ELDORET, Kenya, Jan 27, 2025 –In anticipation of the Data Privacy Day 2025, the Office of the Data Protection Commissioner (ODPC) held a pre-conference meeting with journalists on January 27, 2024,
The event was graced by the Media Council of Kenya’s Chief Executive Officer David Omwoyo Omwoyo and Data Commissioner, Immaculate Kassait, MBS.
Data Privacy Day commemorates the signing of Convention 108, the only international convention on data protection. It aims to raise awareness about personal data protection among citizens, data controllers, and data processors in both the private and public sectors.
The Data Commissioner stated that the 2025 theme aims to raise awareness of the need for data protection amid the increased collection and sharing of personal information among individuals, organizations, and government entities.
She underscored the significance of the pre-conference meeting with journalists as it serves as the initial point of contact to raise awareness not only about the event and its related activities but also about the data protection landscape.
“This engagement facilitates ongoing discussions on the Data Protection Act and plays a vital role in breaking down communication barriers that may hinder future engagements. Furthermore, it provides an invaluable opportunity for feedback, which will greatly contribute to enhancing the operational effectiveness of the ODPC, aligning with the vision outlined in the Data Protection Act,” she said.
The Office is keen on establishing contact and engaging journalists across the country even as it establishes its presence in various parts of the country.
“I applaud the crucial role the media has played in disseminating news since the enactment of the Data Protection Act in 2019 and the operationalization of the ODPC in 2020.
“This event will see the launch of the Eldoret regional office, bringing the total number of offices to six, including those in Kisumu, Nakuru, and Mombasa, Machakos, Nyeri. The Office also has presence in Nyeri, Eldoret and Garissa Huduma Centres,” she said.
In line with its mandate to regulate data protection in Kenya, she noted that the ODPC had made remarkable progress in implementing the Data Protection Act.
- The office has actively registered more than 8,000 Data Controllers and Data Processors, demonstrating an increasing compliance with data protection regulations.
- To further support compliance, ODPC has expanded its efforts to provide sector-specific guidance notes, aiming to streamline data processing operations in various identified sectors. The Office has published eight sector-specific guidance notes cover a range of sectors including digital credit providers, communication, education, and the health sector.
- The Office has conducted 84 audits and inspections of data controllers and processors to ascertain their compliance with the Data Protection Act, 2019, and its accompanying regulations. ODPC has issued 192 advisories and conducted 138 Data Protection Impact Assessments (DPIAs)
- Furthermore, the office received a total of 6,817 Complaints and investigated and resolved a total of 6,516 complaints.
- The ODPC has taken swift action on these complaints, issuing 195 determinations, 100 enforcement notices, and 12 penalty notices to ensure that data controllers and processors comply with data protection regulations.
- The Office has resolved 27 cases under the Alternative Dispute Resolution (ADR) framework.
The MCK CEO, in his remarks, further encouraged the fourth estate to uphold responsibility when handling personal data as they process stories, emphasizing that ethics remain paramount in news production and consumption.
“As we mark this day, I urge journalists, as conveyors of information, to reflect on their privilege to access and disseminate information. We have an additional responsibility, including ensuring consent and the right to privacy. The pleasure we have as media should be exercised with caution,” he stated.
Mr. Omwoyo also encouraged journalists to gain insights into the expectations from the ODPC as a regulator regarding potential malpractices by data controllers and data processors in relation to data protection issues.
