The global economy and the digital revolution are both driven by personal data. Our identities are everywhere in our digital environment, from social media to the Internet of Things. Protecting personal data for your customers and other stakeholders is a vital aspect of corporate social responsibility (CSR) as it pertains to the responsible management and protection of the personal information of individuals. As companies/organizations collect, process, and store large amounts of personal data, it is their utmost
responsibility to protect it from unauthorized access, theft, or misuse.
Effective data protection safeguard measures can positively impact a company’s/organization’s CSR efforts by increasing transparency, trust, and accountability.
Companies/Organizations that process information should uphold the fundamental rights of individuals to privacy and data protection as stated in the Universal Declaration of Human Rights, the Charter of Fundamental Rights of the European Union, the European Convention of Human Rights, Convention 108+, the General Data Protection Regulation, and the Data Protection Act 2019, as well as strive
to protect these fundamental rights.
In addition to legal compliance, companies can go above and beyond to demonstrate their commitment to data protection by implementing additional security measures and transparency practices. For example, companies can implement privacy impact assessments, encrypt personal data, implement multi-factor authentication, and provide regular training to employees on data protection practices.
In his paper “Data Protection as a Corporate Social Responsibility,” Paolo Balbini offers five guidelines for socially responsible personal data protection.:
- Integrate data security and protection into the process design.
- Balance profits with the real benefits for citizens by being open with citizens about collecting their data.
- To better society, disseminate results based on statistical or anonymous data
- Use a portion of the profits to fund public
education efforts in the data-centric society.
Having Mr. Balbini’s ideology in mind, data protection can also contribute to a company’s reputation, as it demonstrates a commitment to protecting the personal information of customers, employees, and other stakeholders. Data Protection help to increase consumer trust and loyalty, ultimately benefiting the company’s bottom line.
In Kenya, the government has recognized the importance of data protection and privacy and has passed the Data Protection Act of 2019 to regulate the processing of personal data in Kenya. The Act sets out principles for data protection, including the requirement for companies to obtain consent from individuals before collecting their data; and to use the data only for the original purposes of the collection (purpose limitation principle).
Companies in Kenya can take several steps to fulfill their data protection CSR obligations. Some of these steps include:
- Ensuring that they comply with the provisions of the Data Protection Act of 2019 and
other relevant data protection regulations. - Educating their employees on data protection and privacy, and ensuring that they
understand their roles and responsibilities in
protecting personal data. - Implementing appropriate technical and organizational measures to protect personal
data from unauthorized access, use, disclosure, or destruction. - Providing transparency to individuals about how their data is being collected, processed, and used.
- Providing individuals with access to their data and allowing them to correct, amend, or delete it.
- Establishing an effective incident response plan to address any data breaches.
By taking these steps, companies in Kenya can demonstrate their commitment to data protection as a CSR issue, and build trust with their customers and stakeholders. In addition, companies that prioritize data protection are more likely to avoid costly data breaches, which can have significant financial and reputational consequences.
In summary, companies/organizations rely on the insights they gain from customer data to hone their strategy and improve the customer experience because with access to that data comes an obligation to protect it. It is a solemn duty for companies to ensure systems for data management and personal data protection are in place since consumers will ultimately hold companies that don’t do this accountable.
