DPA_06-TRANSFER OF PERSONAL DATA OUTSIDE KENYA Flashcards
What is the primary focus of PART VI of the Data Protection Act?
The primary focus is on the conditions and safeguards for transferring personal data outside Kenya.
What is required before transferring personal data out of Kenya?
Conditions for transfer must be met, ensuring adequate data protection safeguards are in place.
What does “adequate data protection safeguards” mean?
It refers to measures that ensure the recipient country provides a level of protection for personal data that is comparable to that provided under Kenyan law.
What is the role of the Data Commissioner in data transfer?
The Data Commissioner assesses and approves the adequacy of data protection in the recipient country before data can be transferred.
What is a “data server” in the context of data transfer?
A data server is a system that stores and processes personal data, which may be located in or outside Kenya.
What is the significance of “consent” in transferring personal data?
Consent from the data subject is required for transferring their personal data outside Kenya, ensuring their rights are respected.
What are the potential consequences of transferring data without adequate safeguards?
Transferring data without adequate safeguards can lead to
Legal penalties,
Loss of data subject trust, and
potential Data breaches.
What is the “principle of accountability” in data transfer?
The principle of accountability requires data controllers to demonstrate compliance with data protection laws when transferring data outside Kenya.
What does “processing through a data server or centre in Kenya” imply?
It implies that personal data can be processed in Kenya even if the data is accessed or managed from outside the country, subject to local laws.
What is the importance of “data protection impact assessments” in transfers?
Data protection impact assessments help identify and mitigate risks associated with transferring personal data outside Kenya.
What is the “right to object” in the context of data transfer?
The right to object allows data subjects to refuse the transfer of their personal data to another jurisdiction under certain conditions.
What does “cross-border data flow” refer to?
Cross-border data flow refers to the movement of personal data from one country to another, which is regulated under the Data Protection Act.
What is the significance of “binding corporate rules”?
Binding corporate rules are internal policies adopted by multinational companies to ensure adequate data protection when transferring data within the organization across borders.
What is the “data subject’s right to access” in relation to data transfer?
Data subjects have the right to access their personal data and understand how it is being processed, including any transfers outside Kenya.
What are “standard contractual clauses”?
Standard contractual clauses are pre-approved contractual terms that ensure adequate protection for personal data being transferred outside Kenya.
What is the “principle of purpose limitation” in data transfer?
The principle of purpose limitation requires that personal data transferred outside Kenya is only used for the specific purposes for which it was collected.
What does “data breach notification” entail in the context of international transfers?
Data breach notification requires that data subjects and the Data Commissioner are informed of any breaches that may occur during or after the transfer of their data.
What is the “right to erasure” concerning data transferred outside Kenya?
The right to erasure allows data subjects to request the deletion of their personal data, including data that has been transferred outside Kenya, under certain conditions.
What is the significance of “legal frameworks” in recipient countries?
Legal frameworks in recipient countries must align with Kenyan data protection standards to ensure that personal data is adequately protected during and after transfer.
What is the “data controller’s responsibility” when transferring data?
The data controller is responsible for ensuring that any transfer of personal data complies with the Data Protection Act and that adequate safeguards are in place.
What does “sensitive personal data” refer to in the context of transfers?
Sensitive personal data includes information that, if disclosed, could lead to significant harm or distress to the data subject, such as health information or biometric data.
What is the “principle of data minimization”?
The principle of data minimization requires that only the personal data necessary for the intended purpose is transferred, reducing the risk of exposure.
What is meant by “legitimate interests” in data transfer?
Legitimate interests refer to the reasons a data controller may have for transferring data, provided they do not override the rights of the data subjects.
What is the “right to data portability”?
The right to data portability allows data subjects to obtain and reuse their personal data across different services, including during transfers.
