- KICTANet - KICTANet

Re: [kictanet] INVITATION: Conference on the Frameworks for Digital Market in Kenya
by JOEL CENAS OJUNG'A 03 Sep '18

03 Sep '18

Interested. On Sep 3, 2018 08:38, "Dr. Thomas A. Senaji via kictanet" < kictanet(a)lists.kictanet.or.ke> wrote: I would like to attend Kind regards Thomas On Mon, 3 Sep 2018, 10:27 Liz Orembo via kictanet, < kictanet(a)lists.kictanet.or.ke> wrote: > Greetings listers, > > > Konrad Adenaeur Stifung (KAS) and KICTAnet are organizing a two-days > conference on digital markets in Kenya, on 13th and 14th September, 2018. > > > We thought it would be of interest to some of you and reserved a few > slots. If you would like to attend the event, please reply of list for more > details. > > > Asanteni. > -- > > Best regards. > Liz. > > PGP ID: 0x1F3488BF > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > Twitter: http://twitter.com/kictanet > Facebook: https://www.facebook.com/KICTANet/ > Domain Registration sponsored by www.eacdirectory.co.ke > > Unsubscribe or change your options at https://lists.kictanet.or.ke/ > mailman/options/kictanet/tsenaji%40gmail.com > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > _______________________________________________ kictanet mailing list kictanet(a)lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke Unsubscribe or change your options at https://lists.kictanet.or.ke/ mailman/options/kictanet/ojayc19%40gmail.com The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development. KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.

1 0

Day 8: Policy and Regulatory Framework on Privacy and Data Protection- Key issues
by Grace Bomu 31 Aug '18

31 Aug '18

Dear listers, During the discussion on the draft data protection policy and bill, a summary of issues includes: - Listers recommended that the policy be expanded to look not only into data privacy but also issues to enable a privacy respecting data economy such as skills gap, standards, public funded data, data centers etc. - L isters appreciated the principles for data protection as provided for in the bill and called for ways of translating them into privacy promoting practices within the data economy. For example, there was advocacy for inculcation of data minimisation. - Concerns were raised that if proper mechanisms were not put in place, there was a risk of small data holders such as MSMEs not being able to comply and the bill being a risk to innovation and growth. - Data subject rights as provided for in the bill were viewed as progressive. While there was debate on whether the right to be forgotten should be absolute, listers recommended for this right with regard to research data as well as data about children. - While discussing data processors and controllers, listers debated on data sovereignty and data residency and gave input on how Kenya could be better facilitative of a local data economy. Listers also mused on decisions made through automated means and how developments in artificial intelligence impacted on personal privacy. - On offences, some listers thought that they were not reflective of data economy activities and that while they may be punitive to small players, they were lenient for larger ones. Hence they recommended graduated penalties. Listers also recommended for civil remedies to injured persons under this law. Further, areas that did not have specified penalties, for example not notifying a data subject in case of a breach, were flagged out. - The proposed institutional framework- office of the DPC came with concerns on financing the office, powers of the DPC as well as independence of the office. - Finally, on exemptions, there was a recommendation for more specificity to avoid eating into privacy of data subjects. We shall translate these points, together with those shared during the face to face forum at Strathmore University into submissions to the Task Force. We appreciate all those who gave input, asked questions and followed the discussion to learn. Please point out other areas we may have missed in this summary and ask your questions- At least two members of the Task Force are here to attend to you. -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F

2 2

Day 7: Policy and Regulatory Framework on Privacy and Data Protection- Exemptions
by Grace Bomu 30 Aug '18

30 Aug '18

Good morning listers, Today we look at other issues in the draft bill that we missed during the discussions. One is the question of exemptions, which are provided for in part vii. The grounds listed for exemption from the provisions of the Act are: national security and public order concerns, lawful disclosure, prevention of crimes, apprehension or prosecution of an offender and assessment or collection of tax. Interestingly, the draft empowers the cabinet secretary to determine national security and public order concerns. (clause 47(3)) Journalism, literature and the arts are also exempted from the principles of data protection. Where a publication is in public interest, the publisher is only required to comply with the relevant code of ethics. Processing and further processing for research, history and statistical purposes is also exempted from the principle of collecting data for a specified purpose. Although the proposed law gives a safeguard through the principle that data must eventually be destroyed, it does not give guidelines on time periods - it states that research data may not be kept indefinitely. Again, the CS is empowered to prescribe further instances when data may be exempted from provisions of the law (clause 50) Finally listers, there are general exemptions in clause 2 of the bill. The law will not apply to sharing of information among government departments/ public sector agencies or to processing by an individual for purely personal business (this is the personal phonebook exemption) Part of public reaction to this draft was that the bill gives with one hand and takes away with the other. Is this an exaggerated view and if so, how can this be cured in the draft? Are there other ways of dealing with the concerns raised in the exemptions (eg national security) without taking away data subject rights? Ultimately, should any data processor/controller be exempt from protecting data? Also, are there other useful exemptions that we are missing? Please share your thoughts on this issue and any other issue from the draft bill. -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F

