be found in Section 41(3) of Kenya’s Data Protection Act No. 24 of 2019, which mandates the adoption of the data protection-by-default principle.<sup>8</sup> Limiting decision-making solely based on automated processing becomes important with the increasing practice of profiling used in various data economic activities. Profiling is the practice of using personal data, specifically data on individuals’ various personal attributes, in order to analyze and predict their behavioral preferences based on their economic status, interests, health, or work performance. On top of this, the data controller may also make decisions about data subjects through automated means, without human oversight. While profiling and automated decision-making may boost efficiency and cost savings for data controllers, these practices may have serious negative impacts on data subjects, perpetuating bias and discrimination. Individuals may see their freedom to purchase products online diminished due to an algorithm that has locked them into a specific category or, in the worst cases, subjected them to unjustified discrimination (Article 29, Working Party 2018). A limitation to the making of decisions about individuals solely as a result of automated processing of personal data is found in about 30% of the countries sampled, with minimal differences recorded across income groups.

# _4.3.5 Safeguards: Nonpersonal data_

The level of safeguards for nonpersonal data is another dimension assessed under the safeguards pillar. It mainly covers two issues: whether IPRs can be cited to prevent the sharing of data and whether a country’s regulatory framework includes provisions on the confidentiality of third-party rights in nonpersonal government data, such as company registers or business data underlying official statistics.

Results show that 70 percent of countries do not allow the use of IPRs to prevent data sharing or have no specific provision for the matter. Most low-income countries have not established relevant legislation on IPRs at all, not to mention the leveraging of such rights to facilitate or prevent data sharing. With regard to the confidentiality of third-party rights in nonpersonal government data, it is not regulated in any lowincome country but is addressed by 14 percent of high-income countries. For instance, Canada protects third-party rights in nonpersonal government official statistics made available publicly, preventing the manipulation of databases to identify individuals, businesses, or organizations.<sup>9</sup> Only 7 percent of the sampled countries worldwide regulate third-party confidentiality in nonpersonal government data.

# _4.3.6 Safeguards: Cybersecurity and cybercrime_

In order to be effective, safeguards for personal and nonpersonal data should be linked with legal and technical cybersecurity measures. Mandating the implementation of security measures in technical infrastructure, as well as adopting provisions against cybercrime—that is, the criminalization of unlawful or illegal access or use of infrastructure, systems, and data—are crucial to build a robust safety net for data economy activities. Therefore, the cybersecurity and cybercrime dimension collects information on four elements: security requirements for automated processing of personal data; cybersecurity requirements for data processors/controllers; existence of a national computer emergency response team (CERT); and existence of provisions that criminalize cybercrime.

> 8 The law can be accessed at:

> <u>http://kenyalaw.org/kl/fileadmin/pdfdownloads/Acts/2019/TheDataProtectionAct__No24of2019.pdf.</u> 9 The terms and conditions of Statistics Canada Open Licence can be accessed at the following link: <u>https://www.statcan.gc.ca/eng/reference/licence.</u>

16