Speaking from the grave: Death, data protection under Kenyan Law

In Kenya, our individual and collective rights to privacy and data protection are exclusively linked to our legal capacity, which begins at birth - or upon registration - and ceases once we die.

Based on this reasoning, our right to privacy and data protection is therefore extinguished upon death.

However, the immortalisation of ourselves on digital platforms means we may have discovered the key to immortality and that a ‘digital life after death’ is possible.

This statement seems far-fetched, but recall that Microsoft recently patented artificial intelligence software capable of ‘reincarnating people as a chatbot’ using data from your social media posts and text messages.

The Data Protection Act, 2019 only refers to (living) natural persons and fails to refer to - or exclude - deceased persons.

In 2018, during deliberations on the draft Bill, the two authors highlighted that this gap would introduce numerous grey areas in law, an issue which our lawmakers opted to shelve.

As discussed below, there are complex issues beyond the data protection realm which rise following the death of a loved one, including survivor privacy and the distribution of our digital assets.

The right to survivor privacy

Before and during the official announcement of the coronavirus pandemic, we seem to have acquired a taste for sharing personal information of deceased individuals, and their families and friends, on social media platforms.

It goes without saying that sharing information and public discussions on digital platforms are constitutionally protected rights.

Moreover, these rights operate in a complex ecosystem, where other rights and competing interests must also be taken into account.

For context, we urge the reader to recall the gruesome deaths and ensuing stories of two university students, Sharon Otieno and Ivy Wangeci.

At the peak of these two investigations, we consumed information about Sharon and Ivy’s supposed lifestyle and habits, their financial, health and marital statuses, and the number of sexual partners they had.

We also learnt about the people who survived them, including the names, number, sex, paternity, ethnic social origin, and location of their children, their parents, spouse or spouses, and siblings.

The sharing of information about individuals who survive a deceased person, including next of kin, requires balancing survivor privacy and the public's right to know (i.e., public interest).

Disclosing personal information about survivors and overriding their right to privacy must meet the ‘public interest in good faith’ threshold under the Access to Information Act (2016).

However, if the disclosure merely seeks to satisfy the public’s curiosity and appetite to consume sensational information or the disclosure violates binding confidentiality agreements (e.g., disclosing health records that are subject to a duty of confidentiality), it may not meet this legal threshold.

Can a deceased person have rights?

Months after their deaths, we still discuss Sharon and Ivy.

We have immortalised them and their digital footprints, the ones they created and the ones we created for them, will always remain a part of our collective psyche.

Comparatively, countries like France enable individuals to issue either general or specific directives to data controllers about how they would like their personal data to be retained, erased and communicated after their death.

These directives can be executed by a designated person or next of kin (heirs) who have the capacity to request concerned data controllers to implement them.

Kenya does not have such a legislative arrangement, which contests our understanding of legal capacity and the creation of protected interests for deceased persons.

This option gives power back to individuals (which is the very essence of data protection laws) who are keen on exercising control over their personal information, even after their demise.

However, the right to privacy and data protection does not arbitrarily permit us to control the free flow of information about ourselves, especially where overriding interests exist.

Digital death - Are your digital assets inheritable?

The ownership of, and access to, a deceased person's digital assets and personal data is a pertinent 21st Century question.

The phrase, a ‘digital death,’ stretches our perceptions and attitudes about death, grieving, technology and property interests, with the management and distribution of our digital assets taking on a seemingly impossible character.

Think about this: you access the Internet and transmit personal data using multiple devices such as your phone, your laptop, your tablet. You use these devices in multiple locations, including your home and your office.

You use multiple virtual platforms to store your data, including Microsoft platforms, Cloud and other mobile applications.

Your personal data is stored in various formats, including text messages, photos, voice notes, emails.

You use multiple platforms to transact, purchase and access goods and services, including Netflix, Spotify, Amazon, Jumia, Uber, Facebook and Twitter.

You are literally everywhere, all the time, but your digital presence and digital assets are known, in most cases, only to you and a few tech-savvy individuals.

Lawyers who dabble in probate and administration matters can confirm that respecting the wishes of a deceased person and protecting the goods and interests amassed during one’s lifetime are subject to other competing rights and interests.

In the data protection field, the German Federal Constitutional Court offered us a glimpse into the ownership and access challenges of our digital assets.

Here, the Court allowed the parents of a 15-year-old girl access to her Facebook account after she committed suicide.

While the potential infringement of the privacy rights of third parties was raised, the court treated her social media profile - a digital asset - like physical property which can be inherited by one’s next of kin.

To go back to our earlier statement, and based on the information canvassed above, we must ask ourselves whether we are clinging to outdated perceptions of legal capacity following technological advancements.

These grey areas require urgent attention, but the release of the 100-days status report by the Office of the Data Commissioner indicates that these issues are not currently a priority for the office, and rightly so.

After all, the rights of the living must first be prioritised.

Kenyanito is a Senior Program Officer at ARTICLE 19 (UK); Mwanzia is a Program Officer at ARTICLE 19 (Kenya).