3 3

Day 6: Policy and Regulatory Framework on Privacy and Data Protection- Institutional Framework
by Grace Bomu 30 Aug '18

30 Aug '18

Good morning listers, The office of the data protection commissioner (DPC) is established as a state office and is expected to be independent. The DPC will however be appointed by the Cabinet Secretary, ICT. To qualify for the office, one needs to have extensive knowledge in data science, law, IT and related fields and meet requirements on leadership and integrity(Chapter six of the Katiba) The functions of the DPC include: oversight and enforcement of the Act; registration of data processors and controllers; control over data processing activities; promotion of self regulation of actors; investigation of complaints; creation of awareness on the Act; ensure compliance with international obligations; research and related functions from other laws. Powers of the DPC include: investigations; obtain professional assistance if need be; facilitate alternative dispute resolution; issue witness summons; request for information from persons governed by the bill. Further, the DPC may request for data audits (clause 20); appointment of guardian for child online services (clause 29) Apart from the usual sources of funds (allocation by Parliament, donations, grants etc) the bill also states that the office of DPC may be funded by funds accrued in performance of its functions. Some public fears on creation of yet another public body are based on concerns about funding the body, an expectation that registration will mean paying for licences and that there is not sufficient capacity in the country to oversee data protection. The bill however only proposes that DPC issues certificates and does not mention registration fees. To guide our discussion today, questions include: 1. Are the functions and powers of the DPC adequate to implement the law? Are there any overboard provisions? 2. Considering that the government is a major data processor and controller, is the office of the DPC as structured in the bill sufficiently independent? As usual, please point out any good or problematic clauses. Welcome to the discussion -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F

3 4

Day 5: Policy and Regulatory Framework on Privacy and Data Protection- Offences and Remedies
by Grace Bomu 28 Aug '18

28 Aug '18

Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created: *Offence * *Penalty * Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3)) General penalty under clause 59: 5 million shillings fine or 5 years imprisonment or both plus possible forfeiture of equipment and prohibition order Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7)) General penalty unlawful processing of personal data (clause 27) 5 million shillings fine or 5 years imprisonment Unlawful processing of sensitive personal data (part v) 5 million shillings fine or 5 years imprisonment Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3)) General penalty Disclosure of personal data by controller against specified purpose (clause 58 (1)) General penalty Disclosure of personal data by processor without authority of controller (clause 58 (2)) General penalty Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a)) General penalty Disclosure to a third party (clause 58 (3) (b)) General penalty Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4)) General penalty The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course) Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor? Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion. -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F

6 8

Day 2- Policy and Regulatory Framework on Privacy and Data Protection
by kanini mutemi 28 Aug '18

28 Aug '18

Day 2- Rights of Data Subjects Good morning Listers, Day 1 we commented on the principles of data protection mentioned in the draft policy and bill. Today, we will look at the rights of data subjects. For demonstration purpose, when you fill in your details at a mobile money agent’s shop– You- data subject The mobile money agent- data processor The data subject is the person to whom the data concerns. Here are the rights as listed in Clause 23 of the Bill. I have added comments underneath to help us visualise what these rights would mean in the future. 1. The right to be informed of the use to which the personal data is to be put Eg. When we leave our details at the entrance to buildings, I expect that they will explain what the data will be used for. 2. Right to access their personal data in custody of data controller Will we be able to demand from our mobile network operators to see our account details and transactional history? 3. Object to the collection or processing of all or part of their personal data Will we be able to opt out of the biometric ID registration proposed by the Ministry of ICT here <https://www.businessdailyafrica.com/economy/Biometric-IDs-listing-set-for-t…>? 4. Correction and deletion of false or misleading data Are we ready for a right to be forgotten? Should it be absolute? What do we think of these Listers? Are there other rights that ought to be included?

