[kictanet] Day 5: Policy and Regulatory Framework on Privacy and Data Protection- Offences and Remedies

Tue Aug 28 13:02:57 EAT 2018

Thank you for your contributions so far.
@Hannington, thank you for bringing in the issue of proportionality of
remedies. While at the moment our economy is much smaller, don't you think
we shall keep growing? Also, how can we cure the fact that there is a mix
of both very small and very big players in our scene?
@Mercy and Jefferson, your comments on pro-rating penalties are noted.
 I would love to get your comments on remedies for the data subjects. How
can the law provide some justice for victims of breaches?

Il giorno mar 28 ago 2018 alle ore 12:13 Hannington Oduor via kictanet <
kictanet at lists.kictanet.or.ke> ha scritto:

> The GDPR model may not fit well in our context, reason, the economy
> factored in that model are much bigger hence remedies  to the victim/
> injured would be likewise, a copy paste here would create a scenario where
> the injury is epic but inversely propositional to the punishment.
>
> On Tue, Aug 28, 2018 at 9:36 AM Grace Bomu via kictanet <
> kictanet at lists.kictanet.or.ke> wrote:
>
>> Offences are public in nature and their prosecution and sentencing is
>> carried out through the criminal justice system. Remedies on the other hand
>> may be considered from a civil lens and examples include damages,
>> restitution, coercive (injunctions) and declaratory remedies. They are
>> personal and their aim is to give justice to the injured person. A trend
>> with newer laws is the provision of both offences and remedies.  In the
>> copyright law for example, in addition to criminal offences,  one can
>> recover profits from pirated material.
>> Back to our bill, the following offences are created:
>>
>> *Offence *
>>
>> *Penalty *
>>
>> Knowingly supplying false information to the data commissioner during
>> registration as a data controller or processor ( clause 15 (3))
>>
>> General penalty under clause 59:
>>
>> 5 million shillings fine or 5 years imprisonment or both
>>
>> plus
>>
>> possible forfeiture of equipment and prohibition order
>>
>> Data controller or processor failing to notify the data commissioner
>> about a change in particulars (clause 16 (7))
>>
>> General penalty
>>
>> unlawful  processing of personal data (clause 27)
>>
>> 5 million shillings fine or 5 years imprisonment
>>
>> Unlawful processing of sensitive personal data (part v)
>>
>> 5 million shillings fine or 5 years imprisonment
>>
>> Refusing to comply with a notice from the data commissioner or knowingly
>> furnishing the commissioner with false information during investigations
>> (clause 52(3))
>>
>> General penalty
>>
>> Disclosure of personal data by controller against specified purpose
>> (clause 58 (1))
>>
>> General penalty
>>
>> Disclosure of personal data by processor without authority of controller
>> (clause 58 (2))
>>
>> General penalty
>>
>> Obtaining personal data without prior authority of controller or
>> processor (clause 58 (3)(a))
>>
>> General penalty
>>
>> Disclosure to a third party (clause 58 (3) (b))
>>
>> General penalty
>>
>> Offer (advertisement) to sell personal data obtained through unlawful
>> disclosure ((clause 58 (4))
>>
>> General penalty
>>
>> The bill has taken the criminal law track and has not provided remedies
>> targeting persons injured by contravention of the bill. It does however
>> create a complaints mechanism where the public can lodge complaints with
>> the data commissioner. The powers of the commissioner in addressing such
>> complaints are limited to issuing notices.(and we shall be discussing more
>> about the office powers of the data commissioner in due course)
>>
>> Our discussion today is on the question of choosing the offences route as
>> opposed or in addition to the civil route. What are our thoughts on this?
>> Should we have borrowed the pro-rated model of the GDPR where
>> controllers/processors are charged administrative fines according to their
>> revenue?
>> And when we come to offences, are they adequate? Should the magnitude of
>> the offence be measured against the size of the data processor or are all
>> sins equal despite might of the transgressor?
>>
>> Listers, please share your views on these issues. As usual, we welcome
>> identification of good and problematic clauses. Welcome to the discussion.
>>
>> --
>> Grace Mutung'u
>> Skype: gracebomu
>> @Bomu
>> PGP ID : 0x33A3450F
>>
>> _______________________________________________
>> kictanet mailing list
>> kictanet at lists.kictanet.or.ke
>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet
>> Twitter: http://twitter.com/kictanet
>> Facebook: https://www.facebook.com/KICTANet/
>> Domain Registration sponsored by www.eacdirectory.co.ke
>>
>> Unsubscribe or change your options at
>> https://lists.kictanet.or.ke/mailman/options/kictanet/hanningtondr%40gmail.com
>>
>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform
>> for people and institutions interested and involved in ICT policy and
>> regulation. The network aims to act as a catalyst for reform in the ICT
>> sector in support of the national aim of ICT enabled growth and development.
>>
>> KICTANetiquette : Adhere to the same standards of acceptable behaviors
>> online that you follow in real life: respect people's times and bandwidth,
>> share knowledge, don't flame or abuse or personalize, respect privacy, do
>> not spam, do not market your wares or qualifications.
>>
>
>
> --
>
>
>
>
>
> *Computer and Cellular Forensic InvestigatorCyber Crime Unit CID HQ
> Nairobi 0720-727003ENCASE II        C.H.F.I*
> _______________________________________________
> kictanet mailing list
> kictanet at lists.kictanet.or.ke
> https://lists.kictanet.or.ke/mailman/listinfo/kictanet
> Twitter: http://twitter.com/kictanet
> Facebook: https://www.facebook.com/KICTANet/
> Domain Registration sponsored by www.eacdirectory.co.ke
>
> Unsubscribe or change your options at
> https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com
>
> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform
> for people and institutions interested and involved in ICT policy and
> regulation. The network aims to act as a catalyst for reform in the ICT
> sector in support of the national aim of ICT enabled growth and development.
>
> KICTANetiquette : Adhere to the same standards of acceptable behaviors
> online that you follow in real life: respect people's times and bandwidth,
> share knowledge, don't flame or abuse or personalize, respect privacy, do
> not spam, do not market your wares or qualifications.
>

-- 
Grace Mutung'u
Skype: gracebomu
@Bomu
PGP ID : 0x33A3450F
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20180828/e222e888/attachment.htm>