By Diana Meso

The Division of Legal Services partnered with Lensiko, Njoroge and Gathogo Advocates to hold two webinars on Monday March 28 and Wednesday March 31 respectively, aimed at training staff on legal matters including data protection, investigation and report writing, complaint handling mechanisms, legal obligations of USIU-Africa to employees of outsourced service providers as well as Human Resource & Labor law matters of interest.

Both webinars were moderated by Ms. Helen Ambasa, Director, Legal Services and facilitated by Dr. Tom Kabau, Partner, Lensiko, Njoroge & Gathogo Advocates and Chege Njoroge, Managing Partner, Lensiko, Njoroge & Gathogo Advocates. It attracted staff from various departments and divisions across the university including Human Resource, Finance, Security, Admissions Office as well as School of Graduate Studies, Research and Extension.

Speaking on Data Protection, Dr. Kabau pointed out that as an education institution, USIU-Africa handles a lot of sensitive data including a person’s race, health status, marital status, family details, sex among other things from staff, students, parents and even suppliers. He went on to appreciate the efforts that the university is undertaking to ensure that they comply with the requirements under the Data Protection Act of 2019.

Dr. Kabau cautioned the participants about the salient features under the Data Protection Act and mentioned the following points as crucial to the university:

• It is paramount to obtain prior informed consent from data subjects;
• An organization should not transfer data to other countries unless they have the rights to do so;
• In instances where data is accessed in an irregular manner with third party, the data subject should be notified;
• There should be reasonable retention of personal data;
• An organization should undertake Data protection impact assessment before implementing its data protection policy;
• Data subjects have a right to be informed on how their data will be used and to whom it will be shared and why;
• Students reserve the right to know how long the university will hold their data and for what purposes.

Additionally, Dr. Kabau said that the university can comply with the salient principles under the Data Protection Act through developing policy statement through which data subjects can be informed on how the data is being used, issuance and signing of consent forms, development of compliance manuals and checklist to guide staff in obtaining and dealing with personal data as well as training for staff.

On the other hand, Mr. Chege Njoroge stated that for the university to efficiently and effectively implement and comply with the Data Protection Act, there is need to develop a data strategy at the highest management level, invest in digital infrastructure that include encryption of data and frequent auditing of the digital infrastructure for compliance. He further said that the university should also consider other laws like the 2017 Health Act, 2006 HIV and Aids Act as well as the Consumer Protection Act which are also intertwined with the Data Protection Act.

Digging deep into the issue of how long can the university hold a student/staff/parent/supplier data, Dr. Kabau said that the university should hold data in good faith and reasonableness. He said that universities are expected to hold data about their graduands to enable them deal with future issues like validating certificates. He however cautioned the university about holding on to data of parents or visitors who just come to visit adding that there are different categories of data that should be stored or deleted.

In the same vein, Mr. Njoroge said that when it comes to data storage, the principles of lawfulness, fairness and transparency should apply. He also said that the university should minimize the data they store or ensure that the data they have is anonymous at certain levels.

In responding to Ms. Ambasa’s questions on whether it is okay for banks to email a staff on the salary income through work email, Mr. Chege said that employees should be given leeway to agree or not to agree or provide alternative personal emails for that purpose adding that it is wrong to collect data for a specific reason and use it for another reason without consent of the data subject.
On work place investigations, Mr. Chege and Dr. Kabau stated that it is important for the investigation to adhere to the Employee Act of 2007. They highlighted the key considerations when carrying out an investigation as follows:

• What do you investigate? An issue that is likely to cause potential violation of the code of conduct or standards of the university and how serious is the allegation facing a potential employee and the credibility of such issue;
• How do you investigate? You need to formally establish a committee that should be documented under the Human Resource handbook which must comprise of the representatives from the Human Resource department;
• What should you consider? If the issue will present a material liability to the company, a serious crime by an employee that may result to their dismissal or criminal offence being pursued against them, caliber of staff involved, resources available and gravity of the offence, what other avenues have been explored to resolve the issue, laws of the country (Fair Administration Act, 2015);
• What happens after that? A well-documented and transparent report should be presented even to the person being investigated, the resulting decision should be communicated accordingly, there should be provision to apply for appeal or review and the timelines of the whole process should be well articulated to the parties involved;

On addressing one of the most common scenarios in organizations when it comes to employees resigning while facing disciplinary actions with an aim of keeping a clean record for their next employer, Mr. Chege and Dr. Tom agreed that once an employee has resigned, he or she is under no law to continue with the disciplinary process and the only way to maybe deal with that is to deny them some benefits, which again should be clearly stated in the Human Resource handbook. However, Ms. Ambasa pointed out that in her research, countries like South Africa have adopted a system where a note about a disciplinary action of a certain employee can be attached to their file for future reference.

On complaints handling procedures, the university should properly document the procedures of reporting a grievance and the feedback channel. The employee holds the right to agree or disagree with the report after investigations.

Mr. Chege also noted that through the Occupational Safety and Health Act (OSHA) 2007, it is the university’s responsibility to ensure that their environment is a safe place for working for independent contractors as well as put necessary measures, like developing a supplier’s handbook that will guide the third-party operations.