8 10

Day 4: Policy and Regulatory Framework on Privacy and Data Protection- Data Controllers and Processors
by Grace Bomu 28 Aug '18

28 Aug '18

Good morning listers! Welcome to data protection bill/policy discussions. Last week, we went through the principles of data protection and rights of data subjects. We covered the right to privacy in its different forms including the right to be forgotten and consent. Today, we shift gears a bit and consider the issue of data protection from the point of the *processor and controller*. The bill defines a controller as one who designs data processing and the processor as one who collects, stores, retrieves , discloses, erases etc on behalf of a controller. General obligations for controllers and processors are listed in part IV and they include upholding the principles of data protection, protecting the rights of the data subject, duty to notify the subject about processing and breaches, acquisition of consent and security safeguards as regards personal data. It would be interesting to hear from data controllers and processors, views on: 1. restrictions on processing personal data (clause 30) where processors may not process data objected by the data subject or which has legal claims.What are the practical implications of restrictions? For example, if one company or government agency received a large number of objections in one period? 2. the protection of data subjects from profiling (clause 31). While we have seen negative effects of profiling during the political season, are there positives of profiling that could benefit the data subject and does this bill adequately balance both ends? 3. the bill makes it mandatory to notify data subjects in case of breach. How will this change sectors such as banking where issues of data breaches are never discussed with customers or the public in order to protect the confidence of the industry? 4. Finally, on the issue of sensitive personal data, which is subject to higher protection. Sensitive personal data includes person’s race, health status, ethnic social origin, political opinion, belief, personal preferences, location, genetic data, biometrics, sex life or sexual orientation. What are the practical implications for existing data sets held by for instance the registrar of persons, universities, schools, insurance companies etc? Is the list proposed by the bill exhaustive? The Senate bill for example defines categories such as trade union membership as sensitive data. Welcome to the discussion. Please point out any issues in the bill that are either very good and should be retained or problematic and should be improved. Tujadiliane. -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F

7 10

Day 1- Policy and Regulatory Framework on Privacy and Data Protection
by kanini mutemi 28 Aug '18

28 Aug '18

Day 1- Principles of Data Protection Dear Listers, As GG had indicated on Monday, we will hold online moderated discussions on the policy and regulatory framework on privacy and data protection. I will kick us off with a discussion on the proposed principles of data protection (Part 5 of the draft policy and Part IV of the draft bill). There are seven proposed principles– (a) Fairness, lawfulness and transparency (b) Purpose limitation (c) Data minimisation (d) Storage limitation (e) Accuracy (f) Confidentiality and Integrity (g) Accountability To begin with, I welcome comments on -what is your first impression of the principles? -why do we need to set out principles? -are the principles clearly defined in the draft policy and bill? Tujadiliane! -- Mercy Mutemi.

8 11

Data Protection and GDPR Training
by Mercy Njue 27 Aug '18

27 Aug '18

Dear Listers, Botlab is offering in house trainings on Data protection and GDPR. We customise the trainings based on organisations need assessments. If you would like to know more, or request for a quote, feel free to contact us. [image: BOTLAB Data protection and GDPR Poster.jpeg] -- Mercy Njue Founder Botlab Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor Office line: +254 700 915197 Email: Mercy(a)botlab.biz *Endless possibilities :* www.botlab.biz *"* What we are is God's gift to us. What we become is our gift to God. - Eleanor Powell

3 2

Pilots, Pivots, Innovation and the corporate crutch
by Mbugua Njihia 27 Aug '18

27 Aug '18

Models of production and consumption are changing the world over. New market segments are also opening up due to the availability of broader choice and wallet capacity, driving lifestyle decisions. To this end many startups are emerging across industries either rethinking traditional ways of work or building out entirely new ways to create and present value. These tectonics can happen slowly or come as a short, sharp shock. Having been part of the start-up scene for many years in different capacities, I have noted the transition from the initial David and Goliath narrative where it was the start-up entrepreneur and team against the corporate juggernauts in a winner takes all, to one of partnership and collaboration albeit measured and cautious for the most part. The realization that both the incumbent and start-up need each other, especially so in emerging markets where greenfield opportunities would deliver terrific returns on investment on the back of new and stable technology and sometime low regulatory barriers is refreshing. Full thought - http://www.mbuguanjihia.com/business/pilots-pivots-innovation-and-the-corpo… *Regards,* Mbugua Njihia ᐧ

