Abstract
A marketer ’ s primary concern in data protection is how to mitigate consumer privacy expectations whilst exhaustively exploring and utilizing data available for best marketing strategies .
The goal of marketing and using data is to make informed decisions , optimize marketing strategies , and create more relevant and valuable interactions with consumers . Data is a valuable tool for achieving these objectives , as it provides the insights and metrics needed to measure , adapt , and improve marketing initiatives .
Genesis
Data Protection law in Kenya is cemented in the supreme law of the land which is the Constitution . The Constitution was promulgated on 27 August , 2010 and its Article 31 guarantees every person ’ s right to privacy .
This provision stipulates that every person has the right not to have their person , home or property searched , their possessions seized , information relating to their family or private affairs unnecessarily required or revealed or the privacy of their communication infringed .
The Data Protection Act No . 24 of 2019 ( hereinafter referred to as “ the Act ”) was enacted on 25 November , 2019 pursuant to the aforementioned Article 31 of the Constitution .
The Act at Section 5 established the Office of the Data Protection Commissioner and the Data Protection Commissioner as its head and accounting officer . She oversees enforcement of the Act and maintains a register of data controllers and processors and is mandated to promote self-regulation among data controllers and processors .
Nexus between marketing and data protection
In examining data protection in marketing , it is vital to define what personal data means and differentiate between data privacy and data protection .
Personal Data is simply any information relating to an identified person or identifiable natural person .
Sensitive personal data is any information on a data subject ’ s race , health status , ethnic social origin , genetic data , biometric data , sex or sexual orientation of the consumer , spouse or spouses , marital status , a person ’ s children or parents or any family data .
Data privacy concerns who has access to that data but data protection lays emphasis on the tools , policies and mechanisms employed to restrict access to data .
The Act does not expressly refer to marketers just as it does not expressly refer to other professionals but the Third Schedule of the Data Protection ( General ) Regulations , 2021 which was gazetted on 14 January , 2022 lists businesses that are wholly or mainly in direct marketing as amongst those that shall mandatorily register as data controllers and processors .
Data Controller and Data Processor
A data controller is defined as a natural or legal person , public authority or entity which alone or jointly with others determines the purpose and means of processing of personal data while a data processor is a natural or legal person , public authority or entity which processes personal information for a data controller .
Data Subject
A data subject is an identified natural person whose data is the subject of personal data .
This definition of data controllers and data processors gives the Data Protection Commissioner a wide latitude in application and enforcement of the Act .
We will for purposes of this article presume marketers to be data controllers and processors and consumers the data subjects .
Moreover , Paragraph 14 of the Data Protection ( General Regulations ), 2021 defines what constitutes commercial use of data in direct marketing . It is where data or personal information is used to advance economic interests by sending a catalogue through any medium addressed to a data subject , displaying an advertisement on an online media site where a data subject is logged on using their personal information , and advertisement in the form of sending electronic messages to data subjects using their personal information .
It further states that marketing is not direct where personal information is not used to identify recipients .
Implications of data protection
Personal Data , the new oil , is a strategic asset but there must be ethical boundaries in its processing for marketing purposes . There must be interest in this subject by marketers for the following reasons :
( a ). The law requires a marketer to practice within the confines of the Data Protection Act No . 24 of 2019 . A statutory breach may culminate in the imposition of an administrative fine not exceeding five million shillings or to imprisonment for a term of not more than two years or both .
A data controller or processor who uses personal information for commercial purposes without the consent of a data subject may upon conviction be fined a sum not exceeding twenty thousand shillings and to imprisonment for a term not exceeding six months or to both as stipulated in the Data Protection ( General Regulations ), 2021 .
( b ). Respecting privacy can enhance consumers ’ trust in marketers and their products which may lead to a more accurate feedback .
( c ). Better data quality that is accurate and up-to-date .
( d ). Adhering to data protection laws and principles can improve a company ’ s data management model .
( e ). It can save the company ’ s time and costs that may be expended in man hours needlessly incurred in the defense to complaints lodged with the data protection commissioner by data subjects .
( f ). Consumers want their privacy respected . In the year 2015 research conducted by EMC2 Corporation in fifteen countries found that 87 per cent of respondents supported data protection legislation to prohibit trading of their data without consent . The Constitution of the Republic of Kenya which is the anchor of data protection was approved by 67 % of Kenyans in the referendum before its promulgation on 27 August , 2010 as aforementioned .
( g ). Less risks of data breaches and cyberattacks .
( h ). Minimizes potential harm or distress to consumers . This ought to be a marketer ’ s first reason for compliance with consumer privacy expectations .