Sections 44-46 of the Kenya DPA establish enhanced protections for Sensitive Personal Data + Section 33 for children's personal data. (1) Section 2 Sensitive Personal Data Definition (broader than GDPR): (a) Race + ethnic origin + tribe (Kenya-specific tribal categorization concern); (b) Health + including reproductive health + mental health + disability; (c) Biometric data (fingerprint + facial recognition + iris + voice + behavioural); (d) Genetic data (DNA + heritable conditions + ancestry); (e) Sex life + sexual orientation; (f) Religion + belief + conscience; (g) Marital status (broader than most jurisdictions); (h) Family details including names of spouse + children + parents (unique Kenya inclusion reflecting communal society); (i) Citizenship + immigration status; (j) Children's personal data (Section 33). (2) Section 44 Sensitive Data Processing Conditions - PROHIBITED unless: (a) Explicit Consent of data subject (written + heightened standard); (b) Employment law obligations + workplace safety; (c) Vital interests where data subject incapable of consent; (d) Non-profit body for own membership; (e) Manifestly made public by data subject; (f) Legal claims + judicial proceedings; (g) Substantial public interest with safeguards; (h) Preventive medicine + occupational medicine + healthcare; (i) Public Interest in Public Health (epidemic + pandemic); (j) Archive + research + statistics with safeguards. (3) Section 45 Conditions for Lawful Processing of Sensitive Data: (a) Necessary in interests of national security; (b) Necessary for purposes of administration of justice; (c) Necessary for performance of statutory function; (d) Sensitive data processing must follow Section 44 conditions strictly. (4) Section 46 Special Conditions for Genetic + Biometric Data: (a) Heightened consent standard; (b) Written form mandatory; (c) Specific to genetic/biometric purpose; (d) Cannot be condition of essential service unless directly related; (e) Recordkeeping requirements. (5) Section 33 Children's Personal Data Enhanced Protection: (a) Children under 18 years (Kenya age of majority); (b) Parental + guardian consent for processing; (c) Reasonable steps to verify parental consent; (d) Child-friendly Privacy Notice; (e) NO direct marketing to children; (f) NO behavioural advertising to children; (g) NO profiling for decisions affecting children; (h) Special protections for school + education sector; (i) Best interest of child principle (UNCRC ratification); (j) Vulnerable children additional safeguards (orphans + refugees + special needs). (6) Genetic Data Specific Kenya Considerations: (a) Heritability affecting family members - significant given Kenyan communal family structure; (b) Tribal identity considerations; (c) Bioethics + medical genetics; (d) National DNA Database considerations; (e) Forensic genetic data + criminal justice; (f) Genetic testing services emerging; (g) Insurance + non-discrimination. (7) Biometric Data Specific Kenya Considerations: (a) Huduma Namba (NIIMS National Integrated Identity Management System) + biometric template; (b) e-Passport + biometric passport; (c) Banking + mobile money (M-Pesa) biometric authentication; (d) Border control + immigration biometrics; (e) IEBC Independent Electoral and Boundaries Commission voter registration; (f) Smart City Nairobi facial recognition emerging; (g) Non-revocable nature concerns. (8) Health Data Specific Kenya Considerations: (a) Physical or mental health; (b) Medical records + diagnoses + treatments; (c) NHIF National Hospital Insurance Fund + Universal Health Coverage; (d) Kenyatta National Hospital + private healthcare; (e) Telemedicine emerging post-COVID; (f) Insurance health data overlap; (g) Mental health stigma sensitivity; (h) HIV/AIDS additional confidentiality per HIV Prevention and Control Act; (i) Reproductive health sensitivity; (j) Joint Commission International (JCI) accreditation for hospitals. (9) Religious Beliefs + Conscience: (a) Religious affiliation + practice + belief; (b) Significant Christian + Islamic populations + Hindu + traditional Kenyan religions; (c) Religious dietary + clothing + ritual observance; (d) Religious community membership; (e) Constitutional protection of religious freedom. (10) Marital Status + Family Details (Kenya-Unique): (a) Marital status as sensitive recognises Kenya communal society; (b) Family details including spouse + children + parents recognises extended family structure; (c) Dowry/bride price negotiations sensitivity; (d) Polygamy considerations (Marriage Act 2014); (e) Divorce + separation sensitivity; (f) Inheritance + succession overlap. (11) Penalties for Sensitive Data + Children Violations: (a) Section 63 heightened penalties; (b) ODPC escalation; (c) Civil compensation; (d) Operational suspension; (e) Criminal liability per Sections 56-62. Coordinates with EU GDPR Articles 8 + 9 + 10 + UK DPA 2018 + Convention 108+ + UN Convention on Rights of the Child (Kenya ratified 1990) + Children Act 2022 + Marriage Act 2014 + HIV Prevention and Control Act + NHIF + Universal Health Coverage + NIIMS Huduma Namba + Kenyatta National Hospital + JCI + Bioethics Committee + IEBC + Kenya Constitution + Children Act + Persons with Disabilities Act + Refugees Act + ODPC. Kenya DPA Sensitive Data + Children + Sections 33 + 44-46 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.