By Grace Mutung’u
This is the finale in our series on Data Protection principles espoused in the Data Protection Bill.
Clause 25 of the 2019 Data Protection Bill spells out the principles of data protection. Among this is the prohibition from sharing data with third parties without the consent of the data subject.
“Third party” is a term that originates from contracts. Traditionally contracts are between two parties and a third party is a person who deals with the contracting parties but is not party to the contract. In data protection however, there are typically three parties- the person whom the data concerns (data subject), the person who designs how data will be processed (data controller) and the person who actually processes the data (the data processor). In some cases, data is processed by the same organisation that is the controller. In other cases, it is processed by a third party processor. A third party processor would not typically require further consent to process data on behalf of the data controller.
For example, a manufacturing firm may outsource their payroll function to a HR firm. The manufacturing firm is the data controller as they determine which data is collected, and how it is processed. The HR firm is the third party data processor and employees of the manufacturing firm are data subjects.
The Data Protection Bill envisages that the data controller will inform the data subject of the use to which their data is being put. Clause 26 lists the rights of the data subject, and they include the right to be informed about their data use; right to access their data in the custody of the controller or processor; as well as the right to object to processing of all or part of their personal data. In the above example, the manufacturing firm would need to inform their employees that their personal data is processed by the payroll company.
In the event that the data controller or processor were to share the data with a third party, then the consent of the data subject would be needed. Clause 25(g) states:Continue reading