The Price of exclusion: an analysis of the inadequate inclusion of clear provisions on data sharing of sensitive personal data of data subjects in Kenya

Abstract

In Kenya, data sharing of sensitive personal data is provided for under sec 44 and 55 of the Data Protection Act (2019). The General Data Protection laws require that data subjects be accorded specific rights and interests while their sensitive personal data. However, there is a lack of a supporting framework to facilitate the inclusion of data subject’s rights such as ownership and self-determination rights. Failure to include these rights and interests will expose their data to misuse and abuse of their rights and freedoms. Furthermore, the legislative framework surrounding data sharing of sensitive personal data fails to clearly provide for obligations that data processors have while handling sensitive personal data of data subjects. This study will attempt to deconstruct the concept of informational self-determination as a principle and as a right of data subjects. Building on the existing data subjects rights under sec 25 of the Data Protection Act, this study asks; how can the principle of informational self-determination be incorporated in the legislative framework to ensure data sharing of sensitive personal data is effectively done without the misuse or abuse of the patient data. Based on the review on the existing literature relating to data sharing of sensitive personal data in Kenya, there is currently an insufficient framework that is contradictory and unclear to its aims with relation to data sharing of sensitive personal data. Nonetheless, the results of this study indicate that a framework that encompasses fundamental rights such as informational self-determination, data ownership and personal autonomy rights will serve as useful in ensuring no privacy breaches in data sharing of sensitive personal data. Failure to incorporate these rights and ensuring clarification of the same in the legislative framework surrounding data sharing of sensitive personal data will result in abuse and misuse by data processors.