The Data Commissioner, having carefully considered the criteria set out in Section 47(2) and being satisfied that the prescription is necessary for the protection of the fundamental rights and freedoms of data subjects and in exercise of the power conferred by Section 47(1) of the Act, hereby prescribes as follows:

1.  Additional Categories of Sensitive Personal Data

The following categories of personal data are hereby prescribed as sensitive personal data only where categorized as such in the Jurisdiction of Origin:

(a) Political affiliation – any information that reveals or relates to a data subject’s political opinions, membership or affiliation with a political party or movement, participation in political activities, or any other information from which political leanings can reasonably be inferred.

(b)Trade union membership – any information that reveals or relates to a data subject’s membership in, affiliation with, or activities in a trade union or labour organization, or any other information from which trade union involvement can reasonably be inferred.

2.   Application.

The prescription in Clause 1 applies only where:

(a)  the personal data in question is transferred to Kenya by way of a CrossBorder Transfer;

(b)  the Originating Law of the Jurisdiction of Origin, at the time of the CrossBorder Transfer, treats, designates or classifies data revealing trade union membership or political affiliation (or data of equivalent character, however described) as sensitive personal data or special category of personal data.

3.   Compliance

All data controllers and data processors shall comply with the provisions of the Act, and the attendant Regulations, applicable to the processing of sensitive personal data.

4.   Enforcement

Non-compliance with the requirements applicable to sensitive personal data (including those prescribed herein) shall attract the enforcement measures and penalties as provided under the Act and the attendant Regulations.