<div dir="ltr"><div class="gmail_default" style="font-family:georgia,serif;font-size:small;color:#000000">Regarding sensitive data, there is need to increase the scope to Mobile number, ID, Email, and postal addresses. Using someones number, you can retrive a lot of meta data about the person. Using an email, you can retrieve a lot of metadata that you wouldn't have had access to physically. There is a lot of fraud happening, including identity theft that use your ID, Number or email. So they need to be included as part of sensitive data. </div><div class="gmail_default" style="font-family:georgia,serif;font-size:small;color:#000000"><br></div><div class="gmail_default" style="font-family:georgia,serif;font-size:small;color:#000000">Another key thing is increasing the jurisdiction to cover Kenyans no matter where they are. A lot of Kenyans are transacting online, which increases the level at which their data is saved and used for and against them. It's important that they are notified and agree or disagree with the service provider and not be held hostage to not using the service if they do not agree. And the purpose to which their data is used for. </div><div class="gmail_default" style="font-family:georgia,serif;font-size:small;color:#000000"><br></div><div class="gmail_default" style="font-family:georgia,serif;font-size:small;color:#000000">Regards,</div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr" style="font-size:small"><span style="letter-spacing:normal">-- </span><br style="letter-spacing:normal"><div style="letter-spacing:normal"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><font color="#000000" size="2" face="georgia, serif">Mercy Njue</font></div><div><font color="#000000" size="2" face="georgia, serif">Founder Botlab</font></div><div><font color="#000000" size="2" face="georgia, serif"><br></font></div><div><font color="#000000" size="2" face="georgia, serif">Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor</font></div><div><font size="2" face="georgia, serif"><font color="#000000">Office line: </font><font color="#000000">+254 700 915197</font></font></div><div><span style="color:rgb(0,0,0);font-family:georgia,serif">Email: </span><a href="mailto:Mercy@botlab.biz" target="_blank" style="font-family:georgia,serif">Mercy@botlab.biz</a><br></div><div><font size="2" color="#000000" face="georgia, serif"><i>Endless possibilities :</i> <a href="http://www.botlab.biz/" style="color:rgb(17,85,204)" target="_blank">www.botlab.biz</a></font></div></div></div></div></div></div></div><font size="2" face="courier new, monospace"><br></font><div><font size="2" face="courier new, monospace"><br><br><font><i>"</i></font>
<span style="line-height:10px;text-align:left;background-color:rgb(255,255,255)">What we are is God's gift to us. What we become is our gift to God. - Eleanor Powell</span></font>
</div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Aug 28, 2018 at 11:00 AM Grace Bomu via kictanet <<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-family:verdana,sans-serif" class="gmail_default">@Michael, on the issue of transfers outside Kenya, I foresee the need for international agreement on what constitutes basic data protection. Otherwise, some data processors will be able to build different products for different jurisdictions while those who cannot will be limited in how they can expand. <br></div><div style="font-family:verdana,sans-serif" class="gmail_default">To balance the question of platform as a service with @Muraya's comments on building the local data economy, maybe we need more evidence to determine what our local capacity is. In addition, the policy needed to rope in other stakeholders who are important for data protection, including the power sector (KPLC etc), academia on skills gaps and KEBS et al on standards, just to mention but a few. <br></div><div style="font-family:verdana,sans-serif" class="gmail_default">I hear you on the lack of incentive on notification and note this under the discussion on offences as one way to remedy this wold be to create an offence of not notifying in case of a breach. <br><br></div></div><br><div class="gmail_quote"><div dir="ltr">Il giorno mar 28 ago 2018 alle ore 00:58 Michael Pedersen via kictanet <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>> ha scritto:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>Listers,</p>
<p>Regarding part IV of the draft I have noted the following points.</p>
<p><b>1. Transfers outside Kenya.</b></p>
<p>Very many (if not most) Kenyan websites/systems are hosted
internationally, AWS, Rackspace, and all the usual suspects are
widely used. As a result very often personal data is currently
transfered internationally.</p>
<p>My issue here is what constitutes "proff" that a foreign nation
have "adequate" data protection laws? My first thought on this
issue is that Europe due to GDPR would be considered "adequate",
whereas United States would NOT be considered having "adequate"
laws.<br>
</p>
<p> If this is the case/correct interpretation then this law will
