When “without lawful excuse” becomes the ultimate alibi: The mens rea mirage in sections 72–75 of Kenya’s Data Protection Act, 2019
The Mt Kenya Times 
By Jerameel Kevins Owuor Odhiambo
In November 2019, Kenya enacted the Data Protection Act to give effect to Article 31 of the Constitution. By early 2026 the Office of the Data Protection Commissioner had received more than 9,000 complaints, issued hundreds of determinations, ordered compensation in 184 cases, and imposed administrative penalties running into tens of millions of shillings. Even so, criminal prosecutions under the very provisions designed to punish the most serious invasions of privacy remain vanishingly rare. Sections 72 to 75 stand as the Act’s criminal spine, yet the mental element they demand the mens rea is so anaemic that sophisticated data predators can treat it as a polite suggestion rather than a barrier. This is not a drafting oversight; it is a structural failure that converts constitutional privacy into a negotiable commodity.
Section 72 criminalises the core wrongs: a data controller who, “without lawful excuse,” discloses personal data incompatibly with the purpose for which it was collected; a processor who discloses without the controller’s prior authority; any person who obtains access or discloses to a third party without authority; and the offer to sell data obtained in breach. Section 73 supplies the general penalty fine not exceeding three million shillings or imprisonment not exceeding ten years, or both plus forfeiture and prohibitory orders. Section 74 empowers the Commissioner to issue codes and certifications; section 75 is spent. The architecture looks stern. The mental element does not.
The phrase “without lawful excuse” is the entire mens rea the statute bothers to articulate. Unlike the Computer Misuse and Cybercrimes Act, which insists on “intent” and “knowing” unauthorized access, or classic common-law offences that require knowledge, recklessness or intention, section 72 leaves the guilty mind largely undefined. In Kenyan criminal jurisprudence, “without lawful excuse” often operates as a hybrid: the prosecution proves the actus reus, and the accused may raise an excuse that the court assesses. The practical effect is closer to strict liability dressed in the language of excuse. A digital lender that harvests phone contacts and bombards family members with debt-shaming messages can claim commercial necessity. A school that plasters a child’s face on billboards without parental consent can plead marketing exigency. A foreign firm that scraped biometric data under the guise of “world-changing technology” can assert research purpose. The excuse becomes elastic; the crime becomes optional.
History sharpens the indictment. Colonial Kenya perfected the art of treating African personal data as administrative raw material pass books, identity cards, forced registrations without any notion that the subject possessed a protectable inner life. Post-independence regimes refined the technique under the banner of national security and development. The Nyayo-era intelligence apparatus treated personal information as state property. When the 2010 Constitution finally elevated privacy to a fundamental right, Parliament responded with an Act that, on paper, promised to reverse the hierarchy. Yet by leaving the mental element of the criminal offences deliberately soft, the legislature preserved a familiar convenience: powerful actors could continue treating Kenyan data as an extractive resource so long as they could manufacture a plausible “excuse.”
The numbers expose the resulting farce. Thousands of complaints have poured in digital lenders leading the charge, followed by banks, schools, hospitality outlets, telecoms and health providers. Determinations and enforcement notices have multiplied. Administrative fines and compensation orders have been issued. Criminal dockets under sections 72 and 73, by contrast, remain almost empty. The Commissioner’s office has shown commendable administrative energy; the criminal justice machinery has treated the same conduct as someone else’s problem. Directors and officers who authorise or turn a blind eye to unlawful processing sleep soundly, protected by the absence of any statutory requirement to prove knowledge, willful blindness or recklessness. The law demands that the data subject prove injury; it does not demand that the data predator prove a clean mind.
This asymmetry is not neutral. It correlates directly with power. The ordinary Kenyan whose phone contacts are harvested, whose medical records leak, whose child’s image is commercialized, or whose biometric data is extracted and monetized abroad has neither the resources nor the institutional leverage to force a criminal trial. The corporation or state-adjacent entity that commits the violation has both. “Without lawful excuse” therefore functions less as a standard of culpability and more as a filter that screens out the well-lawyered. Irony sharpens into satire: the very provision meant to deter the most serious privacy invasions has become the most effective shield for those invasions.
Deep insight requires acknowledging the deeper cultural and institutional failure. Kenya’s digital economy has grown with breathtaking speed mobile money, digital credit, e-government, biometric identity systems. That growth has outpaced the moral and legal imagination of those charged with restraining it. Data is treated as the new cash crop; the people who generate it are treated as seasonal labourers. Sections 72–75 were supposed to introduce a criminal conscience into this extractive logic. Instead they introduced a loophole large enough to drive a data-broker’s convoy through. When the statute fails to insist that the accused knew the disclosure was incompatible, or intended the unauthorized access, or recklessly disregarded the risk, it signals that the real offence is not the violation of privacy but the failure to invent a sufficiently creative excuse after the fact.
The actors who must now act are clear. Parliament must amend section 72 to insert explicit mental elements knowledge, intention or at least recklessness aligned with the gravity of the constitutional right at stake. The Office of the Data Protection Commissioner must stop treating criminal referral as a last resort and begin systematically building files that the Director of Public Prosecutions cannot ignore. The DPP must treat these offences as public wrongs rather than private disputes suitable only for compensation. The Judiciary must resist the temptation to dilute “without lawful excuse” into a catch-all defence of commercial convenience. Corporate boards and data protection officers must abandon the fiction that administrative fines are the cost of doing business; personal criminal liability of responsible officers is the only language some institutions understand. Civil society and the media must keep naming the pattern: every unprosecuted section 72 violation is another quiet auction of Kenyan dignity.
Data is not oil; it is the sediment of human lives. When the law that claims to protect those lives refuses to demand a guilty mind for the most serious invasions, it does not merely fail; it collaborates. Sections 72–75 were written in the language of criminal prohibition. They currently operate in the language of administrative inconvenience. That gap is not technical. It is moral. Until the *mens rea* is given real teeth, Kenya’s data protection regime will remain what history has taught us to recognise: a sophisticated instrument that protects the powerful from the consequences of their own appetites while leaving the ordinary citizen to gather the scattered pieces of a privacy that was never truly theirs.
The writer is a social commentator
Similar Posts by The Mt Kenya Times:
- Ronaldo walks out of Portugal camp on eve of Denmark clash
- From mobile money to AI: How technology is reshaping small businesses across Mount Kenya
- Stanbic Bank brings Ne-Yo to Nairobi in creative economy push
- Campus traders: Chasing financial freedom, risking it all
- Ruto’s Taita Taveta visit puts land and power at the heart of coastal development
About the Author
