What is a Data Protection Impact Assessment

What is a Data Protection Impact Assessment (DPIA)?
A DPIA is a process to help you identify and minimize the data protection risks of a project.

Importance of a DPIA

1. They negate the risk that may arise in the collecting and processing of data
2. They enable accountability
3. They identify the impact entities will have on the privacy of a data subject
4. They provide input on privacy by design
5. They demonstrate the measures to be taken to comply with the DPA

Kenya Data Protection Act 2019 (DPA)
The DPA under Section 31 states that a DPIA should be conducted by a data controller or data processors where the processing of data shall result in a high risk to the rights and freedoms of a data subject, by virtue of its nature, scope, context, and purposes. 

The Data Protection Act states that a DPIA should include the following:

1. A description of the intended processing, purpose, and if possible the legitimate interest being pursued.
2. An assessment of the necessity and proportionality of processing the data in relation to the purpose
3. An assessment of the risk to the rights and freedoms of data subjects
4. The measures put in place to ensure the security of the data and compliance with the DPA

Guidance Note on Data Protection Impact Assessment

The Office of the Data Protection Commissioner published a Guidance Note in accordance with the DPA to guide the formulation of a DPIA. The Guidance Note contains the following;

Definition of risk

It defines risk as a scenario describing an event and its consequences estimated in terms of severity and likelihood. In this case, the risk is in relation to the rights and freedom of a data subject. These are the rights and freedoms found in the DPA and the Constitution of Kenya.

Processing that requires a DPIA

1. Automated decision making with legal or similarly significant effect
2. Systematic Monitoring
3. Sensitive data or data relating to a data subject or matters of private nature
4. Data processed in large scale or volume
5. Matching or combing data sets
6. Data concerning vulnerable subjects
7. Innovative use or applying new technology or organizational measures
8. When processing prevents data subjects from exercising their rights

Submission of a DPIA
A DPIA should be submitted within 60 days before the commencement of processing the data.

The Data Protection Act is silent on whether a DPIA may concern a single data point or a single DPIA can be used to access multiple similar data processing activities. 

The guidelines recommend that a single DPIA can be used for similar processing activities that present similar risks. In this case, the nature, scope, context, purpose, and risks are similar to the ones in which the DPIA has been conducted. A DPIA is, however, required if there has been a change of risks for example with the introduction of new technology.

If it is a joint DPIA it should state what each data controller and data processor is responsible for and the measures they have taken to ensure the safety and privacy of the data

 A DPIA is not required when:

1. The processing is not likely to result in a high risk to the rights and freedoms of the data subject.
2. The case where the processing may lead to a similar risk as to the one in which a DPIA has already been conducted. Therefore, the data controller can use the same DPIA.
3. The processing falls under the exceptions of Section 51 (2) of the DPA. These are: it relates to the processing of personal data by an individual in the course of a purely personal or household activity; if it is necessary for national security or public interest; or disclosure is required by or under any written law or by an order of the court.

When should a DPIA be conducted?
A DPIA should be conducted from the onset when designing the project. The DPIA should regularly be updated during the lifecycle of the project.

The DPIA should contain the following:

1. The amount of data being collected
2. The extent of processing personal data
3. The period and method of storing personal data
4. The technological development available for processing the data
5. The special risks that exist in processing the data
6. Assessment of the necessity and proportionality of processing the data in relation to the purpose
7. Assessment of the risk and rights to data subjects
8. The measures put in place to ensure that the data is secure and compliant with the DPA

Effects of the DPIA on Industry
Public bodies, private entities, and civil societies are examples of entities that would be required to have a DPIA.

Public Bodies
A DPIA may be required to be carried out by public bodies that collect and process data that deals with Biometrics, and surveillance. Some of the public bodies that may be affected include:

1. Kenya Revenue Authority
2. Independent Electoral and Boundaries Commission (IEBC)
3. National Hospital Insurance Fund (NHIF)
4. Huduma Namba Secretariat
5. National Transport and Safety Authority
6. The various registration entities: Civil Registration; Immigration; and the National Registration Bureau.

Private entities
A DPIA may be required to be carried out by private bodies that collect and process data that may put data subjects at risk. Some of the private entities that will be affected include

1. 1. Medical Industry
   2. Telecommunication industry 
   3. Banking Industry
   4. Mobile lending entities
   5. Insurance Industry 

Civil Societies
A DPIA may be required to be carried out by Civil society groups that work with vulnerable groups in the society such as children, women, and the LGBTQ communities. 

Useful links and sources

1. The Kenya Data Protection Act 
2. The Guidance Note on Data Protection Impact Assessment 
3. Republic vs Joe Mucheru, Cabinet Secretary Ministry of Information Communication and Technology and other (ex-parte Katiba Institute and Yash Pal Ghai) Judicial Review Application No. E1138 of 2020 

Please note that the information above is for knowledge purposes only and should not be construed to be legal advice or relied on as such.

Tevin Mwenda is an Advocate of the High Court of Kenya and a data policy associate at KICTANET.
LinkedIn: TevinMwenda