On 30th November 2023, The Employment and Labour Relations Court of Kenya at Nairobi rendered its Judgement in Petition No. E085 Of 2023. The Petitioner, Federation of Kenya Employers had brought the suit against Justice and Environment Foundation, Ronald Onyango and three others; seeking for, among other orders: -
a) A declaration that the act of Respondents of collecting and transmitting personal data outside the Republic of Kenya is incompatible with the provisions of the Data Protection Act 2019 [the Act].
The Petitioner a representative body of employers in Kenya, had learnt that there were on-going legal proceedings between James Finlays Kenya and some of its current and former employees in Scotland over work injuries sustained in Kenya. The Petitioner was therefore apprehensive that the Respondents had transferred sensitive personal data of the employees in the form of medical information to Scotland to prove the work injuries without observing the Data Protection Act 2019.
The High Court held that the actions of the Respondents in collecting and transmitting personal data outside the Republic of Kenya was incompatible with the provisions of Section 48 of the Data Protection Act 2019. For reasons that while no complaint might have been lodged to the Data Commissioner by the data subjects [the employees in the group proceedings in Scotland], the Data Commissioner had to be informed, satisfied that the transfer met the statutory requirements, and an approval subsequently obtained.
Section 48 of the Act sets out the conditions for transfer of personal data outside Kenya only where the transfer is necessary: -
a. for the performance of a contract between the data subject and the data controller or data processor or implementation of pre-contractual measures taken at the data subject's request;
b. for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another person;
c. for any matter of public interest;
d. for the establishment, exercise or defence of a legal claim;
e. in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; or
f. for the purpose of compelling legitimate interests pursued by the data controller or data processor which are not overridden by the interests, rights and freedoms of the data subjects.
Section 49 however, which deals with the processing of data outside Kenya provides that such transfer of data outside Kenya shall only be effected upon obtaining consent of a data subject and on obtaining confirmation of appropriate safeguards.
The Data Protection [General] Regulations, 2021 provides that transfer of personal data to another country or relevant international organization, may be effected in a legal instrument containing appropriate safeguards for the protection of personal data, referred to as binding corporate rules. It is noteworthy that for companies effecting transfer of personal data outside Kenya including for administrative purposes [payroll and employment related matters], such personal data can only be transferred where there exists valid documentation in the nature of Binding Corporate Rules [BCRs].
This alert serves the purpose of general guidance and is not intended to constitute specific legal advice. For more information on data privacy matters and related document preparation, reach out to our data privacy team, Partner, Collette Akwana at Collette.Akwana@CMS-CI.com and Data Privacy Associate, Wilson Mrima at Wilson.Mrima@CMS-DI.com
