Kenyan government put the ‘cart before the house’ on data protection and must live with the consequences, says court

22 October 2021 · Carmel Rickard

The high court in Kenya has taken a strong line on protection of personal data related to the government’s new ‘huduma’ identity cards. The cards are meant to do away with the need for many cards related to various government services – ID, passport, clinic cards, driving licences and others. Collection and collation of the data needed for the new, all-encompassing cards has already taken place and the cards are now available for collection. However, a court challenge to the government’s failure to put in place any screen that would protect the privacy of the individual, has just been finalised in the high court, Nairobi. The presiding judge, Ngaah Jairus, has held that the government put the cart before the horse and that it was unconstitutional to have collected data without first ensuring the constitutional right to privacy would be protected.

Read judgment

Top government officials in Kenya have acted with anger to a high court decision throwing doubt on the validity of the country’s new all-encompassing huduma (“service”) identity cards.

The rollout of data collection began in December 2020, and millions of the new cards have already been collected. The government has, however, expressed concern that people are taking so long to collect the balance of the cards.

Now, though, in the wake of the high court’s decision, and the government’s determination to appeal against it as soon as possible, the validity of the cards that have been collected is uncertain.

‘Misguided’

Fred Matiangi, interior affairs and coordination of national government cabinet secretary, was particularly colourful in his response to the decision. The judge who heard the case, Ngaah Jairus, was ‘grossly misguided’ in his findings. Matiangi said all the different sources of data held by government were being brought together ‘so that you are one person’, and so that ‘you use one card and one number to access services’.

‘We cannot be the only country where you need a handbag to carry your cards,’ he said.

The new system had been challenged indirectly in what has come to be called the Nubian Rights Forum case. That earlier case led to a high court judgment declaring that the collection of DNA and GPS co-ordinates for the purposes of identification was ‘intrusive and unnecessary’ and where it was not specifically ‘anchored in the empowering legislation’ it would be unconstitutional.

Comprehensive

The court in that case also held that the government could go ahead with implementing the planned national integrated identity management system (NIIMS) and use the data it collected for that purpose, but could do so only if an appropriate and comprehensive regulatory framework for NIIMS that complied with the constitutional requirements identified in the judgment, was first enacted.

In the meantime, while that case was being finalised, parliament enacted the Data Protection Act and the court in the Nubian Rights Forum case directed that the processing of data collected for the Registration of Persons Act should wait until the Data Protection Act started working.

The government did not wait, however, and began collecting data and issuing cards before the Data Protection Act began full operation.

Defiance

Another group of petitioners then went to court asking to set aside the government’s decision to roll out the huduma cards without first carrying out a data protection assessment under the Data Protection Act. They argued that, in doing so, the government had acted in defiance of the court orders in the Nubian Rights Forum case.

Government, and the new data commissioner under the Data Protection Act, Immaculate Kasait, objected to the application.

They said it was true that the law required a data protection impact assessment to be carried out where processing of personal data was likely to result in ‘high risk to rights and freedoms of the data subject’. However, at the time that personal data was being collected for NIIMs, that impact assessment was not a requirement (because the law had not yet become operational).

Privacy

The new data law imposed a new duty but did not apply retrospectively, they said.

On this issue, Judge Jairus said the constitution gave a right to privacy and from the preamble and purpose of the new law it was clear that the Act was intended to be retrospective to cover any action taken by the state that might affect the right to privacy.

He added that the government should have had the new law in place before it began collecting and processing personal data. ‘But since the state chose to put the cart before the horse, so to speak, it has to live with the reality (that) there now exists legislation against which its actions must be weighed’, regardless of when the actions were taken, if these actions affected an individual’s right to privacy.

Scale

‘To put it straight, there is no other scale upon which to weigh the actions of the state to collect and process personal data except that provided by the Data Protection Act, at least to the extent that it is an Act meant to put into effect the constitutional right to privacy’.

Commenting on argument by the state, he said that an individual’s constitutional rights were under threat ‘by the excesses of the state in collecting and processing data without prior legal framework to ensure that even as the state embraces a new system of identification, the right to privacy is protected.’

Because of this, said the judge, the new law ‘is more of a bulwark against the excesses of the state than a tool imposing new obligations or duties on the state.’

Fairness

Where did fairness lie in terms of protection of the individual right to privacy?

Was it in the retrospective application of the Data Protection Act or in the rule against such application? ‘I would stand with the individual or the citizen against the might of the state and hold that fairness is in interpreting section 31 as being retrospective in its application.’

