Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 849. Under the Individual Participation Principle, and an individual should have the right: a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; b) to have communicated to him, data relating to him i) within a reasonable time; ii) at a charge, if any, that is not excessive; iii) in a reasonable manner; and iv) in a form that is readily intelligible to him; c) to be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such denial; and d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended. 850. Lastly, under the Accountability Principle, a data controller should be accountable for complying with measures which give effect to the Privacy Principles. It is notable that the African Union Convention on Cyber Security and Personal Data Protection in this respect provides for the principles of accuracy, transparency, confidentiality and security as principles 4 to 6 in Article 13. 851. The Data Protection Act in this respect provides for an independent office of the Data Commissioner, who is appointed by the Public Service Commission, to oversee the implementation of the Act, and who is also given power to register data controllers and processors. Data Controllers are defined as the persons or entities that determine the purpose and means of processing of personal data, while data processors are the persons or entities that process data on behalf of the Data Controller. The Act also provides for the rights of Data Subjects including rights of access to personal data and correction or deletion of misleading data. It also details the procedures for rectification and erasure of personal data. Lastly, the Act has an enforcement section which among other provisions provides for a procedure for complaints and offences for unlawful disclosure of data. The Data Commissioner is required to give an Annual Report to the relevant Cabinet Secretary, and may carry out audits of data controllers. 852. While we find that the Data Protection Act has included most of the applicable data protection principles, we noted that the Registration of Persons Act is not one of the Acts to which the Data Protections Act applies as part of the consequential amendments. This notwithstanding, since one of the objectives of the Act is the regulation of the processing of personal data, whose definition as we have already found includes biometric data collected by NIIMS, it is our finding that it also applies to the data collected pursuant to the impugned amendments. We also note that there are a number of areas in the Data Protection Act that require to be operationalized by way of regulations, including circumstances when the Data Commissioner may exempt the operation of the Act, and may issue data sharing codes on the exchange of personal data between government departments. It is our view that these regulations are necessary, as they will have implications on the protection and security of personal data. 853. Once in force, data protection legislation must also be accompanied by effective implementation and enforcement. The implementation of the Data Protection Act 24 of 2019 requires an implementation framework to be in place, including the appointment of the Data Commissioner, and registration of the data controllers and processors, as well as enactment of operational regulations. Therefore, it is our finding that while there is in http://www.kenyalaw.org - Page 141/174