1 0

(no subject)
by Davidson Thaba 24 Aug '18

24 Aug '18

Hi I see see see

2 1

Re: [kictanet] Invitation to Data Protection Forum and Submission of Comments to Kenya Data Protection Bills (Thursday 23 August, 2018)
by Ephraim Percy Kenyanito 22 Aug '18

22 Aug '18

Dear partner , Greetings from ARTICLE 19 Eastern Africa. ARTICLE 19 in partnership with the *Centre for Intellectual Property and Information Technology*Law (*CIPIT*- Strathmore University Law School) and Kenya ICT Action Network (KICTANET) seek to convene a one day Data Protection Dialogue Forum from *8**am – 5:30pm*on /*Thursday 23 August, 2018). */ While, the Constitution of Kenya, 2010 guarantees freedom of expression and the right to privacy, under Article 31 and 33; Kenya lacks a legally binding comprehensive data protection framework while also retaining laws which are broad and can be used to infringe on privacy on citizen data. The lack of a comprehensive data protection law and existence of laws that can be broadly interpreted to allow for free collection of personal data, storage, usage, and dissemination to other parties has created a situation where citizens are not notified whenever their data is collected and do not have remedies whenever their data is breached on unnecessarily retained by both public and private actors. We note that the ICT committees of the Senate led by Hon Gideon Moi has drafted a Data Protection Bill 2018 and similarly, the Ministry of ICT Taskforce on the Development of the Policy and Regulatory Framework for Privacy and Data Protection in Kenya, chaired by Communications Authority’s Mercy Wanjau has developed a Policy and a draft Data Protection Bill aimed at a Regulatory Framework for Privacy and Data Protection in Kenya and to fill this gap. Please find below the links to the Data Protection Policy and Ministry Bill and the Senate Bill. http://jadili.ictpolicy.org/docs/privacy-and-data-protection-policy-and-bil… http://jadili.ictpolicy.org/docs/the-data-protection-bill,-2018-ch9IKrCm It is with this in mind that the 3 partner organizations and will be meeting multiple data protection experts, lawyers, academia/ data scientists, CSOs, journalists and bloggers to collate recommendations for policy reform on from *8**am – 5:30pm*on /*Thursday 23 August, 2018)*/at Strathmore Law School. Kindly confirm your availability at your earliest convenience to _ephraim(a)article19.org <mailto:[email protected]>_ Please note that even though you might not be able to participate physically, you can nominate a representative or comment on this bills and Policy via the links above. We look forward to your participation. Best regards, -- Best Regards, Ephraim Percy Kenyanito Digital Programme Officer *ARTICLE 19 EASTERN AFRICA * *DEFENDING FREEDOM **OF EXPRESSION AND INFORMATION* W _https://www.article19.org/regional-office/eastern-africa/ _Tw @article19eafric Fa_facebook.com/article19org <http://facebook.com/article19org> _PGP Fingerprint: B0FA394AF73DEB7AA1FDC7360CFED26DE6BA8DC1

2 2

Re: [kictanet] Day 1- Policy and Regulatory Framework on Privacy and Data Protection
by Kiarie Wagitungo 22 Aug '18

22 Aug '18

Dear Kanini, I am still reading the law. It takes time. But I am wondering, is consent a principle? I hope it is captured in the bill. Yours, Gerishon On Wednesday, 22 August 2018, kanini mutemi <kaninimutemi(a)gmail.com> wrote: > > > ---------- Forwarded message --------- > From: kanini mutemi <kaninimutemi(a)gmail.com> > Date: Wed, 22 Aug 2018 at 09:11 > Subject: Day 1- Policy and Regulatory Framework on Privacy and Data > Protection > To: > > Cc: Mercy Sumbi <mercy(a)mutemisumbi.com> > > > *Day 1- Principles of Data Protection * > > Dear Listers, > > As GG had indicated on Monday, we will hold online moderated discussions > on the policy and regulatory framework on privacy and data protection. I > will kick us off with a discussion on the proposed principles of data > protection (Part 5 of the draft policy and Part IV of the draft bill). > > There are seven proposed principles– > > > > > > > > *(a) Fairness, lawfulness and transparency(b) Purpose limitation(c) Data > minimisation (d) Storage limitation (e) Accuracy(f) Confidentiality and > Integrity (g) Accountability* > To begin with, I welcome comments on > > *-what is your first impression of the principles?* > > *-why do we need to set out principles?* > > *-are the principles clearly defined in the draft policy and bill?* > > Tujadiliane! > -- > *Mercy Mutemi.* > > -- > *Mercy Mutemi, Advocate*. > > > >

