Kenya's Data Law Follows Your Company Across the Border

A software company in Berlin launches a fitness app that becomes popular in Nairobi. A fintech in Lagos lends to borrowers in Kisumu through a mobile platform. An artificial intelligence start-up in San Francisco trains its models on images uploaded by users around the world, including thousands in Kenya. None of these companies has an office in Kenya, and each assumes that its data protection obligations are governed by the law of its home country.

That assumption is mistaken. The Data Protection Act 2019 was drafted to follow personal data, not corporate addresses. A company that processes the personal data of people in Kenya may be subject to Kenyan law, to the Kenyan regulator and to the Kenyan courts, wherever it is incorporated and wherever its servers are located. The Worldcoin litigation has shown that the Kenyan courts are prepared to enforce that reach against foreign companies.

What the Act says

The territorial scope of the Act is set out in section 4. The Act applies to the processing of personal data by a data controller or data processor who is established or ordinarily resident in Kenya and processes personal data while in Kenya, and also by one who is not established or ordinarily resident in Kenya but processes the personal data of data subjects located in Kenya.¹

The second limb is the one that matters for foreign companies. It contains no requirement that the company be registered in Kenya, have staff here, or use equipment here. The trigger is simply that the data subjects are located in Kenya.

Wider than the GDPR

The breadth of the Kenyan test becomes clear when it is compared with the European Union's General Data Protection Regulation, on which much of the Act is modelled. The GDPR applies to a controller or processor not established in the Union only where its processing relates to offering goods or services to data subjects in the Union, or to monitoring their behaviour there.² Those conditions build in a requirement of targeting: a foreign company is caught because it has chosen to engage with people in Europe.

Section 4 of the Kenyan Act contains no comparable qualification. On its face, any processing of the personal data of a person located in Kenya is enough. That breadth raises questions the Act does not answer. It is unclear whether a foreign website that incidentally records the IP addresses of visitors from Kenya is caught, or whether a Kenyan who travels abroad remains a data subject located in Kenya while using a service there. The test also turns on location rather than nationality, so a foreign visitor in Nairobi may be protected while a Kenyan living in London may not. Until the courts or the regulator provide guidance, foreign companies with any meaningful Kenyan user base should assume that the Act applies to them.

What follows from being caught

A foreign company within the Act takes on the full range of obligations that apply to Kenyan companies. It must register with the Data Commissioner before acting as a data controller or processor, subject to registration thresholds that the Commissioner may prescribe.³ It must comply with the data protection principles, process personal data only on a lawful basis, and carry out a data protection impact assessment before any processing that is likely to result in a high risk to the rights and freedoms of data subjects.⁴

Transfers of personal data out of Kenya are restricted. Personal data may be transferred abroad only where the controller or processor has given proof to the Data Commissioner of appropriate safeguards, or where the transfer is necessary for one of the purposes listed in the Act, such as the performance of a contract or the establishment of a legal claim. Sensitive personal data, which includes biometric data, may be transferred only with the consent of the data subject and on confirmation of appropriate safeguards, and the Commissioner may prohibit, suspend or impose conditions on a transfer.⁵ The Act also empowers the Cabinet Secretary to prescribe that certain processing take place only through a server or data centre located in Kenya, on grounds of the strategic interests of the State or the protection of revenue.⁶

Worldcoin: extraterritorial reach in practice

The Worldcoin case is the clearest demonstration of how the Act applies to foreign companies. The project collected iris and facial scans from Kenyans using a device known as the Orb, offering cryptocurrency tokens in return. The respondents included companies incorporated in the United States, Germany, the Cayman Islands and the British Virgin Islands, together with a Kenyan marketing agent.

The High Court found that the respondents had collected and processed sensitive personal data without first registering as data controllers or processors as section 18 requires, without an adequate data protection impact assessment, and without a lawful basis for processing. It held that consent obtained by offering cryptocurrency was neither free nor properly informed, and that biometric data had been transferred to servers outside Kenya without evidence of compliance with the Act's requirements on cross-border transfers. It also noted that the respondents had continued to process data despite directions from the Data Commissioner to stop. The court issued orders of prohibition and certiorari, and an order of mandamus compelling the foreign respondents to delete the biometric data collected from Kenyans within seven days, under the supervision of the Data Commissioner.⁷

Notably, the foreign respondents did not succeed in arguing that the Act did not apply to them. Their principal objections concerned the applicants' standing, the exhaustion of remedies before the Data Commissioner and the manner of service, and each of those objections failed.

Who can bring a complaint

The Act gives a data subject who is aggrieved by a decision under it the right to complain to the Data Commissioner, and requires the complaint to be investigated and concluded within ninety days.⁸ The High Court has held, however, that the statutory complaints mechanism is open only to data subjects, who must be identifiable natural persons, so that organisations acting in the public interest cannot be required to exhaust it before going to court.⁹ Foreign companies therefore face two parallel exposures in Kenya: individual complaints to the regulator, and public interest litigation in the High Court brought under the Constitution's broad standing provisions.

The consequences of non-compliance

The Data Commissioner may issue enforcement notices and penalty notices. The maximum administrative fine is five million shillings or, in the case of an undertaking, one per cent of its annual turnover, whichever is lower.¹⁰ A person who suffers damage, including financial loss or distress, because of a contravention of the Act is entitled to compensation from the data controller or processor responsible.¹¹ Decisions of the Commissioner may be appealed to the High Court.¹²

For a large multinational, the capped administrative fine may appear modest. The real exposure lies elsewhere: in compensation claims brought by data subjects, possibly on a representative basis; in court orders requiring data to be deleted or processing to stop; and in the reputational consequences of being found to have processed the data of Kenyans unlawfully.

The enforcement gap

The Act's extraterritorial reach is not matched by an equivalent reach in enforcement. A Kenyan court can order a company in the Cayman Islands to delete data held on servers in Germany, but it cannot easily compel compliance if the company chooses to ignore the order and has no assets or operations in Kenya. In the Worldcoin case, compliance appears to have followed, because the company wished to continue operating in Kenya and in other markets where regulators were watching. A company with no such interest may prove harder to reach.

That gap should not reassure foreign companies too much. Kenyan regulators increasingly cooperate with counterparts abroad, payment and telecommunications channels within Kenya can be subject to Kenyan orders, and any company that hopes to grow in Kenya will eventually need a presence here that brings it within practical reach.

What foreign companies should do

A foreign company that processes the personal data of people in Kenya should begin by mapping that data: what it collects, from whom, for what purpose and where it is stored. It should then determine whether it must register with the Data Commissioner, identify a lawful basis for each processing purpose, carry out an impact assessment for any high-risk processing, and document the safeguards that support any transfer of data out of Kenya. Consent mechanisms deserve particular care, because the Worldcoin judgment shows that consent obtained through inducements, bundled across several purposes or given on an operator's prompting will not satisfy the Act.

The internet has made it easy to collect data across borders. Kenya's data protection law ensures that the obligations travel with it.

Benson Odiwuor is a Nairobi-based dispute resolution lawyer and researcher in internet jurisdiction, who handles dispute resolution in cross-border digital, data protection and online reputation matters. He is also the editor of The BOLD, a legal newsletter focusing on dispute strategies and legal developments in the regulated industries of Kenya. Subscribe to The BOLD here.

For inquiries, contact the author at info@bensonodiwuor.com.