Day 5: Policy and Regulatory Framework on Privacy and Data Protection- Offences and Remedies
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created: *Offence * *Penalty * Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3)) General penalty under clause 59: 5 million shillings fine or 5 years imprisonment or both plus possible forfeiture of equipment and prohibition order Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7)) General penalty unlawful processing of personal data (clause 27) 5 million shillings fine or 5 years imprisonment Unlawful processing of sensitive personal data (part v) 5 million shillings fine or 5 years imprisonment Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3)) General penalty Disclosure of personal data by controller against specified purpose (clause 58 (1)) General penalty Disclosure of personal data by processor without authority of controller (clause 58 (2)) General penalty Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a)) General penalty Disclosure to a third party (clause 58 (3) (b)) General penalty Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4)) General penalty The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course) Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor? Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion. -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
Good morning, The size of the data processor should have an effect on the magnitude of the fines. Although all offences are equal , all penalties can't be the same ,otherwise it would be an academic exercise really. Of say, an individual offender were fined large amounts ,then basically the option would be a jail term by default for many non-wealthy persons. On Tue, Aug 28, 2018, 9:56 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/jeffersonanyega%40gmai...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
The pro-rated model seems more practical, after all we want data processors playing by the law, not causing irreparable financial harm when they violate the law. On Tue, Aug 28, 2018, 10:17 AM anyega jefferson <jeffersonanyega@gmail.com> wrote:
Good morning,
The size of the data processor should have an effect on the magnitude of the fines. Although all offences are equal , all penalties can't be the same ,otherwise it would be an academic exercise really. Of say, an individual offender were fined large amounts ,then basically the option would be a jail term by default for many non-wealthy persons.
On Tue, Aug 28, 2018, 9:56 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/jeffersonanyega%40gmai...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
The GDPR model may not fit well in our context, reason, the economy factored in that model are much bigger hence remedies to the victim/ injured would be likewise, a copy paste here would create a scenario where the injury is epic but inversely propositional to the punishment. On Tue, Aug 28, 2018 at 9:36 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/hanningtondr%40gmail.c...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- *Computer and Cellular Forensic InvestigatorCyber Crime Unit CID HQ Nairobi 0720-727003ENCASE II C.H.F.I*
Thank you for your contributions so far. @Hannington, thank you for bringing in the issue of proportionality of remedies. While at the moment our economy is much smaller, don't you think we shall keep growing? Also, how can we cure the fact that there is a mix of both very small and very big players in our scene? @Mercy and Jefferson, your comments on pro-rating penalties are noted. I would love to get your comments on remedies for the data subjects. How can the law provide some justice for victims of breaches? Il giorno mar 28 ago 2018 alle ore 12:13 Hannington Oduor via kictanet < kictanet@lists.kictanet.or.ke> ha scritto:
The GDPR model may not fit well in our context, reason, the economy factored in that model are much bigger hence remedies to the victim/ injured would be likewise, a copy paste here would create a scenario where the injury is epic but inversely propositional to the punishment.
On Tue, Aug 28, 2018 at 9:36 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/hanningtondr%40gmail.c...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
--
*Computer and Cellular Forensic InvestigatorCyber Crime Unit CID HQ Nairobi 0720-727003ENCASE II C.H.F.I* _______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
Listers, Could it be that the administrative overhead & the associated penalties depended on the amount of people's personal data you hold ? I.e. if you hold less than 10000 people's data you might be a "small data processor", if you hold between 10000 and 100000 peoples data you would be medium and above you would be a large processor... And the requirements would be scaled accordingly. .. Mike On 08/28/2018 01:02 PM, Grace Bomu via kictanet wrote:
Thank you for your contributions so far. @Hannington, thank you for bringing in the issue of proportionality of remedies. While at the moment our economy is much smaller, don't you think we shall keep growing? Also, how can we cure the fact that there is a mix of both very small and very big players in our scene? @Mercy and Jefferson, your comments on pro-rating penalties are noted. I would love to get your comments on remedies for the data subjects. How can the law provide some justice for victims of breaches?
Il giorno mar 28 ago 2018 alle ore 12:13 Hannington Oduor via kictanet <kictanet@lists.kictanet.or.ke <mailto:kictanet@lists.kictanet.or.ke>> ha scritto:
The GDPR model may not fit well in our context, reason, the economy factored in that model are much bigger hence remedies to the victim/ injured would be likewise, a copy paste here would create a scenario where the injury is epic but inversely propositional to the punishment.
