Business and Technology Reporter in Nairobi, Kenya
Nation Media Group
Kenya is planning to join a long list of jurisdictions around the world that are restricting the use of their citizens’ data and information mined within their borders to train artificial intelligence (AI) models, especially by foreign organisations.
In its recently published AI Strategy and Diplomat’s Playbook on Artificial Intelligence, Nairobi has emphasised the need for a robust data governance mechanism to strengthen data sovereignty and protect its citizens from data exploitation by foreign developers.
The strategy will guide the country’s policymakers and lawmakers on the priorities and challenges on the road to AI regulation in the country, while the diplomats’ playbook will guide Kenya’s missions on their advocacy and dealings on AI issues.
As part of the plan to create an AI data governance framework, the Kenyan government plans to “classify, categorise and regulate access to data collected within Kenya and from Kenyans,” and limit the use by foreign companies in training models.
Nairobi says it will also “enhance data residency requirements and ensure compliance with national data laws and regulations regarding data handling and storage,” a move meant to ensure that data mined from Kenyans is stored in data centres within the country.
“Kenya relies heavily on foreign data centres to process and store datasets produced in the country and about Kenyans, raising concerns about data sovereignty and the potential for external entities to control or influence key AI data,” said the ICT Ministry in the recently published AI Strategy.
“This dependence on external entities for data storage and management raises concerns about the potential loss of control over critical AI data, which could expose the country to data exploitation, external manipulation, privacy breaches, dependency on external AI solutions, and national security threats.”
Based on the strategy, developing a framework to restrict access of Kenyans’ data by foreign organisations will be part of the prioritised regulations to enable “effective management and ethical use of data” in Kenya’s AI ecosystem.
At the same time, Kenya’s diplomatic missions abroad have been tasked with advocating for digital and data sovereignty in the international community, paving the way for the roll-out of restrictions on use of locals’ data.
“Kenya advocates for digital sovereignty within international law, ensuring control over our AI systems and data, while promoting global collaboration for shared prosperity,” the Foreign Affairs Ministry said in the playbook shared with diplomatic missions last week.
Studies show that the use of AI is already advanced in Kenya, with the majority of people generally warming up to the technology and feeling optimistic about its future in the country and globally.
For instance, the Global Public Opinion on Artificial Intelligence done by the University of Toronto last year revealed that 25 percent of Kenyans understand what “AI” is, while globally just 24 percent of people do.
Usage of AI tools such as large language model (LLM) ChatGPT also tramps many countries worldwide and the global average. The research revealed that 80 percent of Kenyans are “aware” of ChatGPT, compared to 61 percent globally, while one in four Kenyans use the technology, against a global average of 17 percent.
While a number of jurisdictions across the globe have implemented restrictions on use of their citizens’ data to train AI tools, Kenya might be the first in Africa both to have such restrictions and to regulate AI.
Other jurisdictions with similar restrictions include the European Union, Singapore, China, and Russia.
Currently, Kenya’s data protection laws require any company that handles people’s personal information to register with the Office of the Data Protection Commissioner as data handlers or data processors and provide their data protection strategies and policies.
However, many tech companies that collect user data in Kenya, sometimes even without the data subjects’ consent or knowledge, are yet to register in the country, and the new rules may bar them from collecting that data.