Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR accurate, complete and kept up-to-date. 845. Thirdly, the Purpose Specification Principle provides that the purposes for which personal data are collected should be specified not later than at the time of data collection, and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. The Use Limitation Principle provides that personal data should not be disclosed, made available or otherwise used for purposes other than those specified except with the consent of the data subject; or with the authority of law. 846. Principles 1 to 3 on processing of data in Article 13 of the African Union Convention on Cyber Security and Personal Data Protection in this respect provides for similar principles of consent and legitimacy, lawfulness and fairness, and purpose, relevance and storage. 847. The Data Protection Act has provided for detailed principles on collection, processing and transfer of data in Parts IV, V, and VI of the Act. In particular section 25 of the Act provides for and summarises the principles of personal data protection as follows: “25. Principles of data protection Every data controller or data processor shall ensure that personal data is— (a) processed in accordance with the right to privacy of the data subject; (b) processed lawfully, fairly and in a transparent manner in relation to any data subject; (c) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; (d) adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; (e) collected only where a valid explanation is provided whenever information relating to family or private affairs is required; (f) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay; (g) kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and (h) not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.” 848. The elements of these principles are detailed in subsequent sections of the Act. The next set of principles in the OECD Privacy Principles relate to the storage and rights to collected data. The Security Safeguards Principle provides that personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data. The Openness Principle requires general policy of openness about developments, practices and policies with respect to personal data. Furthermore, that means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller. http://www.kenyalaw.org - Page 140/174