New Kenya High Court Judgment Sets Important Precedent for Digital ID Privacy Protections and Processes
Source: Open Society Justice Initiative
NEW YORK—The Open Society Justice Initiative welcomes a recent judgment handed down by the High Court in Kenya declaring the data collection and roll-out of biometric Huduma cards for the country’s digital ID system, the National Integrated Identity Management System (NIIMS), unconstitutional. In the decision, Justice Ngaah held that the Data Protection Act of 2019, which was operationalized in 2020, should be applied retroactively to the government’s rollout of NIIMS, which was began in November 2020.
Filed by Kenyan constitutional law scholar Yash Pal Ghai and Katiba Institute, a civil society organization, the High Court case sought to challenge the rollout of the system without a prior data protection impact assessment. Saying that the Kenyan government had “put the cart before the horse”, Justice Ngaah noted in his decision that the state should have ensured that the legal framework for protection of the right to privacy was in place before taking action “likely to infringe” on this right under the Kenyan constitution. In addition to finding the introduction of Huduma cards to have been unconstitutional, the High Court’s judgment orders the government to conduct a data protection impact assessment of the identity card program in accordance with the Data Protection Act prior to processing data in the system.
The ruling highlights an important matter regarding protective mechanisms for digital ID systems more generally, namely that legal and regulatory frameworks should be in place before these wide-ranging systems are introduced. Civil society has called for technological safeguards to be transparent and built into the design of the databases, warning that rolling out a system before implementing governing legislation and regulations would run a high risk of endangering sensitive biometric and personal data.