data subject’s political opinions, membership or affiliation with a political party or movement, participation in political activities, or any other information from which political leanings can reasonably be inferred.

(b)Trade union membership – any information that reveals or relates to a data subject’s membership in, affiliation with, or activities in a trade union or labour organization, or any other information from which trade union involvement can reasonably be inferred.

2.   Application.

The prescription in Clause 1 applies only where:

(a)  the personal data in question is transferred to Kenya by way of a CrossBorder Transfer;

(b)  the Originating Law of the Jurisdiction of Origin, at the time of the CrossBorder Transfer, treats, designates or classifies data revealing trade union membership or political affiliation (or data of equivalent character, however described) as sensitive personal data or special category of personal data.

3.   Compliance

All data controllers and data processors shall comply with the provisions of the Act, and the attendant Regulations, applicable to the processing of sensitive personal data.

4.   Enforcement