1 0

Fwd: IBM Digital - Nation Africa!
by John Matogo 21 Aug '18

21 Aug '18

Dear colleagues, This learning platform maybe of interest to you and others you may know. Lots of comprehensive content in blockchain, AI and many more. Happy learning! This message contains graphics. If you do not see the graphics, *click here to view* <http://links.ibmdeveloperworks.mkt6741.com/servlet/MailView?ms=MzM2Nzg3NDQS…> . [image: Welcome to Digital - Nation Africa!>] Greetings, I am pleased to share with you IBM's Digital-Nation Africa program (D-NA). With D - NA, you can expand your skills on emerging technologies such as *cloud, Artificial Intelligence, IoT, blockchain*, and more. You get a sanbox where you can apply what you learn and build your own intelligent chatbot, AI app, blockchain app or robot. Registration is free just click here: http://www.digitalnationafrica.com/ *All courses are free, and you can access them anytime, anywhere.* For every course you successfully complete, an IBM Digital Badge will be issued, which you can share on social media platforms like LinkedIn. *More importantly, as a registered D - NA user, you are entitled to a free IBM Cloud Lite account.* With IBM Cloud Lite <http://links.ibmdeveloperworks.mkt6741.com/ctt?kn=6&ms=MzM2Nzg3NDQS1&r=NzMy…>, you get quick and easy access to *more than 170 services* that can help you rapidly build your cloud apps (*no credit card is required, and the account never expires).* [image: IBM Cloud] <http://links.ibmdeveloperworks.mkt6741.com/ctt?kn=6&ms=MzM2Nzg3NDQS1&r=NzMy…> Get started! <http://links.ibmdeveloperworks.mkt6741.com/ctt?kn=3&ms=MzM2Nzg3NDQS1&r=NzMy…> or Copy this link: http://www.digitalnationafrica.com/ in your browser Share this opportunity with your contacts. Have a question? <http://links.ibmdeveloperworks.mkt6741.com/ctt?kn=14&ms=MzM2Nzg3NDQS1&r=NzM…> We are so glad you could join us! *Your Digital – Nation Africa team* John Matogo skype: jmatogo Twitter: @jmatogo Mobile: +254 722 813 533 LinkedIn: http://tinyurl.com/avcn7qu

1 0

Online moderated discussion on the Policy and Regulatory framework on Privacy and Data Protection
by Grace Githaiga 20 Aug '18

20 Aug '18

Good afternoon Listers As a follow up to an earlier email where I shared the _Policy and Regulatory Framework on Privacy and Data Protection _ (https://www.kictanet.or.ke/?wpdmpro=policy-and-regulatory-framework-on-priv…) I wish to invite all listers to participate in the online moderated debate which will take place over a period of seven days. The Data and Privac framework was developed by a task force constituted by the Minister of ICT in May. Our Grace Bomu and Mercy Mutemi will lead us in the discussion starting which will commence on Wednesday August 22, 2018. Please see the proposed schedule. We look forward to your active participation. Asanteni sana. Date Topic 20 Aug Intro to list * Structure of the discussion * Reference to DP brief Wed 22 Aug Principles of data protection Thur 23 Aug Rights of data subjects Friday 24 Aug Rights of data subjects: II Monday 27 Aug Obligations of processors and controllers Tues 28 Aug Offences and remedies Wed 29 Aug Institutional framework Thur 30 Aug Comments for Way Forward Fri 31 Aug Key findings Best regards Githaiga, Grace Co-Convenor Kenya ICT Action Network (KICTANet) Twitter:@ggithaiga Tel: 254722701495 Skype: gracegithaiga Alternate email: ggithaiga(a)hotmail.com Linkedin: https://www.linkedin.com/in/gracegithaiga www.kictanet.or.ke "Change only happens when ordinary people get involved, get engaged and come together to demand it. I am asking you to believe. Not in my ability to bring about change – but in yours"---Barrack Obama.

