A recent determination by Kenya’s Office of the Data Protection Commissioner provides useful guidance on the extent to which personal data collected lawfully for one purpose may subsequently be used for another.
The determination concerned a photograph of a student who was a minor at the material time. The photograph had been collected by her school during the admission process for administrative purposes. It was subsequently disclosed to a media organisation and used in reporting concerning a public health incident at the school.
The complaint raised several issues under the Data Protection Act, 2019, including the lawful processing of children’s personal data, purpose limitation, transparency, data minimisation and the application of the exemptions for processing undertaken in the public interest and for journalistic purposes.
Lawful collection does not authorise every subsequent use
A central issue before the ODPC was whether the school could rely on its original collection of the photograph to justify its subsequent disclosure.
The ODPC drew a distinction between the two processing activities.
The photograph had initially been collected for purposes associated with the student’s admission and administration at the school. Its subsequent disclosure to the media for publication served a materially different purpose.
The ODPC therefore considered the disclosure to be a separate processing activity for which the school was required to establish an appropriate lawful basis.
This finding is an important application of the purpose limitation principle under section 25 of the Data Protection Act. Personal data must be collected for explicit, specified and legitimate purposes and should not subsequently be processed in a manner that is incompatible with those purposes.
Accordingly, the fact that a data controller lawfully obtained personal data does not, without more, permit the controller to use or disclose that data for a new purpose.
Purpose limitation must be considered throughout the data lifecycle
The determination demonstrates that compliance with the Data Protection Act does not end at the point of collection.
Where a data controller proposes to use information already in its possession for a different purpose, it should consider whether that further processing is compatible with the purpose for which the information was originally collected.
In this case, the ODPC found that the school had not demonstrated that disclosure of the photograph for publication was necessary, proportionate or limited to the purpose for which it had originally been obtained.
The ODPC consequently found that the school had breached the principles of lawfulness, fairness and transparency, purpose limitation and data minimisation under section 25 of the Act.
The finding has wider relevance for data controllers that retain personal data and later identify new potential uses for it. A change in purpose may require a fresh assessment of the legal basis for processing, the information previously provided to the data subject and any additional safeguards required by the Act.
Children’s personal data requires heightened safeguards
The fact that the data subject was a minor was significant to the ODPC’s analysis.
Section 33 of the Data Protection Act imposes specific requirements in relation to the processing of children’s personal data. The ODPC found that the school had not demonstrated that the student’s parent or legal guardian had consented to the subsequent disclosure of the photograph.
The determination illustrates the additional care required where an organisation proposes to use children’s personal data for a purpose that differs from the purpose for which it was initially collected.
Consent or another basis relied upon for the original processing should not simply be assumed to extend to subsequent processing.
Organisations that routinely process children’s personal data, including schools, healthcare providers, technology platforms and organisations providing services to children, should therefore ensure that their consent and notification procedures adequately address how that data may be used and disclosed.
The position of the media respondents
The ODPC reached a different conclusion in relation to the media respondents.
They challenged the ODPC’s jurisdiction on the basis of the exemptions under sections 51 and 52 of the Data Protection Act concerning processing in the public interest and processing for journalistic, literary or artistic purposes.
The ODPC considered the wider circumstances of the publication, including the serious public health incident at the school, the significant public concern surrounding it and the applicable media code of ethics.
It also considered the media organisation’s response after discovering that the student’s photograph had been published erroneously, including the subsequent correction and public apology.
The ODPC ultimately upheld the jurisdictional objection and dismissed the complaint against the media respondents.
This aspect of the determination is significant because it illustrates that the lawfulness of processing must be assessed in relation to the particular controller, the purpose of the processing and the legal basis available to that controller.
The fact that one controller is unable to establish a lawful basis for disclosure does not necessarily mean that another controller processing the same information will be in breach of the Act.
Regulatory engagement is part of data protection compliance
The determination also provides an important reminder about engagement with the ODPC.
The school had been notified of the complaint and was subsequently requested to cooperate with the ODPC’s investigation, including by facilitating a scheduled site visit. According to the determination, it failed to respond adequately or provide the requested assistance.
The ODPC found that this conduct amounted to obstruction of the Data Commissioner under section 61 of the Data Protection Act and recommended prosecution of the school’s directors.
This is an important regulatory point. An organisation’s exposure may arise not only from the processing activity that gives rise to a complaint, but also from its conduct once the regulator begins an investigation.
Data controllers and processors should therefore have appropriate procedures for receiving, escalating and responding to correspondence and information requests from the ODPC.
The determination
The ODPC dismissed the complaint against the media respondents but found that the school had breached its obligations under the Data Protection Act.
The school was ordered to compensate the complainants in the sum of KES 300,000. The ODPC also recommended prosecution of the school’s directors for obstruction of the Data Commissioner under section 61 of the Act.
What this means for data controllers
The determination is relevant well beyond the particular circumstances in which it arose.
Organisations routinely collect personal data for specific operational purposes and subsequently identify additional uses for information already in their possession. This may arise in marketing, research, analytics, product development, employee management and the development or deployment of artificial intelligence systems.
Before implementing a new use of existing personal data, organisations should consider the purpose for which the data was originally collected, whether the proposed processing is compatible with that purpose, the lawful basis available for the new processing and whether additional notification or consent requirements arise.
Particular care is required where the processing involves children or sensitive personal data.
The broader implication of the determination is that lawful collection should not be treated as a continuing authorisation for all future processing. Each materially different use of personal data should be assessed against the requirements of the Data Protection Act.
For organisations developing increasingly data intensive operations, this makes purpose limitation an important component of data governance throughout the information lifecycle, rather than a compliance question considered only when personal data is first collected.
The decision is also a timely reminder that effective data protection governance requires both substantive compliance with the Act and an appropriate framework for responding to regulatory scrutiny.
This article provides a general discussion of the law as it stands at the moment and is not intended to be legal advice. For more detailed insights and professional advice, reach out to B M Musau & Co., Advocates LLP. Our team of experts is here to support your business needs and ensure you stay ahead in a dynamic economic environment.