The Office of the Data Protection Commissioner (ODPC) has rejected a section of a Bill which seeks to compel parastatals, public entities, and constitutional commissions to collate and process employee details and ethnicity.
Data Commissioner Immaculate Kassait says the Public Service (Values and Principals) (Amendment) Bill, 2023, contains provisions that will reveal personal data that should not be exposed to third parties.
The Bill, sponsored by North Imenti MP Rahim Dawood, seeks to require all State organs and State corporations to submit annual reports with details of workers at constitutional commissions, independent offices, county public service boards and county assembly service boards.
The Bill requires the reports to carry the total number of employees and their gender, age, county of birth, county of residence, ethnicity and whether they are living with disabilities.
Section 10 of the Public Service (values and Principles) Act, 2015 stipulates that the public service, a public institution or an authorised officer shall ensure that public officers are appointed and promoted based on fair competition and merit.
It also requires a public institution or an authorised officer to develop a system for the provision of relevant information that promotes fairness and merit in appointments.
Mr Dawood wants an officer who fails to prepare such a report to be subjected to be disciplined.
The Data Commissioner said the proposed amendment that seeks to collate and process, among others, employee details, and employee ethnicity is deemed “sensitive person data under Section 2 of the Data Protection Act (DPA).
“The Data Protection Act provides that where personal data is to be processed, a Data Protection Impact Assessment (DPIA) must precede the processing of such employee data, to identify and mitigate potential risks,” Ms Kassait told the committee on Labour during public participation of the Bill.
Fair competition
“The employee of whom the data is being sought should be informed why the data is required, purpose, any third parties who may receive that data, protection of their data including security and integrity and whether their compliance is voluntary or mandatory.”
Ms Kassait has recommended an amendment to require that the details are processed according to the Data Protection Act.
The committee chaired by Eric Karemba said the team observed that the inclusion of the county of residence and that of birth is not provided for in the Constitution and may be deemed discriminatory.
It says the words “county of birth and county of residence” should be deleted.
“The matter of what data is private or privileged as has been proposed to be contained in the report as per the parameters should be determined as per the Data Protection Act, 2019 since the report is a public document,” Mr Karemba said in a report on the proposed law.
“The deletion of the parameters of the county of birth and county of residence is necessary as these two parameters are not provided for in the Constitution as parameters for achieving fair competition, merit and fair representation within the public service,” the report states.
Article 232(2) of the Constitution stipulates that the values and principles of public service apply to public service in all State organs at both levels of government and all State corporations.
