The Public Service Commission (the "Commission"), in compliance with the provisions of the Data Protection Act, 2019 ("DPA"), recently published a list of shortlisted candidates for the position of Data Commissioner.

The DPA, which came into effect on 25 November 2019, provides for the establishment the office of the Data Protection Commissioner to be headed by the Data Commissioner. The Commission had undertaken a shortlisting exercise and published names and interview schedules for the 10 shortlisted candidates, calling for public participation and requesting comments on any of the candidates ahead of the interview dates.

The Commission commenced interviews with the shortlisted candidates on 7 July 2020. However, on the same morning, the Employment and Labour Relations Court, through an order issued by Judge Hellen Wasilwa and directed to the Commission and the Attorney General, ordered the government to suspend the ongoing recruitment of the Data Commissioner pending the hearing and determination of a petition filed by lawyer Mr Adrian Kamotho.

Mr Kamotho filed a judicial review application seeking to quash the recruitment process on the basis that the process is defective and irredeemably tainted with illegality. He stated that the Commission disregarded queries about the recruitment process and that the methodology and system used to shortlist applicants is unknown to law as it contravenes the rules of natural justice. He argued that the scheduling for interviews more than two months after the statutory deadline exceed legal jurisdiction and amounts to abuse of power. Section 6(3) of the DPA mandates the Commission to conclude its statutory role within 21 days. A hearing date for the petition had been fixed for 14 July 2020.

Recent developments indicate that the Commission and Mr Kamotho reached an agreement that the Commission would start the recruitment process anew, in compliance with the DPA requirements. Whereas the DPA remains the law on all data issues in Kenya, promulgation of the rules bringing into effect the substantive functional provisions of the DPA, such as the registration of data controllers and data processors, oversight over data processing operations and investigation of any alleged breach of the DPA, rests upon the appointment of the Data Commissioner.

Originally published 05 August, 2020

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.