Immaculate Kassait is Kenya’s first Data Commissioner after the country came up with the Data Protection Act as it sought to tackle the emerging problem of privacy in the age of information.
In this interview, Ms Kassait, who spent years at the Independent Boundaries and Electoral Commission (IEBC) and the Federation of Women Lawyers of Kenya (Fida), reveals the challenges of starting an institution from scratch, especially during the pandemic year when international travels had been restricted and so they could not do benchmarking.
She also talks about the challenge of curbing data privacy breaches by foreign digital lenders and warns Kenyans against giving all their personal data to the Internet because it might haunt them in the future.
I always describe myself as a builder. I am not afraid to have complex problems and try and find solutions. When I came here, there was no office, no car, nothing, and I came up with a 100-day project plan saying this is what needed to be done.
And there was no budget. You then realise, ‘Alar, it is not going to work.’ You have to piggybank on others. Luckily, the PS and the Cabinet secretary were very supportive.
The current Cabinet Secretary, Mercy Wanjau, I have to say is one of the people who made this office a reality. She gave a hand. With the request from the PS, she gave us an office at the Communications Authority of Kenya.
She also gave us seed money where we were able to meet stakeholders. Mark you it was in the middle of Covid-19, and so there were no meetings.
Our first days were partnership before we could even get resources. And then, of course, the parliamentary committee and then the Treasury gave us money during the supplementary budget because we came in in November. That is the second quarter.
From there, within the first year, we got our regulations. The Public Service Commission got us our instruments. With the help of CA, we were able to identify an office. I think it took a lot of determination to get things done.
Because you could easily give up. But you know, life is not about giving up. It is about forward ever, backwards never.
How did you prepare for the interview, given that there was no precedence?
Honestly, nothing prepared me for the interview. Maybe the experience from the public service helped me understand how the public service works.
Also working in a high-octane environment. Before I joined data protection in November 2022, I had no interaction with data protection at all. Only my interview and I have the book there with the Act, which has writings everywhere.
Jokingly, as I was preparing for the interview, I called one of my friends and told her, why don’t you look through this Act and tell me what you get? The following day she told me, “You better read. It is very technical.”
I went and printed it and started reading. I read that Act nothing less than five times. Because they were technical terms. Then I went on YouTube because GDPR (the General Data Privacy Regulations) for the European Union had come out two years earlier.
I would put on my earphones and listen. Luckily for them, they have interpreted everything. I had so over-read, I was overprepared.
How did your years in civil society help you with your current work?
When you are an activist, you don’t have the benefit of knowing the workings of government. When you come in (to government), you realise some of the decisions you were pushing from a civil society perspective will not work in government.
One of the things I took away from civil society is the issue of stakeholder engagement. That is something I strongly took away because I believe that the only way you can get true representation is sitting around a table with stakeholders. There is also an open-door policy and also being available. That I took along, and that we have embraced in this office. They joke that this office is unlike other governments.
The other one (a lesson from civil society) is about women’s empowerment. We are very deliberate about making the workplace a much more conducive environment for women. We have a mother’s room. Also, civil society is very result-oriented, that is the skill we took when we got into government.
So, when we talk about human rights and the right to privacy, it is something we as an office are held accountable for. I have been lucky to have the best of both worlds.
For most people today, especially young ones, the freedom of expression trumps the right to privacy. How do you reconcile the two?
Please always remember, if you are not at the table, you are the menu and meal. That is what data has made us. Whereas that reputation damage might not look like a big deal right now, please remember that the Internet never forgets.
And today what might look like a vogue, for you to be out there clubbing, tomorrow you might want it forgotten. Because, the me of yesterday, when Facebook started, for example, is not the me of today. What is happening to that information? That footprint is being used for analytics and somebody else is making money out of it.
Essentially, you are the menu on the meal.
Do you receive cases of people complaining about their photos being taken in clubs?
My vision is that for every family, data privacy is something every family has internalised.
We are not yet there. It is disheartening to see we are still receiving complaints about photography one or two years later after we have fined institutions for using people’s photos for commercial use. We have seen a reduction, but also an increase in some quarters.
We have seen a reduction in some cases of digital lenders. We have also seen notorious digital lenders who continuously violate the Data Protection Act. We are looking at ways of dealing with that issue permanently. Some of them, although complex, include mutual legal assistance.
