Kenya - Media Data Governance Guide

Overview

The Media Council of Kenya (MCK) has produced a draft "Data Governance Guide for Media Practice in Kenya" as part of a suite of media-focused documents on AI, data and social media. The draft was prepared by an MCK technical committee and released for public comment in January 2025 to provide sector-tailored guidance on responsible handling of personal and non-personal data in journalistic practice, and on the ethical application of automated tools. The guide is explicitly designed to help newsrooms align editorial decision-making with legal obligations under the Data Protection Act, 2019 and related regulations while safeguarding press freedoms and public interest journalism. It combines operational measures (data inventories, retention schedules, breach reporting) with higher-level governance (oversight, roles and responsibilities) and provides sector-specific examples to support implementation by small and large media houses alike.

Definitions

The draft establishes working definitions tailored to media practice: "personal data" and "special categories" as per the Data Protection Act; "data processing" to include collection, storage, analysis and publication for reporting; "data controller" (typically the media house or publisher determining purposes) and "data processor" (third-party vendors and cloud providers used by media); "anonymisation" and "pseudonymisation" as risk-mitigation techniques; and "automated decision making" referencing algorithmic tools used in verification, content recommendation or audience analytics.

Governance and Institutional Framework

The guide recommends a governance model combining editorial oversight with a formal data governance function. It advises appointing a data focal person or Data Protection Officer where organisational scale requires, establishing a governance committee that includes editorial, legal and technical representation, and maintaining documented policies for data retention, access control and breach response. The draft positions the MCK as a convening authority for standards and training while recognising statutory enforcement by the Office of the Data Protection Commissioner (ODPC). It also recommends formal memoranda of understanding with technical vendors and templates for processor contracts to ensure alignment with the Data Protection Act, 2019 and associated regulations.

Key Focus Areas

The draft concentrates on several core domains: (1) Legal compliance and editorial decision-making: assessing legitimate interests and public interest exceptions when handling sensitive information; (2) Data lifecycle management: inventorying datasets, purpose limitation, retention and secure disposal; (3) Technical and organisational security: encryption, access controls, secure transfer and vendor governance; (4) Algorithmic systems and AI: requirement for safety testing, documentation of model inputs/outputs, and human oversight for automated verification or recommendation tools; (5) Transparency and audience engagement: disclosure of methods, data sources and use of automation; (6) Data subject rights: mechanisms to respond to correction, deletion and objections; and (7) Capacity-building: training, accredited trainers and community of practice for media professionals. Practical annexes include editorial checklists, breach-notification flowcharts and sample consent and data-sharing text for sourcing material.

Implementation Framework

The guide proposes a phased approach: initial gap analysis and data inventory; short-term fixes (policies, basic security, incident response); medium-term measures (DPIAs, contractual updates, staff training); and long-term embedding (audits, certified processes, periodic review). It emphasises proportionate measures for smaller outlets and prescribes scaled governance commensurate with processing risk. The draft encourages collaboration with the ODPC for technical guidance and cross-sector standards and suggests that MCK develop accredited training modules and a register of certified data and AI trainers to support roll-out.

Monitoring and Evaluation

MCK's draft sets out monitoring mechanisms including regular internal audits, publication of transparency reports, and submission of anonymised compliance summaries to MCK for peer benchmarking. It suggests indicators such as number of DPIAs completed, incidents reported and time to resolve data subject requests. Where appropriate the guide recommends independent assessments or external audits for high-risk processing and proposes an MCK-led peer review mechanism to foster continuous improvement.

Penalties, Liability, and Appeals

As a non-statutory sector guide, MCK's draft itself does not create criminal sanctions but makes clear that non-compliant conduct may attract enforcement under the Data Protection Act, 2019 and other laws. The guide outlines disciplinary and editorial remedies a media house may use for breaches of internal policy and recommends escalation paths to the ODPC where statutory breaches occur. It also explains rights of appeal and remedies for data subjects under existing legislation and encourages media houses to maintain insurance and legal support for potential liability arising from data handling and publication.

Relationship to Other Instruments

The draft situates itself alongside the Data Protection Act and regulations, the Kenyan Constitution's protections for freedom of expression and access to information, sectoral laws such as the Kenya Information and Communications Act, and national digital strategies. It recommends cross-references to national AI strategy and to international standards and guidance (for example those developed by UNESCO and international press freedom bodies) to ensure media practice remains consistent with broader policy frameworks.

International Alignment

The guide references international norms for data protection and ethical AI and proposes alignment with widely accepted principles like transparency, human oversight and non-discrimination. It highlights Kenya's participation in regional and global fora and suggests adoption of comparative practices (e.g., risk assessments, impact assessments and documentation) used in other jurisdictions to facilitate cross-border data sharing for investigative journalism while protecting rights.

Implementation Timeline

Sources and References