324
The Data Protection Bill, 2018
a school processing the information for purposes
of providing special support for students in
connection with their health;
a public or private body acting under a lawful duty
to manage the welfare of a data subject; or
an administrative body, pension fund, or employer
processing information for purposes of
implementation of the law relating to the health of
the data subject.
29. An agency shall not process personal data of a
child unless the processing iscarried out with the prior consent of the parent or
guardian or any other person having the authority
to make decisions on behalf of the child;
necessary to comply with the law;
for research or statistical purposes; or
publicly available.
30. An agency may process personal information
concerning a data subject's political persuasion if the
agency is a political party formed under the Political Parties
Act or public entity whose functions are political in nature
and the personal informationrelates to the members of the agency; and
is necessary to the formation or carrying out of the
activities of the agency.
31. An agency shall not transfer personal data of a
data subject outside the territory of the Republic of Kenya
unlessthe third party is subject to a law or agreement that
requires the putting in place of adequate measures
for the protection of personal data;
the data subject consents to the transfer;
the transfer is necessary for the performance or
conclusion of a contract between the agency and
the third party; and
the transfer is for the benefit of the data subject.
PART IV—OVERSIGHT AND ENFORCEMENT
32. The Commission shall oversee the implementation
of and be responsible for the enforcement of this Act.
Personal data of
children.
Data subiect's
Political
No. Ilof 2011.
Transborder flow
of personal data.
Role of the
Commission.