The rapid advancement of Artificial Intelligence (AI) is transforming industries globally, and Kenya is no exception. AI solutions like ChatGPT have captured public imagination, prompting Kenyan businesses and the government to explore their potential. The 2018 report by the Distributed Ledgers Technology and Artificial Intelligence Task Force highlighted AI’s potential in tackling issues like corruption and unemployment, and enhancing public services.
However, this digital revolution brings both opportunities and risks, particularly concerning data protection. As Kenyan employers increasingly integrate AI into recruitment, performance management, data handling, and routine tasks, they must navigate the existing legal landscape, especially concerning the handling of personal data under the Data Protection Act, 2019 (DPA) and related employment laws.
AI and the Handling of Personal Data: A Kenyan Employer’s Obligation:
AI’s functionality heavily relies on data. Therefore, Kenyan employers deploying AI solutions must be acutely aware of data protection issues. For instance, using AI in recruitment to record and analyze candidate images, emotions, and behavior necessitates obtaining explicit consent from each candidate. Furthermore, employers must ensure that such data collection and analysis do not excessively or unnecessarily infringe upon the candidates’ right to privacy, a fundamental principle under the Kenyan Constitution and the DPA.
To ensure compliance, Kenyan employers need to establish clear policies outlining:
- Permitted use of AI tools: Defining who can use AI and for what specific purposes.
- Consent protocols: Specifying when, how, and from whom to obtain informed consent for data processing involving AI, particularly from job applicants and employees.
- Transparency and information rights: How to clearly inform individuals that AI is being used to process their data and explain their rights under the DPA.
- Data processing and storage: Establishing secure and lawful procedures for processing, storing, and retaining data collected through AI systems.
- Lawful processing grounds: Ensuring that the processing of personal data by AI aligns with the lawful bases предусмотренные in the DPA.
- Data Protection Impact Assessments (DPIA): Determining when a DPIA is necessary to evaluate and mitigate potential risks associated with AI-driven data processing.
- Significance and consequences of processing: Clearly explaining to data subjects the potential impact and intended outcomes of AI-driven data processing.
Compliance with the Data Protection Act, 2019:
The DPA and its regulations impose specific obligations on data controllers (employers) and data processors when using automated decision-making, including AI. These include:
- Preventing errors: Implementing measures to minimize inaccuracies in AI outputs.
- Using appropriate procedures: Employing sound mathematical and statistical methods in AI algorithms.
- Technical and organizational measures: Putting in place robust technical and organizational safeguards to correct inaccuracies and minimize the risk of errors in AI-driven data processing.
Therefore, Kenyan employers must thoroughly understand both the AI software they utilize and the surrounding legal framework to effectively mitigate potential legal risks associated with data protection.
Fairness in Employment and Labour Practices:
Both the Employment Act, 2007 and the Data Protection Act, 2019 emphasize fairness in employment and labour practices. In the context of AI, this includes:
- Data subject autonomy: Granting individuals the highest possible degree of control over their personal data processed by AI systems.
- Eliminating discrimination: Ensuring that AI algorithms do not perpetuate or create discriminatory outcomes based on biased data or assumptions.
- Human intervention: Incorporating human oversight and intervention in AI-driven decision-making processes to minimize potential biases and ensure fairness. AI outputs can be biased if the training data lacks objectivity or reflects existing societal biases.
Other Legal Considerations for AI in the Workplace:
Beyond data protection, Kenyan employers need to consider other legal implications of AI adoption:
- Work Injury Compensation: Assessing liability under work injury compensation laws if employees are injured while interacting with AI-powered machines and systems.
- Redundancy and Restructuring: Understanding the legal and financial implications of potential workforce reductions due to AI-driven automation, as redundancy is a highly regulated process in Kenya.
- Job Role Changes and Remuneration: Addressing potential internal realignments and changes to job descriptions and compensation for employees whose roles are affected by AI.
- Trade Union Engagement: Anticipating potential opposition from trade unions, especially if AI implementation leads to job losses or significant changes in working conditions.
- Employee Well-being: Monitoring and addressing the potential impact of AI-driven changes on employees’ mental health, morale, and performance.
To proactively manage these diverse legal risks, Kenyan employers should review and refine their existing human resource policies and invest in training staff to understand and comply with new AI-related policies and develop necessary technical skills.
Global Trends in AI Regulation:
While there are no specific, universally accepted AI laws yet in Kenya, the global landscape is evolving. The European Commission’s 2021 proposal on AI regulation offers insights into potential future legal frameworks, addressing high-risk AI systems in employment management, algorithmic discrimination, and prohibited AI practices. The enactment of such laws globally will necessitate Kenyan businesses to assess their AI systems for compliance.
The Cost of Non-Compliance:
Failure to comply with data protection and other relevant laws when using AI can lead to significant legal consequences, including fines. The European Union’s experience, with data protection authorities fining companies millions of euros for unlawful use of algorithms and lack of transparency, underscores the potential financial and reputational risks. Policymakers worldwide advocate for AI systems that prioritize privacy, data governance, transparency, accuracy, non-discrimination, fairness, and diversity.
A Call to Action for Kenyan Businesses:
The time is ripe for Kenyan businesses to strategically consider the current and future impact of AI on their operations and take proactive steps. For employers, investing in workforce development to acquire the necessary AI-related skills and staying informed about evolving legal developments in this area are crucial. Employees, in turn, must embrace a mindset of continuous learning and adaptability. By proactively engaging with the opportunities and challenges presented by AI, Kenya can harness its full potential while safeguarding fundamental rights and fostering a responsible and ethical technological future.