[kictanet] Day 5: Policy and Regulatory Framework on Privacy and Data Protection- Offences and Remedies

Michael Pedersen michael at pluspeople.dk
Tue Aug 28 13:10:24 EAT 2018


Listers,

Could it be that the administrative overhead & the associated penalties 
depended on the amount of people's personal data you hold ?

I.e. if you hold less than 10000 people's data you might be a "small 
data processor", if you hold between 10000 and 100000 peoples data you 
would be medium and above you would be a large processor... And the 
requirements would be scaled accordingly.

..

Mike


On 08/28/2018 01:02 PM, Grace Bomu via kictanet wrote:
> Thank you for your contributions so far.
> @Hannington, thank you for bringing in the issue of proportionality of 
> remedies. While at the moment our economy is much smaller, don't you 
> think we shall keep growing? Also, how can we cure the fact that there 
> is a mix of both very small and very big players in our scene?
> @Mercy and Jefferson, your comments on pro-rating penalties are noted.
>  I would love to get your comments on remedies for the data subjects. 
> How can the law provide some justice for victims of breaches?
>
>
>
> Il giorno mar 28 ago 2018 alle ore 12:13 Hannington Oduor via kictanet 
> <kictanet at lists.kictanet.or.ke <mailto:kictanet at lists.kictanet.or.ke>> 
> ha scritto:
>
>     The GDPR model may not fit well in our context, reason, the
>     economy factored in that model are much bigger hence remedies  to
>     the victim/ injured would be likewise, a copy paste here would
>     create a scenario where the injury is epic but inversely
>     propositional to the punishment.
>
>     On Tue, Aug 28, 2018 at 9:36 AM Grace Bomu via kictanet
>     <kictanet at lists.kictanet.or.ke
>     <mailto:kictanet at lists.kictanet.or.ke>> wrote:
>
>         Offences are public in nature and their prosecution and
>         sentencing is carried out through the criminal justice system.
>         Remedies on the other hand may be considered from a civil lens
>         and examples include damages, restitution, coercive
>         (injunctions) and declaratory remedies. They are personal and
>         their aim is to give justice to the injured person. A trend
>         with newer laws is the provision of both offences and
>         remedies.  In the copyright law for example, in addition to
>         criminal offences,  one can recover profits from pirated
>         material.
>         Back to our bill, the following offences are created:
>
>         *Offence *
>
>         	
>
>         *Penalty *
>
>         Knowingly supplying false information to the data commissioner
>         during registration as a data controller or processor ( clause
>         15 (3))
>
>         	
>
>         General penalty under clause 59:
>
>         5 million shillings fine or 5 years imprisonment or both
>
>         plus
>
>         possible forfeiture of equipment and prohibition order
>
>         Data controller or processor failing to notify the data
>         commissioner about a change in particulars (clause 16 (7))
>
>         	
>
>         General penalty
>
>         unlawful processing of personal data (clause 27)
>
>         	
>
>         5 million shillings fine or 5 years imprisonment
>
>         Unlawful processing of sensitive personal data (part v)
>
>         	
>
>         5 million shillings fine or 5 years imprisonment
>
>         Refusing to comply with a notice from the data commissioner or
>         knowingly furnishing the commissioner with false information
>         during investigations (clause 52(3))
>
>         	
>
>         General penalty
>
>         Disclosure of personal data by controller against specified
>         purpose (clause 58 (1))
>
>         	
>
>         General penalty
>
>         Disclosure of personal data by processor without authority of
>         controller (clause 58 (2))
>
>         	
>
>         General penalty
>
>         Obtaining personal data without prior authority of controller
>         or processor (clause 58 (3)(a))
>
>         	
>
>         General penalty
>
>         Disclosure to a third party (clause 58 (3) (b))
>
>         	
>
>         General penalty
>
>         Offer (advertisement) to sell personal data obtained through
>         unlawful disclosure ((clause 58 (4))
>
>         	
>
>         General penalty
>
>
>         The bill has taken the criminal law track and has not provided
>         remedies targeting persons injured by contravention of the
