Outgoing Data Commissioner Immaculate Kassait highlights public awareness among her key achievements.
Outgoing Data Commissioner Immaculate Kassait highlights greater public awareness and institutional accountability, while urging action on AI and cross-border safeguards.
Outgoing Data Commissioner Immaculate Kassait has identified greater data protection awareness as a major achievement of her six-year tenure. She said the issue had moved from an unfamiliar regulatory concern into national discussion.
Reflecting on her leadership, Kassait said the Office of the Data Protection Commissioner (ODPC) helped people understand why personal information matters. It also challenged institutions that had previously faced little scrutiny over their handling of that information.
However, the regulator initially encountered resistance when it contacted organisations to demand compliance. Kassait recalled institutions questioning the office’s authority, before increasingly having to explain how they processed personal information.
Data protection complaints and penalties
Beyond public awareness, Kassait highlighted the office’s role in handling complaints and investigating alleged breaches. That work also included deciding what action to take against organisations that violated legal requirements.
She explained that the ODPC first assesses whether a complaint falls within its mandate before beginning investigations. When determining penalties, it considers the seriousness of the breach and whether an organisation has committed repeated offences.
The office also weighs the number of people affected and any steps taken to remedy a violation. Kassait described growing accountability over the collection and handling of personal information as another defining change during her tenure.
AI and cross-border safeguards remain priorities
Meanwhile, Kassait identified artificial intelligence as an emerging challenge requiring continued regulatory attention. She questioned whether organisations adequately inform people when they repurpose personal information to train or develop AI systems.
The ODPC has also issued AI guidance covering acceptable uses, organisational responsibilities and practices to avoid. Kassait said regulators need to keep pace with technological developments as they address these concerns.
She further argued that Kenya’s reliance on foreign technology infrastructure limits its control over personal information. In her view, limited domestic platforms and cloud capacity can weaken the country’s negotiating position with international technology companies.
Alongside those concerns, Kassait urged organisations to build privacy safeguards into digital products and services from the design stage. They should collect only the information necessary for their intended purpose, she said.
Despite the progress, she identified stronger legal and institutional arrangements for cross-border matters as unfinished work. Priorities include ratifying the Malabo Convention on Cyber Security and Personal Data Protection, alongside reforms to facilitate mutual legal assistance.
Kassait said digital data flows cannot be stopped. Instead, she emphasised responsible handling of personal information and appropriate safeguards to protect it.
