NAIROBI, Kenya- The Office of the Data Protection Commissioner has proposed classifying information about political affiliation and trade union membership as sensitive personal data under specified cross-border transfer conditions.
Data Commissioner Immaculate Kassait published the draft notice under Section 47 of the Data Protection Act, 2019, and invited members of the public and other stakeholders to submit their views.
Under the proposal, political affiliation would include information revealing a person’s political opinions, membership of or association with a political party or movement, and participation in political activities.
It would also cover information from which an individual’s political leaning could reasonably be inferred.
Trade union membership would include information revealing a person’s membership of, affiliation with or activities in a trade union or labour organisation.
The designation would not automatically apply to all political or trade union information processed in Kenya.
According to the draft notice, the additional protections would apply only when the information is transferred into Kenya from another country or jurisdiction.
The originating country’s law must also classify political affiliation or trade union membership as sensitive or special-category personal data at the time of the cross-border transfer.
The proposal would therefore require Kenyan data controllers and processors receiving such information to maintain the protection it enjoyed under the laws of its country of origin.
Organisations handling the affected information would be required to comply with provisions governing sensitive personal data under the Data Protection Act and its regulations.
Non-compliance would attract the enforcement measures and penalties provided under the Act.
The Data Protection Act already defines sensitive personal data as information revealing matters including a person’s race, health, ethnic or social origin, beliefs, genetic and biometric details, property, marital status, family details, sex and sexual orientation.
Section 47 empowers the Data Commissioner to prescribe additional categories after considering factors including whether disclosure could cause significant harm, humiliation or loss to an individual.
The commissioner must also consider whether the information enjoys confidentiality protections under other laws or professional relationships and whether it is generally regarded as highly confidential.
ODPC said the proposed additions were necessary to protect the fundamental rights and freedoms of people whose personal information is processed in Kenya.
The office has invited comments, observations and recommendations through its online feedback platform or by email at public.participation@odpc.go.ke.
The notice remains a draft pending completion of the public participation and prescription process.