In addition, there was no suggestion that the judgment in the Nubian Rights Forum case had been overturned. Therefore, the government parties could not deny that they were bound by that judgment.

Data impact assessment

The judge found that a case had been made for judicial review of the government’s roll-out decision, mostly on the ground of illegality.

If the government had appreciated the importance and extent of the application of the Data Protection Act when it came to collecting and processing date collected under NIIMs, it would have conducted a data impact assessment before getting hold of personal data and using it in the rollout of the Huduma cards.

Judge Jairus added, ‘It has been a while since the rollout or the launch of the Huduma Card and it is not clear whether it is still on or has been concluded.’

He concluded that because this case was ‘of substantial public interest’, he would not make any order on costs.

* 'A matter of justice', Legalbrief, 19 October 2021

Carmel Rickard

About the author

Recent articles by Carmel Rickard

‘No justification for the unjustifiable’: Lesotho’s ombud slams grand-scale torture, assault in Maseru prison

22 March 2024
Carmel Rickard

Lesotho’s national ombud, Tlotliso Angelina Polaki, has issued a scathing report on massive-scale torture and assaults that took place in Maseru’s central correctional institution during December 2023, leaving about 95% of the inmates of the prison injured, one dead and one who is now wheelchair-bound and will never walk again.

Major court decision on image rights benefits Ugandan soccer players

21 March 2024
Carmel Rickard

Members of Uganda’s national soccer team from the period around 2007/8 have just been awarded a payout against MTN Uganda by the commercial court. The telecom giant had a year-long contract with Proline, the players’ originating development soccer club, allowing it to use the players’ images for advertising. But MTN had continued to use their images even after that contract expired on the basis that it had a sponsorship agreement with Fufa, soccer’s governing body in Uganda. The players then challenged MTN in court, through Proline, and have now won a significant damages award. But the judgment exposed some serious flaws in the way that Fufa has approached the question of using the image rights of its senior players, and the court commented that this is a ‘case study’ for why Fufa needs to sort out its contractual arrangements with senior players.

Executive interference in Ugandan court decisions continues – this time by the justice minister

21 March 2024
Carmel Rickard

Uganda’s minister of justice, Norbert Mao, has taken a leaf straight from the book of the country’s president, Yoweri Museveni. This week, the minister wrote to the principal judge of the Ugandan high court, asking that the judge directly intervene in a matter that has been brought to his attention by an MP on behalf of a constituent. Mao asked for the ‘immediate administrative intervention’ in the matter by the principal judge. Earlier this year, Museveni wrote a similar letter to the chief justice of Uganda, also requesting intervention in a matter, and the CJ later indicated that this was not the first time it had happened.

Is rape by family members treated too lightly by the law?

19 March 2024
Carmel Rickard

The high court has sent the case of a Malawian teenager, charged with raping his 89-year-old grandmother, back to the magistrate’s court for a possible re-trial because the court had wrongly prosecuted a case of rape instead of incest. If convicted in a re-trial, however, Malawi’s incest law could see the accused sentenced to a mere five years. Malawi’s penal code provides for a significant difference between the sentence to be imposed when a man rapes a close family member, and in a case where the two are not related. When they are unrelated, the code provides that a rape offender ‘shall be liable to be punished with death or with imprisonment for life’ (However, Malawi has had what amounts to a moratorium on carrying out the death penalty since 1992.) By contrast, ‘incest by males’, is categorised in the code as a ‘felony’, and anyone convicted ‘shall be liable for imprisonment for five years’. There is an exception: if it is proved ‘that the female person is under the age of 16, the offender shall be liable to imprisonment for life’.

Prominent SA advocates lose battle over conviction in Namibian courts for working without a permit, misleading immigration officials

6 March 2024
Carmel Rickard

Two prominent South African advocates have just lost their last hope of squashing their convictions in the Namibian courts. Johannesburg advocates, Mike Hellens SC and Dawie Joubert SC, had been found guilty on two counts, first, working as legal practitioners without an employment permit, and second, giving false or misleading information to immigration officers when they entered the country in 2019. Though they had gone to Namibia to appear in court in a bail application, they told the immigration officials they were there for a ‘visit’ and for a ‘meeting’. Both appealed against their conviction but they had also asked for a judicial review of the decision. In the high court they lost their appeal but won on the review. The outcome in both matters were taken to the apex supreme court for a final word. In December 2023, they lost their appeal at the supreme court. What would that same court say when the state appealed against the review finding? The supreme court has now given its answer: it found the review, that had favoured Hellens and Joubert, was wrongly decided, and set it aside, awarding costs against the two advocates in both the high court and the supreme court.