Author Archives: Brian

Victor Kapiyo |

In East Africa, Kenya has over the years been regarded as a model of excellence in digital rights. However, more recently, the country has been plagued by alarming practices that threaten its standing. These include a heightened crackdown on activism, including the abduction and intimidation of activists and journalists, politically motivated internet censorship, rising disinformation, cyber threats and data breaches, and a media decline. Nonetheless, it has not been all doom and gloom as there are glimmers of hope aided by increasing internet use and a population that has displayed remarkable resilience and pushback against continued threats to digital rights.

In this brief, The Collaboration on International ICT Policy for East and Southern Africa (CIPESA) explores these trends and presents some recommendations for consideration by stakeholders. 

The key trends that the brief highlights include the following:

1. Increased Internet Usage: Kenya’s internet and social media usage has been on the rise with 22.7 million internet users, of which 13 million are active on social media. Likewise, cellular mobile connections stood at 66 million in 2024. However, digital access remains uneven across the country, with urban areas reporting the highest adoption, and affordability being the main barrier to access.
   
2. Growing Crackdowns on Activism: The #OccupyParliament and #RejectFinanceBill2024 protests were met with excessive force, arrests, abductions, and crackdowns on organisers and participants. The government also invoked various laws and deployed sophisticated digital tools to monitor protestors without adequate oversight.
   
3. Spiralling Censorship of Online Speech: The government imposed a nationwide internet shutdown during the #RejectFinanceBill2024 protests and later blocked access to Telegram for two weeks to prevent cheating during the national examination period. Further, government officials issued several warnings to the public over the “irresponsible use of social media” and threatened to regulate social media platforms and block websites.
   
4. Disinformation Persists: Kenya’s disinformation enterprise remains sophisticated, lucrative and largely funded by political actors that exploit the divisions around ideological, ethnic, economic, and demographic lines while harnessing the power of social media. However, government responses to disinformation through the enforcement of the Computer Misuse and Cybercrimes Act (2018) continue to raise concerns about censorship due to the misapplication of the law to muzzle legitimate speech.
   
5. Gaps in Access to Information: Access to information about key government projects has remained inconsistent, with widespread secrecy, delays or outright refusal characterising projects. However, the delivery of government services online through the eCitizen portal has facilitated enhanced access to information and services even as the digital divide expands.
   
6. Growing Data Breaches and Cyber Threats: As the population embraces the digital economy, the number of cyber threats recorded increased in 2024, with the majority being system vulnerabilities, malware and brute force attacks. Also, there are concerns over unchecked state surveillance, and the adequacy of safeguards to protect citizens’ data amidst rising data breaches.
   
7. Media under Siege: Kenya’s media rankings have declined, with the Media Council of Kenya reporting a total of 74 cases of press freedom violations in 2024. The violations included cases of harassment, intimidation, and arbitrary arrests of journalists, particularly those reporting on politically sensitive topics such as corruption, protests, and human rights abuses.
   
8. Change of Guard at the MoICDE: William Kabogo was appointed as the third Cabinet Secretary for the Ministry of Information, Communications, and the Digital Economy (MoICDE) in a span of two years. The billionaire politician announced his readiness to regulate social media and shut down the internet if national security is threatened. 

In conclusion, the brief calls for continued vigilance and action to stem the downward spiral. 

Summary of Recommendations:

1. The government should commit to maintaining free, open and secure internet access by international human rights standards.
   
2. The government should take measures to expand ICT infrastructure in rural and underserved areas.
   
3. The Computer Misuse and Cybercrimes Act should be amended to narrow its scope and ensure that response measures comply with the three-part test and the law is not used to censor or suppress digital rights.
   
4. The capacity of the Office of the Data Protection Commissioner should be strengthened to ensure compliance of all government online services and digital initiatives to the Data Protection Act.
   
5. Kenya should address its cybersecurity constraints.
   
6. Stakeholders should work to strengthen legal protections for journalists and media outlets.
   
7. The government, including at the county level, should continue to invest in the digitisation of public records and services to facilitate efficiency, transparency and accountability.

Read the full brief here.

In today’s highly digitalised society, where large amounts of data are being collected and processed, the need for guidelines on health data governance can not be overemphasised. Health data is profoundly sensitive and breach of privacy can cause significant harm to concerned individuals and affect health outcomes. Such guidelines should regulate how data is collected, how and where it is stored, who can share or process it, and what they can do with the data.

As global interest in the regulation of health data picks pace, it is instructive to revisit how health data collected during massive data collection exercises has been handled in some African countries. This examination is crucial to appreciate the key challenges faced in safeguarding the privacy and security of health-related data. This can provide pointers to the areas that require regulation and strengthening of practices.

In this June 2023 Brief, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) recounts how measures related to tracking and monitoring people’s movements, communications and health data by the Kenyan and Ugandan governments and private entities during the Covid-19 pandemic were deemed to have breached the right to privacy, lacked sufficient oversight, and did not respect data protection principles.

Based on experiences from Kenya, South Africa, and Uganda, the Brief cites recommendations by the Transform Health Coalition, on the need for “common regulatory standards to harness the potential, and manage the risks, of health data sharing within and across borders, ensuring data is used for public good and prioritising equity, whilst protecting individual rights”. 

Furthermore, the Brief puts forward pointers on how African governments can balance the responsibility to protect personal health data with the importance and value of sharing it for public good purposes such as research, innovation and health planning:

• Develop clear and comprehensive privacy rights-respecting guidelines on health data through consultative processes that involve different private, civil society and public sector actors.

• Regional and global cooperation in devising the guidelines is key to share best practices and promote cross-country cooperation and harmonisation of regulations.

• The health data regulations should clearly and robustly embed all the high-level data protection principles. For health data specifically, it must only be processed for a period not longer than is necessary to achieve the intended purpose.

• The guidelines should provide for assessment by independent bodies of applications and systems that collect health data for their privacy / data protection credentials.

• The guidelines should include provisions on data collection, storage, sharing during pandemics and other health emergencies.

• Government, private companies and medical facilities should be transparent about what data they hold, who they share it with, how they process and store it, and who accesses it and for what purpose.

• Developers of health apps should embrace privacy by design when developing applications that collect, store or process health data. They should also have internal data governance policies that highlight the steps to ensure that the data they collect and process is secure.

• Establish accountability mechanisms for apps and health data collectors and ensure data protection authorities proactively enforce them.

• Government bodies should be transparent about all public–private partnerships they enter that entail data collection, storage and data sharing.

• The regulations should encourage data sharing and reuse at national level, as well as cross-border sharing but provide mechanisms for ensuring the integrity of data that is shared.

• Require health data collectors to have privacy policies written in plain language describing their data governance protocols and privacy credentials.

• The regulations should require data collectors and processors to implement appropriate, timely and effective measures to demonstrate compliance with personal data processing regulations.

Read the Brief here.