have a significant cost (money and time) for all the ones
currently hosting in US who have to migrate their setup.</p>
<p><br>
</p>
<p><b>2. Platform as a service</b></p>
<p>In situations where your system is build on a global company's
"platform as a service" (Google being the prime example) you have
very little control of "where" the personal data is "transfered" -
as Google have caching servers almost everywhere, essentially the
data would/could be copied all over the globe.</p>
<p>The limitation on international transfers - does it in-effect
kill innovations that utilize global infrastructure such as this ?<br>
</p>
<p><br>
</p>
<p><b>3. Lack of incentive for notification</b></p>
<p>As I have mentioned elsewhere I think it is great that any breach
that should happen requires that the affected person(s) be
notified. However I feel that the draft very much creates no
incentive for data-processors to actually full-fill this
requirement - In-fact the way I read it it is very very tempting
for processors who are subject to a breach to keep very quiet
(i.e. they are committing an offence if they are subject to a
breach - so better make sure no-one ever finds out that you lost
some data).<br>
<b></b></p>
<p><br>
</p>
<p>Kind regards<br>
Michael Pedersen</p>
<p><br>
</p>
<br>
<div class="m_2586334980384523942m_3716395938510396906moz-cite-prefix">On 27/08/2018 08:30, Grace Bomu via
kictanet wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr"><br>
<div class="gmail_default" style="font-family:verdana,sans-serif">General obligations for
controllers and processors are listed in part IV and they
include upholding the principles of data protection,
protecting the rights of the data subject, duty to notify the
subject about processing and breaches, acquisition of consent
and security safeguards as regards personal data. It would be
interesting to hear from data controllers and processors,
views on: </div>
<br>
<div class="gmail_default" style="font-family:verdana,sans-serif">Welcome to the
discussion. Please point out any issues in the bill that are
either very good and should be retained or problematic and
should be improved. Tujadiliane. <br>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif"><br>
<br clear="all">
</div>
<br>
-- <br>
<div dir="ltr" class="m_2586334980384523942m_3716395938510396906gmail-m_2365108637350245690gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div>Grace Mutung'u <br>
Skype: gracebomu<br>
@Bomu<br>
<span style="font-size:12.8px">PGP ID : 0x33A3450F</span><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="m_2586334980384523942m_3716395938510396906mimeAttachmentHeader"></fieldset>
<br>
<pre>_______________________________________________
kictanet mailing list
<a class="m_2586334980384523942m_3716395938510396906moz-txt-link-abbreviated" href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>
<a class="m_2586334980384523942m_3716395938510396906moz-txt-link-freetext" href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a>
Twitter: <a class="m_2586334980384523942m_3716395938510396906moz-txt-link-freetext" href="http://twitter.com/kictanet" target="_blank">http://twitter.com/kictanet</a>
Facebook: <a class="m_2586334980384523942m_3716395938510396906moz-txt-link-freetext" href="https://www.facebook.com/KICTANet/" target="_blank">https://www.facebook.com/KICTANet/</a>
Domain Registration sponsored by <a class="m_2586334980384523942m_3716395938510396906moz-txt-link-abbreviated" href="http://www.eacdirectory.co.ke" target="_blank">www.eacdirectory.co.ke</a>
Unsubscribe or change your options at <a class="m_2586334980384523942m_3716395938510396906moz-txt-link-freetext" href="https://lists.kictanet.or.ke/mailman/options/kictanet/michael%40pluspeople.dk" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/michael%40pluspeople.dk</a>
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
</pre>
</blockquote>
<br>
</div>
_______________________________________________<br>
kictanet mailing list<br>
<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
Domain Registration sponsored by <a href="http://www.eacdirectory.co.ke" rel="noreferrer" target="_blank">www.eacdirectory.co.ke</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com</a><br>
<br>
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="m_2586334980384523942gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Grace Mutung'u <br>Skype: gracebomu<br>@Bomu<br><span style="font-size:12.8px">PGP ID : 0x33A3450F</span><br></div><div><br></div></div></div></div></div></div></div>
_______________________________________________<br>
kictanet mailing list<br>
<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
Domain Registration sponsored by <a href="http://www.eacdirectory.co.ke" rel="noreferrer" target="_blank">www.eacdirectory.co.ke</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/mkawira2010%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/mkawira2010%40gmail.com</a><br>
<br>
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
</blockquote></div>