The Data Protection Act, 2019 (the “DPA” or the “Act”) which came into force on 25th November 2019 regulates how and when personal data can be obtained, handled or disposed. The DPA was enacted to give effect to Articles 31(c) and (d) of the Constitution. The two clauses guarantee the protection of the privacy of personal information and communication. In that regard, the DPA provides for principles of data protection, rights of a data subject, requirements for collecting personal data and restrictions on handling personal data.
Collection of data under the DPA is required to be strictly by informed consent of the data subject. The subject also has a right to be informed of the use to which the data is to be put. The DPA limits the use of the data to the purpose specified during the collection. In addition, the data subject must be informed whether the data collection is compulsory and any consequences of failing to provide any of the requested data.
Furthermore, the data subject has rights under the DPA to access, object, correct and delete false or misleading data held by any person. The DPA further requires that data must be collected directly from the data subject.
The DPA is going to impact on the rules of admissibility of evidence containing personal data. Evidence relied on in dispute resolution whether in litigation or alternative dispute resolution containing personal data risks exclusion for failure to comply with the provisions of the DPA.
Traditionally, the common law as applied by Kenyan Courts has always treated unlawfully obtained evidence as generally admissible as far as it is relevant to the proceedings before the court. Therefore, evidence obtained in contravention of the DPA would have been treated as admissible. However, court rulings in the recent past indicate a departure from the common law view on admissibility of illegally obtained evidence.
In the case of Njonjo Mue & another v Chairperson of Independent Electoral and Boundaries Commission & 3 others [2017] eKLR, the Supreme Court of Kenya departed from the broad view on admissibility of illegally obtained evidence. The Supreme Court expunged evidence obtained by the petitioner in contravention of the Access to Information Act, 2016. The court reasoned that if a legislation has specified a particular procedural or substantive requirement for obtaining evidence then those requirements must be strictly complied with. The court also recognized the constitutional imperative in Article 50(4) which requires exclusion of any evidence obtained in a manner that violates any rights or fundamental freedoms in the Bill of rights
The evidentiary implications of the DPA is that parties with disputes before court and tribunals will be required to collect evidence in strict compliance with the DPA since courts are mandated to follow the binding precedent in the above Supreme court ruling.
It is worth noting that there will be a tough balancing act between the rights the data subjects’ right to privacy and the necessity of using personal data to institute and defend claims in dispute resolution.
We shall keep you updated on the developments as courts tackle the issues arising out of the interpretation of the provisions of the DPA relating to the use of personal data in dispute resolution.
Please contact us at info@cfllegal.com should you require further information.
