<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><font face="Avenir-Book" style="font-size: 14px;" class="">Good morning Grace, </font><div class=""><font face="Avenir-Book" style="font-size: 14px;" class=""><br class=""></font></div><div class=""><font face="Avenir-Book" style="font-size: 14px;" class="">I don’t think the Office of the DPC is set up to be an independent office. That the DPC will be appointed by the CS is comparable to the elusive ‘independence of the Communication Authority’. The obvious concern is that this will water down the DPC’s watchdog powers when it comes to regulating the government as a controller and processor. The best the Office will be able to do is make recommendations to other government offices to comply with the Act. </font></div><div class=""><font face="Avenir-Book" style="font-size: 14px;" class=""><br class=""></font></div><div class=""><font face="Avenir-Book" style="font-size: 14px;" class="">Setting up a new body may also be a problem in the case of data protection. For context purposes, Acts that were passed in 2016 are just now being fully operationalised. Anything that requires the setting up of yet another government office has grave budgetary implications and unfortunately the restructuring takes quite some time. A legal framework on data protection is urgent- we don’t have the luxury of time. </font></div><div class=""><font face="Avenir-Book" style="font-size: 14px;" class=""><br class=""></font></div><div class=""><font face="Avenir-Book" style="font-size: 14px;" class="">Good discussion! </font></div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 29 Aug 2018, at 08:20, Grace Bomu via kictanet <<a href="mailto:kictanet@lists.kictanet.or.ke" class="">kictanet@lists.kictanet.or.ke</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:verdana,sans-serif">Good morning listers,</div><div class="gmail_default" style="font-family:verdana,sans-serif">The office of the data protection commissioner (DPC) is established as a state office and is expected to be independent. The DPC will however be appointed by the Cabinet Secretary, ICT. To qualify for the office, one needs to have extensive knowledge in data science, law, IT and related fields and meet requirements on leadership and integrity(Chapter six of the Katiba) <br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif">The functions of the DPC include: oversight and enforcement of the Act; registration of data processors and controllers; control over data processing activities; promotion of self regulation of actors; investigation of complaints; creation of awareness on the Act; ensure compliance with international obligations; research and related functions from other laws. <br class=""><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif">Powers of the DPC include: investigations; obtain professional assistance if need be; facilitate alternative dispute resolution; issue witness summons; request for information from persons governed by the bill. <br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif">Further, the DPC may request for data audits (clause 20); appointment of guardian for child online services (clause 29) <br class=""><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif">Apart from the usual sources of funds (allocation by Parliament, donations, grants etc) the bill also states that the office of DPC may be funded by funds accrued in performance of its functions. <br class=""><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif">Some public fears on creation of yet another public body are based on concerns about funding the body, an expectation that registration will mean paying for licences and that there is not sufficient capacity in the country to oversee data protection. The bill however only proposes that DPC issues certificates and does not mention registration fees. <br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif">To guide our discussion today, questions include: <br class=""></div><ol class=""><li class="">Are the functions and powers of the DPC adequate to implement the law? Are there any overboard provisions?</li><li class=""> Considering that the government is a major data processor and controller, is the office of the DPC as structured in the bill sufficiently independent? </li></ol><div class=""><br class="webkit-block-placeholder"></div><div style="font-family:verdana,sans-serif;display:inline" class="gmail_default">As usual, please point out any good or problematic clauses. <br class=""></div><div style="font-family:verdana,sans-serif;display:inline" class="gmail_default">Welcome to the discussion</div><br class=""><div class=""><br class="webkit-block-placeholder"></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br clear="all" class=""></div><br class="">-- <br class=""><div dir="ltr" data-smartmail="gmail_signature" class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="">Grace Mutung'u <br class="">Skype: gracebomu<br class="">@Bomu<br class=""><span style="font-size:12.8px" class="">PGP ID : 0x33A3450F</span><br class=""></div><div class=""><br class=""></div></div></div></div></div></div></div></div>
<br class=""><br class="">-- <br class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="">Grace Mutung'u <br class="">Skype: gracebomu<br class="">@Bomu<br class=""><span style="font-size:12.8px" class="">PGP ID : 0x33A3450F</span><br class=""></div><div class=""><br class=""></div></div></div></div></div></div><br class="">
_______________________________________________<br class="">kictanet mailing list<br class=""><a href="mailto:kictanet@lists.kictanet.or.ke" class="">kictanet@lists.kictanet.or.ke</a><br class="">https://lists.kictanet.or.ke/mailman/listinfo/kictanet<br class="">Twitter: http://twitter.com/kictanet<br class="">Facebook: https://www.facebook.com/KICTANet/<br class="">Domain Registration sponsored by www.eacdirectory.co.ke<br class=""><br class="">Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com<br class=""><br class="">The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br class=""><br class="">KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br class=""></div></blockquote></div><br class=""></div></body></html>