NEW YORK\u2014The Open Society Justice Initiative welcomes a recent judgment handed down by the High Court in Kenya declaring the data collection and roll-out of biometric Huduma cards for the country\u2019s digital ID system, the National Integrated Identity Management System (NIIMS), unconstitutional. In the decision, Justice Ngaah held that the Data Protection Act of 2019, which was operationalized in 2020, should be applied retroactively to the government\u2019s rollout of NIIMS, which was began in November 2020.<\/p>\n
Filed by Kenyan constitutional law scholar Yash Pal Ghai and Katiba Institute, a civil society organization, the High Court case sought to challenge the rollout of the system without a prior data protection impact assessment. Saying that the Kenyan government had \u201cput the cart before the horse\u201d, Justice Ngaah noted in his decision that the state should have ensured that the legal framework for protection of the right to privacy was in place before taking action \u201clikely to infringe\u201d on this right under the Kenyan constitution. In addition to finding the introduction of Huduma cards to have been unconstitutional, the High Court\u2019s judgment orders the government to conduct a data protection impact assessment of the identity card program in accordance with the Data Protection Act prior to processing data in the system.<\/p>\n
The ruling highlights an important matter regarding protective mechanisms for digital ID systems more generally, namely that legal and regulatory frameworks should be in place before these wide-ranging systems are introduced. Civil society has called for technological safeguards to be transparent and built into the design of the databases, warning that rolling out a system before implementing governing legislation and regulations would run a high risk of endangering sensitive biometric and personal data.<\/p>\n