Kenyan Court Ruling Raises Questions Over Cross-Border Sensitive Personal Data Transfers
Kenyan Court Ruling Raises Questions Over Cross-Border Sensitive Personal Data Transfers
admin
Nairobi, Kenya – A recent ruling from the Employment and Labour Relations Court of Kenya has shed light on the complexities of transferring sensitive personal data, particularly in the context of legal proceedings. The case, Federation of Kenya Employers v. Cabinet Secretary Ministry of Foreign Affairs & International Relations and 4 others [Petition No.E085 of 2023], centered on the unauthorized transfer of Kenyan employees’ personal data to Scotland without complying with provisions of the Data Protection Act, 2019. The court found that the respondents had violated Section 48 of the Act, which outlines the conditions for cross-border data transfers.
Sensitive Personal Data and Consent
The data transferred in this case involved highly sensitive information, including medical records that detail the nature and extent of injuries. According to General Regulation 46(2) and Section 49(1) of the Data Protection Act, obtaining consent is a clear requirement when processing sensitive personal data outside Kenya. Although Section 48(c) of the Act permits processing without consent when necessary for legal claims, there are practical challenges in adhering to the additional conditions set forth by General Regulation 46(2) and Section 49(1).
This raises a conundrum: if a data subject withholds consent, how can a respondent rely on that same sensitive data to defend a legal claim? The ruling highlights the tension between the need for data protection and the practical realities of legal proceedings.
Implications for Organizations/ Case Parties
The case has significant implications for organizations or parties involved in legal claims that may need to transfer sensitive personal data across borders for legal claim purposes. It highlights the critical importance of carefully adhering to the requirements of the Data Protection Act, including obtaining appropriate consent whenever possible.
Parties must also be prepared to navigate challenges that arise when data subjects withhold consent for the use of sensitive personal data essential to their legal defense. This may require seeking alternative evidence or pursuing legal avenues to obtain the necessary data.
