Lessons from Kenya: How Open Data efforts can build more accountable governments and empower citizens to manage their own data
By Kate Wilson and Claudine Lim
As digital transformation efforts accelerate globally, the volume of data produced, particularly personally identifiable data, has grown exponentially, raising data privacy, protection and usage questions. While interesting legal and technical models exist, technical and regulatory solutions are often complex, and efforts in many countries, particularly in Africa, are still nascent. For example, countries implementing a national identification program are grappling to determine when it is appropriate to access, share, and use data; does it change depending on the nature of the data and if it’s being used for international development or humanitarian services?
I set out to learn from individuals working on the front line of these challenges, and alongside my fellow podcast host, Claudine Lim, we sat down recently with Al Kags, Executive Director of the Open Institute, for the latest Digital Decisions podcast.
The Open Institute is an African Civil Society Organization (CSO) that supports Government responsiveness and active citizenship. We discussed:
1. What personal data protection laws need to be in place as services are digitized?
2. How are citizens learning about their rights to personal privacy and what tactics are being taught to citizens to protect their own data;
3. How can governments and civil organizations work together to both advance digitization efforts and promote improved data privacy, protection and responsible use?
Al, a former tech entrepreneur, served as an advisor to the government of Kenya starting in 2005, playing a pivotal role in the development of its inaugural digital strategy. About eight years ago, he recognized the increasing prevalence of data collection and utilization, prompting him to enhance the early strategy by focusing on strengthening its data privacy pillar. With guidance from Al, Jay Bhalla, and other partners, Kenya became the first developing economy in Africa to establish an Open Data movement. This pioneering effort led Al and Jay to evangelize Open Data in other countries, including Ghana, Moldova, Tanzania, and beyond. Eventually, in 2012, the Open Institute was born, marking a significant milestone in their journey to strengthen civil society efforts.
What personal data protection laws need to be in place as services are digitized?
As a leader in digital and data innovation on the continent, Kenya quickly recognized the importance of digitalization and entrepreneurship to the country, leading to the government passing Kenya’s Data Protection Act in 2019. This stands as a strong example of personal and data protection laws for other countries to consider as they digitally transform.
The act declares privacy as a fundamental human right and outlines the process for safeguarding personal information. It also imposes obligations on data processors and controllers, emphasizing lawful and transparent processing, limited collection for legitimate purposes, accuracy, and timely updates.
Furthermore, the Act mandates registration of entities with the Data Commissioner, who maintains a public register of controllers and processors. Notably, data collection should primarily occur directly, although exceptions allow for indirect collection under specified conditions, such as public record availability or explicit consent. This approach provides a strong framework against which responsible data handling practices, aligned with global standards for digital privacy and security, can be measured.
How are citizens learning about their rights to personal privacy and what tactics are being taught to citizens to protect their own data?
While Kenya’s Data Protection Act was a critical first legal step to ensure data protection and data rights, Open Institute’s research revealed another major problem of law versus practice: enforcement proved challenging and many Kenyans remained unaware of their right to privacy and their rights as data subjects. At the same time, citizens were not yet accessing the open data available to hold the government accountable for improved service delivery.
The Open Institute’s programs address this gap. To improve citizen awareness of data privacy and protection tactics, their Ficha Uchi campaign educates people on common practices to capture citizen data and how to better protect it. They also work through programs like the Maono Project, to directly build the capacity of new civil society organizations, local groups, and individual citizens to manage their own data and act locally to effect change using Open Data. As Al noted in our conversation, however, Kenya is not alone in these challenges. Lack of citizen understanding of data misuse is a common global challenge and primarily impacts marginalized communities in rural and remote areas, exacerbating the gap in access to services and knowledge by these groups and their ability to effect change. This is why the Open Institutes model of strengthening citizen awareness and local CSOs driven by local needs is so powerful.
How can groups collaborate to drive digitization efforts and minimize data extraction, particularly from external actors?
To drive digitization efforts and minimize data extraction, especially by external actors, collaborative initiatives between civil society and government are crucial. In addition to the programs mentioned earlier, the Open Institute also advises the Kenyan government on data protection and privacy issues. Al firmly believes that governments and CSOs must join forces to protect citizens, and the example of the bitcoin company, Worldcoin (WLD), which Al discussed in his blog, serves as a powerful model to illustrate the need for this collaborative approach.
In brief, last year, WLD offered bitcoin to Kenyan citizens in exchange for capturing their biometric data through retinal scans. They marketed it as creating a “World ID”, promising access to new financial markets and free money. In return, each person scanned received a bitcoin equivalent to about USD $49. While thousands lined up by the hour, few realized that Worldcoin was paying to capture their biometric data, storing it outside of Kenya, and retaining the right to sell it. The voluminous waiver form citizens signed offered few protections, and any recourse required visiting the company’s headquarters in San Francisco. Fortunately, the Kenyan regulator and the Open Institute intervened, investigating the issues and successfully halting the practice from extending further.
This incident underscores the importance of local collaborations that empower citizens and ensure informed data usage. Governments and civil society organizations need to work hand-in-hand to scrutinize and regulate the activities of external actors, emphasizing transparency, citizen empowerment, and data protection. In the era of rapid digital transformation, national civil society organizations become crucial intermediaries, bridging the gap between citizens, companies, and governments. Their role extends to providing valuable insights for monitoring and enforcing data protection measures, fostering a collaborative ecosystem that safeguards individuals from potential data exploitation.
How can governments and civil organizations work together to both advance digitization efforts and preserve personal data privacy?
Open Institute and Kenya’s example offers countries and development partners four powerful “open data” lessons:
1) Commit to Open Data: If we want more engaged citizens, governments need to commit to publish their data and make it more visible and accessible to citizens. This requires better mechanisms and financing for holding data gathering entities accountable for any rights infringement or misuse and establishing local monitoring efforts.
2) Invest in local Digital Literacy efforts: Access to the data is necessary but not sufficient. More investment is needed in national digital literacy and privacy awareness efforts to promote the use of responsible data and train people how to use it effectively and safely. Governments and civil society organizations should work together to protect and promote digital and data literacy within national governments and with the population overall so that all citizens understand and ideally, approve, how their data is being used, stored, and shared.
3) Build stronger collaborations between CSOs and Governments: Governments have a crucial role in shaping digital protection framework, enforcing it, and raising awareness about digital rights. They also need to build capacity within their own administrations and the proper infrastructure to manage data practices and monitor partners. CSOs are natural local partners who, when engaged from the outset, can bring in citizen participation to collaboratively build this infrastructure with the government, and serve as an external check on the use of data.
4) Design with citizens from the beginning: While CSOs represent the voices of citizens, direct public participation when designing digitalization or data strategies, ensures that citizens’ needs and concerns are incorporated into government frameworks. Participatory processes should be integrated from the beginning of any national digital transformations, with proper resources and time allocated throughout the journey to engage citizens effectively.
As digital transformation trends and data use continue to accelerate globally, countries must be equipped to navigate the intricate landscape of data and digitally-driven advancements. Kenya, exemplified by the Open Institute, offers valuable options for others to consider, emphasizing collaboration, regulatory vigilance, and empowerment.
To delve further into Al’s insights and our discussion on development practices more broadly, listen to the full podcast on Apple Podcasts or Spotify.