>         bill. It does however create a complaints mechanism where the
>         public can lodge complaints with the data commissioner. The
>         powers of the commissioner in addressing such complaints are
>         limited to issuing notices.(and we shall be discussing more
>         about the office powers of the data commissioner in due course)
>
>         Our discussion today is on the question of choosing the
>         offences route as opposed or in addition to the civil route.
>         What are our thoughts on this? Should we have borrowed the
>         pro-rated model of the GDPR where controllers/processors are
>         charged administrative fines according to their revenue?
>         And when we come to offences, are they adequate? Should the
>         magnitude of the offence be measured against the size of the
>         data processor or are all sins equal despite might of the
>         transgressor?
>
>         Listers, please share your views on these issues. As usual, we
>         welcome identification of good and problematic clauses.
>         Welcome to the discussion.
>
>         -- 
>         Grace Mutung'u
>         Skype: gracebomu
>         @Bomu
>         PGP ID : 0x33A3450F
>
>         _______________________________________________
>         kictanet mailing list
>         kictanet at lists.kictanet.or.ke
>         <mailto:kictanet at lists.kictanet.or.ke>
>         https://lists.kictanet.or.ke/mailman/listinfo/kictanet
>         Twitter: http://twitter.com/kictanet
>         Facebook: https://www.facebook.com/KICTANet/
>         Domain Registration sponsored by www.eacdirectory.co.ke
>         <http://www.eacdirectory.co.ke>
>
>         Unsubscribe or change your options at
>         https://lists.kictanet.or.ke/mailman/options/kictanet/hanningtondr%40gmail.com
>
>         The Kenya ICT Action Network (KICTANet) is a multi-stakeholder
>         platform for people and institutions interested and involved
>         in ICT policy and regulation. The network aims to act as a
>         catalyst for reform in the ICT sector in support of the
>         national aim of ICT enabled growth and development.
>
>         KICTANetiquette : Adhere to the same standards of acceptable
>         behaviors online that you follow in real life: respect
>         people's times and bandwidth, share knowledge, don't flame or
>         abuse or personalize, respect privacy, do not spam, do not
>         market your wares or qualifications.
>
>
>
>     -- 
>
>     /*Computer and Cellular Forensic Investigator
>     Cyber Crime Unit
>     CID HQ Nairobi
>     0720-727003
>     _ENCASE II        C.H.F.I_*/
>     _______________________________________________
>     kictanet mailing list
>     kictanet at lists.kictanet.or.ke <mailto:kictanet at lists.kictanet.or.ke>
>     https://lists.kictanet.or.ke/mailman/listinfo/kictanet
>     Twitter: http://twitter.com/kictanet
>     Facebook: https://www.facebook.com/KICTANet/
>     Domain Registration sponsored by www.eacdirectory.co.ke
>     <http://www.eacdirectory.co.ke>
>
>     Unsubscribe or change your options at
>     https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com
>
>     The Kenya ICT Action Network (KICTANet) is a multi-stakeholder
>     platform for people and institutions interested and involved in
>     ICT policy and regulation. The network aims to act as a catalyst
>     for reform in the ICT sector in support of the national aim of ICT
>     enabled growth and development.
>
>     KICTANetiquette : Adhere to the same standards of acceptable
>     behaviors online that you follow in real life: respect people's
>     times and bandwidth, share knowledge, don't flame or abuse or
>     personalize, respect privacy, do not spam, do not market your
>     wares or qualifications.
>
>
>
> -- 
> Grace Mutung'u
> Skype: gracebomu
> @Bomu
> PGP ID : 0x33A3450F
>
>
>
> _______________________________________________
> kictanet mailing list
> kictanet at lists.kictanet.or.ke
> https://lists.kictanet.or.ke/mailman/listinfo/kictanet
> Twitter: http://twitter.com/kictanet
> Facebook: https://www.facebook.com/KICTANet/
> Domain Registration sponsored by www.eacdirectory.co.ke
>
> Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/michael%40pluspeople.dk
>
> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
>
> KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20180828/03bd82be/attachment.htm>


More information about the KICTANet mailing list