The proposed Data Protection Bill 2018 will hurt local firms that rely on data exchange to reach new consumers, experts have warned.
“The bill includes a data localisation provision, making it illegal to send personal data outside the country,” Microsoft East Africa Government Affairs Lead Angela Ng’ang’a said.
She said there is need for the law to allow a seamless flow of data or local firms will find it difficult to transact businesses with foreign firms.
Speaking to the Star on phone, Technology advocate Fiona Makaka said the bill may prove to be counter-productive if implemented despite its intention being consumer protection.
“First, compliance with the provisions can prove to be quite costly and second, it generally lengthens the customer journey,” she said.
The Data Protection Bill seeks to give the consumer control over their data. Its provisions heavily mirror the European Union’s General Data Protection Regulation which demands that companies must seek consumer consent before sharing their data.
Businesses contravening this law may end up being fined up to four per cent of their annual global turnover or Sh2.4 billion whichever is greater.
Locally, the Data Protection Bill prescribes a fine of Sh5 million or a five year jail term for those who contravene the provisions.
In his write-up to the Council of Foreign Relations, Global Public Policy manager at Visa, Sabina Frizell said the restrictions if implemented will hurt SMEs more than large corporates.
“Although it outlines a number of scenarios where data transfers outside the country will be allowed, small companies will lack the teams of legal and policy experts necessary to comply. That is likely to favour incumbents and choke Kenyan tech start-ups,” Frizell said.
Myriad Connect’s Business Development director for Africa Willie Kayenki said the burden to make the law work rests with technology experts. He said experts need to execute the provisions of the law and blend it in with business needs.
While the bill is yet to be passed, Kenya is in the processes of setting up a National Integrated Identity Management System to centralise citizens’ data.
The system will see government-issued documents such as IDs, refugee cards, birth and death certificates and driving licenses all stored in a single place. To collect citizens data, the government will carry out a mass registration using biometric data listing kits that will collect fingerprints, hand and earlobe geometry, retina and iris patterns and voice waves.