1 1

How China is working to overtake the internet and butt heads with the U.S. - Axios
by WANGARI KABIRU 18 Aug '18

18 Aug '18

2 1

Introduction to Network Operations course- Free online course
by Mercy Njue 18 Aug '18

18 Aug '18

Greetings, Botlab has partnered with ISOC to offer a free online course- Introduction to Network Operations course ( September Cohort Registration). The courses are free and anyone can apply. Those who complete this course will be allowed to take on the Network service and monitoring course. If you are interested, check the links below: *Introduction to Network Operations course * Course outline and prerequisites click here <https://isoc-inforum.afrinic.net/wiki/tiki-index.php?page=Introduction%20to…> Sign up sheet, click here <https://docs.google.com/forms/d/e/1FAIpQLSeq-stz_l6BC6SFYJzFByHa9Jz_DdEusP9…> *Network Services and Monitoring course* Course outline and prerequisites click here <https://isoc-inforum.afrinic.net/wiki/tiki-index.php?page=Network%20Service…> -- Mercy Njue Founder Botlab Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor Office line: +254 700 915197 Mobile: +254 729758 701 Email: Mercy(a)botlab.biz *Endless possibilities :* www.botlab.biz *"* What we are is God's gift to us. What we become is our gift to God. - Eleanor Powell

2 1

Telcos CEOs on the spot in push to declare Safaricom dominant
by Ali Hussein 18 Aug '18

18 Aug '18

Listers This talk of Dominance is getting tiring.. Telco CEOs on the spot for pushing Safaricom Dominance narrative <https://www.businessdailyafrica.com/economy/Telcos-CEOs-on-the-spot-in-push…> Regards *Ali Hussein* *Principal* *AHK & Associates* Tel: +254 713 601113 Twitter: @AliHKassim Skype: abu-jomo LinkedIn: http://ke.linkedin.com/in/alihkassim <http://ke.linkedin.com/in/alihkassim> 13th Floor , Delta Towers, Oracle Wing, Chiromo Road, Westlands, Nairobi, Kenya. Any information of a personal nature expressed in this email are purely mine and do not necessarily reflect the official positions of the organizations that I work with.

14 30

Kenya Wins Top Africa ICT seat
by Alwala, Rachel 18 Aug '18

18 Aug '18

Dear listers, Kenya’s Mr. John Omo has today been elected the new Secretary General of the African Telecommunications Union (ATU). Out of the 26 votes, Mr.Omo garnered 23 beating his sole challenge, Burundi’s Mr. Constaque Hakizimana who managed two (2) votes at elections held today during the 5th Ordinary Session of the ATU Plenipotentiary Conference in Nairobi. One vote was spoilt. Attached is the press release on the same as well as the Nairobi Declaration by the African menus states at the end of the ATU Plenipotentiary Conference today. Attached too are images of Mr.Omo giving his acceptance speech and receiving the instruments of office from the outgoing Secretary general Mr.Abdoulkarim Soumaila We thank you for your continued support. I Regards, Rachel

8 7

Re: [kictanet] Kenya Wins Top Africa ICT seat
by ceo 18 Aug '18

18 Aug '18

Congrats Mr. Omo! May God give you wisdom in your new position. Regards, Abdalla On Aug 17, 2018 10:18 PM, "Alwala, Rachel via kictanet" <kictanet(a)lists.kictanet.or.ke> wrote: > > Dear listers, > > Kenya’s Mr. John Omo has today been elected the new Secretary General of the African Telecommunications Union (ATU). > > Out of the 26 votes, Mr.Omo garnered 23 beating his sole challenge, Burundi’s Mr. Constaque Hakizimana who managed two (2) votes at elections held today during the 5th Ordinary Session of the ATU Plenipotentiary Conference in Nairobi. One vote was spoilt. Attached is the press release on the same as well as the Nairobi Declaration by the African menus states at the end of the ATU Plenipotentiary Conference today. > > Attached too are images of Mr.Omo giving his acceptance speech and receiving the instruments of office from the outgoing Secretary general Mr.Abdoulkarim Soumaila > > We thank you for your continued support. I > >

