Data and Commerce

Banking institutions, as with many other entities, are increasingly handling personal data owing to an increased use of different technologies to offer banking services. Increased handling of such personal data coupled with new statutory requirements relating to data protection have placed renewed emphasis on the efforts used by banks to create and communicate policies for handling data subjects’ information. This report analyses the publicly available data policies of commercial banks in Kenya, providing an overview of the approaches taken by the studied banks with respect to data protection for existing and prospective customers.

This report compares the banks’ data policy provisions against a data protection standard developed using the provisions of existing national and international data protection regimes, including the Kenya Data Protection Act 2019 (DPA) and the European General Data Protection Regulation (GDPR). This standard comprises three broad indicators: data collection, data sharing, and the rights of data subjects. Compliance with these indicators is measured using tabulated analyses showing the individual and aggregated performance of the banks.

The report’s conclusions are derived from research conducted in Kenya in 2019 and 2020. A total of 32 policies were identified and analyzed, all of which were in existence prior to the enactment of the Kenya DPA. This report is therefore a baseline study of the policies; the report anticipates that there will be changes in banking policies as the DPA is put into practice. The findings in this report will be useful for comparative purposes as the DPA is implemented and enforced.

Key Findings

On average, the banks were found to be more likely to have unclear or incomplete policy provisions in all categories. Provisions relating to data collection were the most compliant while provisions relating to rights of data subjects had the lowest compliance score.

There is a notable variance in the performance of banks with regard to rights of data subjects. A large number of banks lacked any policy provisions in this category while a similarly large number of banks were clustered at the higher scores. This disparity suggests that the banks took two general approaches, i.e., to exclude policy provisions relating to data subjects’ rights altogether, or to incorporate such provisions clearly and completely.

Overall, provisions relating to the purpose of processing data were the most compliant among all provisions in all categories. Provisions relating to the rights of data subjects to object to the outcome of an automated decision were the least compliant. Clarity or completeness of provisions was a problem for a large number of the policies, and the overall readability of the policies may present challenges to banking customers that are likely to have a wide range of formal education.

Although the report highlights that the banking sector falls short of what we consider internationally-recognized norms in data protection, the data also show that data protection policies are widely present in the sector, and can be modified to become compliant.

The increased use of digital platforms in Kenya has changed the manner in which marketing is conducted. Many companies and individuals have embraced direct marketing because it is affordable, enables one to attract new customers fast and one can reach target customers efficiently. The importance of direct marketing to a marketer is that it allows him to promote the product or service directly to his target audience. The availability of various marketing tools and the benefits that accrue with direct marketing has attracted many businesses thus causing many to incorporate the practice in their daily activities.

The purpose of this policy brief was to identify existing Kenyan laws that are applicable to the practice of direct marketing, identify any gaps in these legislations and come up with policy recommendations based on comparison with other jurisdictions. The approach used involved doctrinal research which was useful in analysing existing Kenyan laws to identify direct marketing provisions. A comparative analysis approach was also employed and it was useful in coming up with appropriate policy recommendations based on the gaps identified.

The findings from the policy brief indicate that:

• Kenya already has four laws that are applicable to the practice of direct marketing.

• Key definitions which are fundamental ingredients of direct marketing are not included in the legislations analysed.

• The existence of big data has transformed how marketing is conducted.

• External jurisdictions have made an effort to protect data subjects in the commercial use of personal data.

• Numerous jurisdictions have updated their privacy laws and subsequently included direct marketing provisions so as to protect consumer data and measure up with global marketing privacy standards.

The full policy brief attached herein contains the detailed analysis of the findings that were obtained and the policy recommendations that were made.