The Office of the Data Protection Commissioner (ODPC) recently published a set of guidance notes on the use of emerging technologies including artificial intelligence (AI) and privacy enhancing technologies such as encryption.
The guidelines come at a time when the adoption of these technologies is growing significantly, particularly in the private sector where investment in digital technologies has been rising in recent years.
In its guidance note on AI the ODPC acknowledges that the nature of AI systems introduce new data protection challenges that existing regulations do not fully address.
This includes the opacity of algorithmic models, the risk of discrimination from biased training data, the reduction of human oversight and the generation of predictions about data subjects without their input among others.
The guidelines are thus meant to introduce an additional layer of regulations aimed at protecting Kenyans and are a welcome development, even as some would argue they should have come sooner.
AI use has been deployed for years in the country to create consumers’ credit scores, read through employment resumes, diagnose diseases and develop hyper-targeted advertising and entertainment content.
The guidelines apply to both public and private entities that develop AI systems trained on personal data, produce recommendations or decisions based off of this data or use these technologies in automated decision-making.
They are also based on existing regulations including the Data Protection Act and the Data Protection (Registration of Data Controllers and Data Processors) Regulations and thus extend protections introduced in 2019.
On the one hand the guidelines are crucial for consumer protection as they apply to a broad swathe of entities, ranging from insurance companies to telecommunication firms, airlines, hospitals and streaming platforms.
For instance, a lending company that uses an AI-based credit scoring model is expected to test the model to ensure it does not produce adverse outcomes and provide transparency through a privacy notice disclosing the use of AI-scoring.
A hospital collecting patient records cannot supply these records as training data to a commercial AI vendor developing a diagnostic tool for commercial licensing without further assessment and legal authority.
Other guidelines also limit the length of time entities may hold on to users’ personal data used to train AI models, mandate data minimisation, accuracy, anonymisation, security and users’ consent.
On the other hand the scope of the guidelines could present an administrative challenge for the ODPC to regulate compliance.
Ride-hailing drivers and restaurants that use food delivery apps, for example, rely on AI models that are developed and deployed outside the country, with the phone apps serving as consumer touchpoints that are location-agnosic.
It is thus difficult to outline how the ODPC would go about enforcing the regulations upon firms that have no physical presence in Kenya and operate beyond the country’s regulatory scope.
Kenyan regulators have in the past struggled to enforce local regulations upon global big tech firms like Google and Facebook that cite their foreign-based offices as falling outside the purview of legislation covering Kenyan corporates.
At the same time the nature of AI deployment where companies purchase subscriptions to enterprise language learning models presents a regulatory headache for the ODPC.
There are hundreds of proprietary language learning models and thousands more on open source platforms like Hugging Face. It thus presents a regulatory dilemma for the ODPC to monitor compliance across such a large range of products and often, problematic LLM deployment will not be identified until consumers raise the flag and by that time the damage has already been done.
Nevertheless the release of the guidance note is a step in the right direction in the country’s attempt at regulating an industry that is disruptive globally and one that many governments are just starting to understand.
It further enshrines the right of Kenyan digital users such as informed consent, access to personal data collected by private companies and rights to have their data corrected and erased.
It is further an advancement of Kenya’s data protection regulation that is among the most robust in the region and sets the country ahead of regional peers in enforcing data governance at a time the industry is progressing at breakneck speed.
To ensure successful implementation, the ODPC will have to work together with entities in the private and public sector to ensure effective adoption.
The regulator will also have to reach out to other state regulators and government bodies to ensure an umbrella approach to enforcement of the guidelines. Just like laws on ethical corporate governance and investor protection are enforced by more than one regulator, regulations on appropriate AI deployment will require a multi-sectoral approach to work effectively in safeguarding the personal data rights of Kenyan consumers.
The Writer is Managing Partner , Maudhui House a public Affairs Consultancy – [email protected]