1 0

Why local funding is critical for ICT projects
by S.M. Muraya 17 Aug '18

17 Aug '18

Last week Walu penned some very pertinent thoughts (will create a second thread for that article). The current one is somehow related https://www.nation.co.ke/oped/blogs/dot9/walubengo/Why-local-funding-critic… Quote: "What is this that foreign investors see in our ICT potential that local investors don’t? Additionally, what are the ‘strings’ attached, which more often than not go hand in hand with foreign money... our typical local investor is only interested in the traditional assets.." Reality: We (veterans in ignoring/undermining each other) did not model decency for upcoming talent and now they worship foreigners who due to cultural differences (misunderstanding) cannot move our nation forward. https://businesstech.co.za/news/cloud-hosting/251373/amazon-and-microsoft-t… Case in point, why do excellent multi nationals (e.g. Microsoft, Amazon) favor South Africa for data centers? In South Africa there is an efficient, creative (primarily white) minority population which does not undermine (deceive) itself as much as we do. To conclude, last year, a well spoken, well presented employer/investor (former high school mate of mine 25+ years ago) was shocked by Kenyans in their early twenties. He conducted a research for one of his clients and 24 out of 26 lied in their submissions. That is all.

4 4

Why the Digital ID project is important
by S.M. Muraya 17 Aug '18

17 Aug '18

Dear Listers, To avoid being tried (in future) for treason (selling/entrusting Kenyan bio-metric data to foreigners) our public officials need to ensure the Digital ID project is localized (managed/operated) by Kenyans (excluding dual citizens). Walu has described why the Digital ID project is important https://www.nation.co.ke/oped/blogs/dot9/walubengo/Digital-ID-project-raise… "Globally, this problem is known as an Identity Management problem and in Kenya, it has reached an acute stage and requires an urgent but carefully thought through approach to resolve.."

2 2

A survey on value added services for airtime credit and other mobile based micro credit
by Geoffrey Gitau 14 Aug '18

14 Aug '18

Dear Kictanet friends I am Dr Gitau Kamau and with my partner institution Infoholic we are conducting a interational survey to determine infographics on financial technologies (fintech) through mobile service providers value added services such as micro credit via mpesa among others. Kindly help me by completing attached questionnaire. Rgds Dr Gitau Kamau On Tue, 14 Aug 2018, 13:04 Mercy Njue via kictanet, < kictanet(a)lists.kictanet.or.ke> wrote: > Greetings, > > Botlab has partnered with ISOC to offer a free online course- Introduction > to Network Operations course ( September Cohort Registration). The courses > are free and anyone can apply. Those who complete this course will be > allowed to take on the Network service and monitoring course. > > If you are interested, check the links below: > > *Introduction to Network Operations course * > Course outline and prerequisites click here > <https://isoc-inforum.afrinic.net/wiki/tiki-index.php?page=Introduction%20to…> > Sign up sheet, click here > <https://docs.google.com/forms/d/e/1FAIpQLSeq-stz_l6BC6SFYJzFByHa9Jz_DdEusP9…> > > *Network Services and Monitoring course* > Course outline and prerequisites click here > <https://isoc-inforum.afrinic.net/wiki/tiki-index.php?page=Network%20Service…> > -- > Mercy Njue > Founder Botlab > > Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor > Office line: +254 700 915197 > Mobile: +254 729758 701 > Email: Mercy(a)botlab.biz > *Endless possibilities :* www.botlab.biz > > > > *"* What we are is God's gift to us. What we become is our gift to God. - > Eleanor Powell > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > Twitter: http://twitter.com/kictanet > Facebook: https://www.facebook.com/KICTANet/ > Domain Registration sponsored by www.eacdirectory.co.ke > > Unsubscribe or change your options at > https://lists.kictanet.or.ke/mailman/options/kictanet/gitaugk%40gmail.com > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. >

1 0

Re: [kictanet] Policy and Regulatory Framework on Privacy and Data Protection (Draft)
by Jimmy Gitonga 14 Aug '18