On Tue, Aug 28, 2018 at 9:36 AM Grace Bomu via kictanet <kictanet@lists.kictanet.or.ke <mailto:kictanet@lists.kictanet.or.ke>> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke <mailto:kictanet@lists.kictanet.or.ke> https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke <http://www.eacdirectory.co.ke>
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/hanningtondr%40gmail.c...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
--
/*Computer and Cellular Forensic Investigator Cyber Crime Unit CID HQ Nairobi 0720-727003 _ENCASE II C.H.F.I_*/ _______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke <mailto:kictanet@lists.kictanet.or.ke> https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke <http://www.eacdirectory.co.ke>
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/michael%40pluspeople.d...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
The penalties are too static for the market. They might be crippling to an SME but pocket change to a big firm. This will also translate to more small firms complying since the amounts are too steep and the big firms complying as they seem fit. Instead, I think it should lean towards the GDPR penalties where the penalties are pegged on Gross revenue. Regarding "Knowingly supplying false information to the data commissioner during registration as a data controller or processor " Its a double sword. There are some who do this to protect their identity since the purpose of the data collected is unclear. Or because we don't know if they will sell the details to the highest bidders in the dark web. -- Mercy Njue Founder Botlab Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor Office line: +254 700 915197 Mobile: +254 729758 701 Email: Mercy@botlab.biz *Endless possibilities :* www.botlab.biz *"* What we are is God's gift to us. What we become is our gift to God. - Eleanor Powell On Tue, Aug 28, 2018 at 9:48 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mkawira2010%40gmail.co...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
Good evening listers, I think the model should be based on the fundamentals; that anyone holding personal data should know that it will hurt significantly if the data goes to unintended parties or is used for unintended purpose. Whether the data processor is ' small' or ' large' fact is the data held is personal and should be handled as per the agreed terms when this information was provided. My preference though should be applied based on revenue but there should be a minimum amount or jail term for penalties. I think this would keep data processors in check. Regards, Martha Muriuki Skype: marthamuriuki On Tue, Aug 28, 2018 at 12:18 PM Mercy Njue via kictanet < kictanet@lists.kictanet.or.ke> wrote:
The penalties are too static for the market. They might be crippling to an SME but pocket change to a big firm. This will also translate to more small firms complying since the amounts are too steep and the big firms complying as they seem fit. Instead, I think it should lean towards the GDPR penalties where the penalties are pegged on Gross revenue.
Regarding "Knowingly supplying false information to the data commissioner during registration as a data controller or processor " Its a double sword. There are some who do this to protect their identity since the purpose of the data collected is unclear. Or because we don't know if they will sell the details to the highest bidders in the dark web.
-- Mercy Njue Founder Botlab
Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor Office line: +254 700 915197 Mobile: +254 729758 701 Email: Mercy@botlab.biz *Endless possibilities :* www.botlab.biz
*"* What we are is God's gift to us. What we become is our gift to God. - Eleanor Powell
On Tue, Aug 28, 2018 at 9:48 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mkawira2010%40gmail.co...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/marthamuriuki%40gmail....
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
@Mike, at a forum at Strathmore University, when the issue of classifying data processors/controllers , one of the proposed solutions was that classification could be a matter to be dealt with in regulations. You make a practical proposal that we shall capture in the report of these discussions. @Martha , thank you for drawing us back to the basic objective of the proposed law- to ensure that anyone who holds data protects it. Listers, some of the points from your contributions from today include: a) that the proposed law should have mechanisms for graduated penalties b) that remedies should also be incorporated into the law and although listers are divided on the GDPR model ,proposals have been given for graduated remedies depending on the size of the processor/controller c) it has been noted that there are important aspects of data protection whose non performance has no offences/ remedies attached. An example is when data processor/controller fails to notify data subjects of a breach of their data. Tomorrow, we discuss the exciting topic of institutional framework as provided for in part II of the bill. This thread remains open for more comments. Thank you for your participation today and goodnight. Il giorno mar 28 ago 2018 alle ore 20:16 Martha Muriuki via kictanet < kictanet@lists.kictanet.or.ke> ha scritto:
Good evening listers,
I think the model should be based on the fundamentals; that anyone holding personal data should know that it will hurt significantly if the data goes to unintended parties or is used for unintended purpose. Whether the data processor is ' small' or ' large' fact is the data held is personal and should be handled as per the agreed terms when this information was provided. My preference though should be applied based on revenue but there should be a minimum amount or jail term for penalties. I think this would keep data processors in check.
