Laws Applicable to Political Micro-Targeting in Kenya

The rise of online political microtargeting has caused governments to come up with initiatives to respond to the situation. Online political microtargeting has a number of risks such as invasion of privacy since it involves the collection of people’s personal data on a massive scale to identify their political preferences. The data collected can also be used for other separate purposes thus invading the privacy of data subjects.

There are a number of principles relating to the processing of personal data that should be observed. For instance the Kenya Data Protection Act 2019 provides that, ‘Every data controller or data processor shall ensure that personal data is collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes.’ ¹ This provision is also reiterated in the General Data Protection Regulation (GDPR).² If personal data is collected for other purposes other than the specified purpose it violates the above principle and also infringes on the privacy of a data subject.

Another important principle that should be observed when processing personal data entails lawfulness, fairness and transparency. This principle is enshrined in the Kenya Data Protection Act 2019 and it provides that a data controller or data processor shall ensure that personal data is ‘processed lawfully, fairly and in a transparent manner in relation to any data subject.’³ The same principle has also been reiterated in the GDPR.⁴ Data processing can therefore only take place where the data subject has consented to it or if it is covered by a legal permission.⁵ This principle also applies to online political microtargeting where personal data relating to a voter should be processed in a transparent manner. Political microtargeting however requires robust laws which will cover online political advertising and due diligence measures that should be observed when dealing with online political advertising.

In Kenya there is not yet a specific legislation that addresses political microtargeting. However, the laws discussed below are applicable to political microtargeting:

1. The Constitution of Kenya

The Constitution of Kenya is regarded as the supreme law of Kenya and the right to privacy is an important right which is enshrined in it. Every citizen is guaranteed the right to informational privacy as provided for in Article 31(c)⁶ of the Constitution. In order to give effect to this provision, the Data Protection Act was enacted into law in 2019.⁷

2. The Data Protection Act 2019

The Act regulates how personal data is processed⁸ and ensures that the data subject’s data is processed in accordance with the data protection principles provided for in the legislation.⁹ Personal data should be processed with regard to the right to privacy of a data subject,¹⁰ in a lawful, fair and transparent manner¹¹ and should be collected for specified and legitimate purposes.¹² The personal data should also be relevant to what is necessary in relation to the purposes for which it is processed.¹³

Consent is also required from a data subject before processing their personal data for a specified purpose.¹⁴ The data belonging to a voter can therefore be collected for targeting and micro targeting purposes if they have given consent for it to be used for such purposes.¹⁵ Additionally, due to the nature of such data, the rights and freedoms of a data subject may be at a high risk and therefore a data processor shall be required to perform a data protection impact assessment.¹⁶

The legislation also provides for sensitive personal data and this kind of data includes a person’s race, their biometric data and also their ethnic social origin.¹⁷The ethnic origin of a person can easily be identified by the name one holds and therefore this also becomes easy for political actors to target certain individuals.¹⁸ In such a case, a name can be placed in the category of sensitive personal data. If a political actor desires to process such data they will have to satisfy the conditions for processing personal data and one of the grounds for processing sensitive personal data¹⁹ provided for in Section 45 of the Act.

3. The Data Protection (General) Regulations 2021

The regulations provide that certain measures should be taken by the data controller or processor when processing personal data on the basis of consent. A data subject will therefore be aware of the implications involved in processing personal data. Section 4 of the regulations lists the information that a data processor shall inform the data subject of and some of these include the right to withdraw consent, whether the personal data that will be processed shall be shared with third parties and also the kind of personal data collected.

Such measures will hinder political micro-targeting since they will ensure transparency is observed and political actors don’t misuse personal data which they have obtained from data subjects. Additionally, a data processor who obtains consent from a data subject will be required to ensure that the consent was given voluntarily, it was specific to the purposes of processing and the data subject had capacity to give consent.²⁰

The regulations also recognise that personal data can be used for commercial purposes through direct marketing and it occurs when a data controller or data processor advances commercial interests through ‘displaying an advertisement on an online media site where a data subject is logged on using their personal data…’²¹ The regulations provide that personal data can be used for direct marketing purposes by the data controller or data processor under certain conditions which include notification of the data subject that ‘direct marketing is one of the purposes for which personal data is collected.’²²The other requirement is that the data subject should have ‘consented to the use or disclosure of the personal data for the purpose of direct marketing.’²³

The right to object to processing is recognised in the regulations and it is also applicable where processing is for ‘direct marketing purposes which includes profiling…’²⁴ If a data subject objects to the processing of his or her personal data for instance where it is obtained for political micro-targeting purposes, he or she can request for erasure or destruction of the data. ²⁵ The regulations also provide the procedures that will be followed whenever a data controller or processor receives such a complaint. The measures will therefore play a key role in restricting political micro-targeting practices.

4. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021

The regulations ‘provide for the procedure required for registration of data processors and controllers.’²⁶The regulations will play a key role because without them the Data Commissioner would have a difficult time registering data processors and controllers and this includes political parties and candidates thus ensuring that the activities they engage in are monitored.²⁷The regulations provide that a data controller or data processor is required to register as being a data controller or processor where personal data is processed for ‘canvassing political support among the electorate.’²⁸

5. The Elections (Technology) Regulations, 2017

The regulations came into place to regulate the use of electoral technology by the Independent Electoral and Boundaries Commission (IEBC). Part V of the regulations deal with information security and data storage. The commission is required to come up with mechanisms to ensure confidentiality of data and measures to protect against attacks on election technology.²⁹ These measures are important so as to protect voters’ alphanumeric and fingerprint data from being misused for instance through political micro targeting.

The IEBC maintains that its database has not been hacked to date since its data storage is not centralised. This is because it uses primary and secondary servers.³⁰ The Commission also confirmed that it has an external disaster data recovery site³¹ which is in line with the requirements provided in section 25 of the Elections (Technology) Regulations.³²

6. The Computer Misuse and Cybercrimes Act, 2018

One of the vices of political micro-targeting is that it has the capability of turning citizens into objects of manipulation and thus ‘undermines the public sphere by thwarting public deliberation, aggravating political polarization and facilitating the spread of misinformation.’³³ The Computer Misuse and Cybercrimes Act makes it an offence to misinform an individual with the intent that the data relied on shall be acted upon.³⁴

Another threat of micro targeting is with regard to privacy and especially data breaches. Once a hacker realises that there is a loophole when it comes to protection of data belonging to individuals, they can access databases containing personal data³⁵ then misuse it. The Computer Misuse and Cybercrimes Act makes it an offence to intentionally or without authorisation intercept data and cause it to be transmitted to a computer system or telecommunication system.³⁶

In conclusion, the above laws and regulations play a significant role in governing how data regarding voters should be handled which is important in protecting data subjects. However, there are certain gaps in these legislations that need to be addressed such as the lack of precise rules on the use of personal data for political micro-targeting and also lack of a clear definition of what political advertising entails. A single comprehensive law dealing with political microtargeting is therefore required since this is an emerging area and developments in the ICT sector will require legislators to come up with laws addressing specific sectors being affected by technological advancement including the political arena.

Image used is from lawdonut.co.uk