Breaking Down the Computer Misuse and Cybercrimes Act 2018 and the Data Protection Act 2019

In our increasingly digital world, understanding the laws that govern our online activities is essential.

Kenya has implemented two key pieces of legislation to address cybercrime and data protection: the Computer Misuse and Cybercrimes Act 2018 and the Data Protection Act 2019.

Computer Misuse and Cybercrimes Act 2018

This Act was established to combat cyber threats and ensure the safety of Kenya’s digital space.

It addresses offenses such as unauthorized access to computer systems, cyber harassment, identity theft, and cyber terrorism.

The primary objectives include:

• Protecting the confidentiality, integrity, and availability of computer systems, programs, and data.
• Preventing the unlawful use of computer systems.
• Facilitating the detection, investigation, and prosecution of cybercrimes.
• Upholding rights to privacy, freedom of expression, and access to information as guaranteed under the Constitution.
• Promoting international cooperation on cybercrime matters.

Understanding this Act is crucial for all Kenyans, as it outlines what constitutes cyber offenses and the penalties associated with them.

By familiarizing ourselves with these provisions, we can avoid unintentional breaches and contribute to a safer online environment.

Data Protection Act 2019

The Data Protection Act was enacted to give effect to Article 31(c) and (d) of the Constitution, which enshrines the right to privacy.

This Act provides a framework for the processing of personal data, ensuring that individuals’ privacy rights are upheld.

Key aspects include:

• Establishing the Office of the Data Protection Commissioner to oversee compliance.
• Outlining principles for data collection, storage, and sharing, including lawfulness, transparency, and purpose limitation.
• Providing rights to data subjects, such as access to their data, correction, and deletion.
• Mandating data controllers and processors to register with the Data Commissioner and adhere to data protection principles.
• Regulating the transfer of personal data outside Kenya to ensure adequate protection measures are in place.

For businesses and organizations, compliance with this Act is not optional.

It requires a commitment to data protection principles and the implementation of appropriate safeguards to protect personal data.

Why Does this Matter to You?

In October 2024, a notable case highlighted the importance of adhering to data protection laws. WPP Scangroup was ordered to pay damages for mishandling personal information, underscoring the serious consequences of non-compliance.

As individuals, being aware of our rights under these laws empowers us to take control of our personal data and understand the legal implications of our online activities.

For businesses, compliance is not only a legal obligation but also a demonstration of commitment to customer privacy and trust.

Taking Action

Education and sensitization are key to ensuring compliance and protecting against cyber threats.

Here are steps you can take:

• Stay Informed: Regularly update yourself on the provisions of these Acts and any amendments.
• Implement Best Practices: For organizations, ensure that data protection policies are in place and that staff are trained on cybersecurity measures.
• Exercise Your Rights: As a data subject, know your rights under the Data Protection Act and how to exercise them.

By taking these steps, we can collectively contribute to a secure and privacy-respecting digital environment in Kenya.

For more detailed information, you can access the full texts of the Computer Misuse and Cybercrimes Act 2018 and the Data Protection Act 2019.