Regards,
Martha Muriuki Skype: marthamuriuki
On Tue, Aug 28, 2018 at 12:18 PM Mercy Njue via kictanet < kictanet@lists.kictanet.or.ke> wrote:
The penalties are too static for the market. They might be crippling to an SME but pocket change to a big firm. This will also translate to more small firms complying since the amounts are too steep and the big firms complying as they seem fit. Instead, I think it should lean towards the GDPR penalties where the penalties are pegged on Gross revenue.
Regarding "Knowingly supplying false information to the data commissioner during registration as a data controller or processor " Its a double sword. There are some who do this to protect their identity since the purpose of the data collected is unclear. Or because we don't know if they will sell the details to the highest bidders in the dark web.
-- Mercy Njue Founder Botlab
Botlab Physical Address: Ngong hills Hotel along Ngong road, 5th Floor Office line: +254 700 915197 Mobile: +254 729758 701 Email: Mercy@botlab.biz *Endless possibilities :* www.botlab.biz
*"* What we are is God's gift to us. What we become is our gift to God. - Eleanor Powell
On Tue, Aug 28, 2018 at 9:48 AM Grace Bomu via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Offences are public in nature and their prosecution and sentencing is carried out through the criminal justice system. Remedies on the other hand may be considered from a civil lens and examples include damages, restitution, coercive (injunctions) and declaratory remedies. They are personal and their aim is to give justice to the injured person. A trend with newer laws is the provision of both offences and remedies. In the copyright law for example, in addition to criminal offences, one can recover profits from pirated material. Back to our bill, the following offences are created:
*Offence *
*Penalty *
Knowingly supplying false information to the data commissioner during registration as a data controller or processor ( clause 15 (3))
General penalty under clause 59:
5 million shillings fine or 5 years imprisonment or both
plus
possible forfeiture of equipment and prohibition order
Data controller or processor failing to notify the data commissioner about a change in particulars (clause 16 (7))
General penalty
unlawful processing of personal data (clause 27)
5 million shillings fine or 5 years imprisonment
Unlawful processing of sensitive personal data (part v)
5 million shillings fine or 5 years imprisonment
Refusing to comply with a notice from the data commissioner or knowingly furnishing the commissioner with false information during investigations (clause 52(3))
General penalty
Disclosure of personal data by controller against specified purpose (clause 58 (1))
General penalty
Disclosure of personal data by processor without authority of controller (clause 58 (2))
General penalty
Obtaining personal data without prior authority of controller or processor (clause 58 (3)(a))
General penalty
Disclosure to a third party (clause 58 (3) (b))
General penalty
Offer (advertisement) to sell personal data obtained through unlawful disclosure ((clause 58 (4))
General penalty
The bill has taken the criminal law track and has not provided remedies targeting persons injured by contravention of the bill. It does however create a complaints mechanism where the public can lodge complaints with the data commissioner. The powers of the commissioner in addressing such complaints are limited to issuing notices.(and we shall be discussing more about the office powers of the data commissioner in due course)
Our discussion today is on the question of choosing the offences route as opposed or in addition to the civil route. What are our thoughts on this? Should we have borrowed the pro-rated model of the GDPR where controllers/processors are charged administrative fines according to their revenue? And when we come to offences, are they adequate? Should the magnitude of the offence be measured against the size of the data processor or are all sins equal despite might of the transgressor?
Listers, please share your views on these issues. As usual, we welcome identification of good and problematic clauses. Welcome to the discussion.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mkawira2010%40gmail.co...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/marthamuriuki%40gmail....
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Domain Registration sponsored by www.eacdirectory.co.ke
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F
participants (6)
-
anyega jefferson -
Grace Bomu -
Hannington Oduor -
Martha Muriuki -
Mercy Njue -
Michael Pedersen