The Implications of Kenya’s Data Protection Act on Urban Planning. Urban planning is essential for the structured development of cities and regions, guiding the use of land, resources, and infrastructure. In Kenya, the urban planning process includes the preparation and enforcement of various plans—such as strategic, local, and detailed plans—that dictate the spatial arrangement of urban areas.
This process is often collaborative, involving government entities, planners, and the public to ensure that urban growth aligns with sustainable development goals. The planning process requires the collection and processing of various data sets including spatial and socio-economic data.
The increasing digitization of urban planning activities, such as the use of Geographic Information Systems (GIS), digital platforms for public participation, and online submissions of planning applications, presents new challenges and opportunities. However, it also raises significant concerns regarding the protection of personal data, especially in light of Kenya’s Data Protection Act.
Overview of Kenya’s Data Protection Act
The Data Protection Act, enacted in November 2019, provides a comprehensive framework designed to safeguard the collection, processing, and storage of personal data in Kenya. The Act outlines the principles for processing personal data while upholding the rights of data subjects. The key provisions of the Act include:
Salient Features of the Act and Their Implications for Urban Planning
- Consent and Data Collection:
According to Section 30, “A data controller or data processor shall only process personal data with the consent of the data subject.” In urban planning, this means that during activities such as public consultations or surveys, planners must ensure that individuals are fully informed about how their data will be used and obtain explicit consent before collecting any personal information. This could complicate the data collection process but ensures that citizens’ rights are respected.
- Data Minimization:
Section 25(d) of the Act states that data should be “adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.” For urban planning, this necessitates a careful review of the type and amount of data collected, ensuring that only essential information is gathered. This minimizes the risk of data breaches and misuse, fostering trust between planning authorities and the public.
- Data Security and Storage:
Sections 41 and 42 of the Act emphasize the importance of implementing “appropriate security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.” Urban planning departments, which handle vast amounts of spatial and demographic data, must adopt robust cybersecurity practices. This includes encrypting data, using secure servers, and limiting access to sensitive information to authorized personnel only. What does this mean for planners who have been using open source and publicly hosted services for data collection?- Consent for Data Processing: Section 30 mandates that personal data must be collected and processed with the explicit consent of the data subject.
- Data Minimization: Section 25(d) requires that only data relevant and necessary for the intended purpose should be collected.
- Data Security: Sections 41 and 42 obligate data controllers and processors to implement security measures to protect personal data from unauthorized access or loss.
- Right to Access and Correction: Sections 26 and 28 give data subjects the right to access and correct their data, ensuring transparency and accountability in data processing activities.
The Implications of Kenya’s Data Protection Act on Urban Planning
By: Plan. Gitonga K. Ritho, MKIP
A RIPPLE PLANNING ASSOCIATES LTD NEWSLETTER
OCTOBER 2024
