The High Court has given the Katiba Institute and law scholar Yash Pal Ghai the go-ahead to challenge the roll-out of Huduma Namba cards over lack of guarantees of theft or misuse of Kenyans personal information. This comes after the lobby group argued that the State failed to subject the fresh registration of Kenyans to the Data Protection Impact Assessment (DPIA) — a requirement under the law.
The High Court has allowed @katibainstitute and law scholar Yash Pal Ghai permission to challenge the roll-out of Huduma Namba cards over lack of guarantees of theft or misuse of Kenyans personal information. https://t.co/po8UxUDk6V
— Katiba Institute (@katibainstitute) November 27, 2020
The assessment is aimed at flagging risks that could reveal breaches of privacy, loss data and unlawful use of information like names, date of birth, postcode and residences. As of next week, Kenyans will start receiving Huduma Namba cards in a gradual rollout. This means that as of December next year, the current National Identity Cards will be invalid.
Justice Jairus Ngaah certified the case as urgent and directed the lobby group and Prof Ghai to file the case and serve it to Cabinet secretaries Joe Mucheru (ICT), Fred Matiang’i (Interior) as well the Attorney-General Paul Kihara and Data Commissioner Immaculate Kasait. The judge, however, rejected a plea to stop the roll-out, which the government announced would start on December 1.
“I am satisfied that the application is urgent and is hereby certified as such. I am also satisfied that the applicants merit a grant of leave to file a substantive motion for judicial review orders for prohibition restraining the respondents, their servants and agents from executing the decision of November 18, 2020, to roll out Huduma cards before and without a data protection impact assessment,” the judge said.
Katiba Institute, however, argued that the government’s plan to roll-out Huduma cards before conducting a data protection impact assessment as required by section 31 of the Data Protection Act. According to the act, “Where the resulting operation is likely to result in a high risk to the rights and freedoms of the data subject, by virtue of its nature scope context, and purposes, a data controller or data processor, prior to the processing conduct an impact assessment.”
Under Huduma Namba, the State will combine all vital documents including the national ID, passport, driving licence, National Social Security Fund and the National Hospital Insurance Fund numbers. The Huduma Number registration required a photo, information about themselves, their parents or guardians, place of birth, phone number, e-mail address, physical and permanent residence and marital status.
Data collected through the Huduma Namba registration will be stored in the Integrated Population Registration System — the central location for easy electronic access by institutions, including private corporations that provide crucial and sensitive services.
Lawyer Dudley Ochiel said due to the lack of publicly available information on the system, it is unclear where and how personal data, and which data, will be stored and processed, between the cards themselves and other components of the NIIMS system.
“Data protection impact assessment is a necessary mechanism for alleviating this gap and mitigating the risks associated with the system, including the production and rollout of Huduma Namba cards,” he said.