14 Aug '18

This is an excellent summary of the draft bill on Data Protection. Thank you Michael. While working on platforms that hold public information and register users through 3rd party authorisation applications, I suppose those types are exempted. But let me read the draft for myself :-D. With the best regards, Jimmy Gitonga > On 14 Aug 2018, at 12:00 PM, kictanet-request(a)lists.kictanet.or.ke wrote: > > Hi Listers, > > > > Have just finished the first read-through of this document, here are > my initial thoughts/questions/concerns (in no particular order) > > > > Registration fee > I am concerned that the registration-fee might be prohibitive for many > startup ICT businesses - especially since this is not just a cost that > is meant to cover the actual cost of processing the application, but > is intended to cover the entire cost of the office of the data > protection regulator (as mentioned in section 12.2). > > This may lead to a situation where many/most startups either stay > non-compliant with the law (in which case - then whats the point?), or > they may be unable to launch new innovation due to compliance-costs. > > > Reporting frequency > As mentioned in section 11.4 the data protection officer needs to make > regular compliance reports to "the office" but I could not find any > mention of what "regular" means - is it once a year, once a month or > ... It could be a rather significant administrative burden (especially > for a SME) so that there are no quantification of "regular" worries me > quite a bit. > > > Compliance levels > The way I see it a very high percentage of ICT startups would be > subject to this law, but I fear that very few will have the capacity > to actually become (and remain) compliant on this matter. > If compliance levels remain low then few consumers/end-users/customers > will be requesting compliant vendors or even aware of their rights > according to this law a negative circle will be created where no-one > expect compliance and hence no-one will offer it. > > > No Breach notification incentive > 8.2.6 and section 38.1 states that data controllers are obligated to > notify on breaches - this is good and probably the most important > element in my mind - accidents will happen but they key thing is that > affected people gets notified (and of-course that measures are taken > to prevent it happening again). > However section 70.1+2 tells us that a data-controller who "looses" > data will be committing an offense and subject to a fine of (max) > 10million kes. > > This sounds to me like there are absolutely NO incentive to report a > breach - in fact it kinda encourages data controllers to keep VERY > quiet about breaches and hope that no-one notices. > Would it not be smart to make so that if the breach was reported to > "the office" prior to "the office" receiving any complaints then any > subsequent fine/penalty would be discounted i.e. 50% - but it would be > 100% if no reporting had happened... > > I just fear that the main point of the exercise - to ensure that > people actually are aware if their data is "lost" and give them the > ability to react before someone exploits their data. > > > Training / capacity > I wonder what kind of training program would be available for all the > newly designated data protection officers. > How are we going to ensure that they get up to speed with this (new) > legislation fast (?) > > > Scope > Initially I thought that effectively every company in Kenya would have > to register (and pay registration fee) - as everyone would have > private data on their employees in some kind of "system" / HR-file. > Although my gut kinda told me that it is not the intention. > > However section 56(a) sounds like it would exclude data obtained in > relation to employment - Anyone else who have reached the same > conclusion on this ? > > > Our own house > Looking internally I am actually in doubt if our company would need to > register or not. > Our company builds and runs HR/Payroll management systems - and the > system does hold private data, because... that is kinda what the > system does ;-) > The reason that I am in doubt is when I read section 49(1)(c) where it > explicitly exempts data related to assessment of taxes - and this is > exactly what our system(s) does, so depending on how I read that we > could be exempt (?) - but somehow I get the feeling that 49(1)(c) is > intended specifically for government-bodies (read KRA) not private > entities.. So am a little confused. > > > Security by design > Section 5.3.4 dictates that systems should incorporate "security by > design", which is an absolutely great way to approach developing such > systems. > However from what I have seen being developed while interacting with > various SME's and startups "security by design" is not a principle > that very many apply, or even have on their "radar". > To make things worse unless you do a very close evaluation of the > actual systems and HOW they are developed it can be really hard to > determine if they utilize "security by design"... > All in all this sounds kinda like wishful thinking - If it's meant as > a way of creating awareness of "security by design" then great - but > can't really see it as a condition. > > > Kind regards > Michael Pedersen

1 0

Policy and Regulatory Framework on Privacy and Data Protection (Draft)
by Grace Githaiga 13 Aug '18

13 Aug '18

Dear Listers Please find the _Policy and Regulatory Framework on Privacy and Data Protection _here:__ https://www.kictanet.or.ke/?wpdmpro=policy-and-regulatory-framework-on-priv… This is a consolidated document containing the draft policy and law, as drafted by the Task Force on Data Protection, which was constituted by the Cabinet Secretary, Ministry of ICT in May. The Task Force is requesting for comments from the public, which should be submitted by September 12, 2018. Please feel free to share the document with your networks. Best regards Githaiga, Grace Co-Convenor Kenya ICT Action Network (KICTANet) Twitter:@ggithaiga Tel: 254722701495 Skype: gracegithaiga Alternate email: ggithaiga(a)hotmail.com Linkedin: https://www.linkedin.com/in/gracegithaiga www.kictanet.or.ke "Change only happens when ordinary people get involved, get engaged and come together to demand it. I am asking you to believe. Not in my ability to bring about change – but in yours"---Barrack Obama.

3 3