Contribution by: Yvonne Muriu
In the era of technological advancement, law firms have created an online presence in order to
market themselves and give clients a chance to get to know who they are. These Websites offer
clients insights into the firm’s identity, members, practice areas, contacts, values, and mission.
Nevertheless, the advancement of technology has increased the vulnerability of these websites to
cyber security risks , including, malware, data breaches, ransomware, phishing schemes, Denial of service (DoS) and Distributed Denial-of-service (DDoS). This vulnerability calls for the
adoption of cyber security measures to protect the privacy and integrity of law firms’ digital assets.
The Constitution of Kenya, under article 31, guarantees every person the right to privacy which
includes the rights to not have information relating to their family or private affairs unnecessarily
required or revealed and the privacy of their communications infringed. To actualize this right, the
Data Protection Act (DPA) was enacted in 2019, to regulate the processing of personal data and to
safeguard the rights of data subjects as well as the obligations of data controllers and processors.
Personal data refers to any information relating to an identified or identifiable natural person. The
DPA emphasizes on obtaining consent prior to processing of a person’s personal or sensitive
personal data.
In addition to the DPA, the Computer Misuse and Cyber Crimes Act (CMCA) aims to protect the
confidentiality, integrity and availability of computer systems, programs and data. It also facilitates
the prevention, detection, investigation, prosecution and punishment of cybercrimes in order to
protect the rights to privacy, freedom of expression and access to information. The CMCA
provides for various cyber crimes including, but not limited to, unauthorized access to computer
systems; unauthorized interference; unauthorized disclosure of passwords or access codes;
computer fraud; cyber harassment; and phishing.
Furthermore, in the case of Okiya Omtatah Okoiti v Communication Authority of Kenya & 8
others [2018] eKLR, the court acknowledged that presently many citizens live significant portions
of their lives online, using computers and cell phones for business, communication, research, and
various personal activities, with mobile digital devices. The court further noted that the innovations
in information technology have enabled previously unimagined forms of collecting, storing, and
sharing personal data which infringe on the right to privacy. The court in this case emphasized the
importance of the right to privacy and data protection. Websites owned by law firms hold personal
information of the firm’s members. Consequently, law firms must take measures to ensure that
this personal data is protected from unauthorized/illegal access. This can be achieved through
firewalls and cybersecurity insurance policies.
A firewall protects the personal data of the law firm from illegal/ unauthorized access. It is a
network security device that monitors and controls incoming and outgoing network traffic based
on security rules, establishing a barrier between trusted and untrusted networks. By filtering
internet traffic, firewalls protect websites from data breaches, phishing, ransomware, and malware
attacks. On the other hand, a cybersecurity insurance policy, or cyber liability insurance cover, is
designed to help organizations mitigate risk exposure by covering recovery costs after a cyber-related security breach or similar event. These policies cover incidents such as data breaches,
ransomware attacks, business email compromise, network security liability, and regulatory fines
for non-compliance with data protection regulations. The insurance policies also cover expenses
for both first parties and claims by third parties.
With the rising number of cyberattacks, having such insurance is crucial for protecting businesses
from substantial financial losses. Therefore, law firms must prioritize cybersecurity to protect their
digital presence and maintain their credibility. In this regard, firewalls and cyber security insurance
covers are essential. Firewalls act as the first line of defense, monitoring and controlling traffic to
prevent unauthorized access and attacks. A cybersecurity insurance cover ensures risk
management, legal compliance, data protection and a coordinated incident response. By
incorporating these cybersecurity measures, law firms can protect personal data, maintain online
credibility, and navigate the digital landscape confidently, ensuring they are well-equipped to
handle evolving cyber threats and uphold the highest standards of data security and client trust.
Contributor
Yvonne Muriu
Legal Intern, MNA Law Africa LLP