If a government agency stores the DNA and fingerprints of its residents can it serve them more efficiently or control them more effectively?
(Image: News Decoder)
A year after Kenya’s historic digital identity program was declared illegal, the Kenyan government is going to try again.
The decision by Eliud O. Owalo, cabinet secretary for the Ministry of Information, Communications and Digital Economy, accompanied plans to digitize 5,000 government services and make them available on a common online platform in 2023.
“We need a digital identity to facilitate virtual transactions between the government and members of the public,” Owalo told the Kenyan broadcaster Citizen TV in January.
Kenyan President William Ruto confirmed the announcement by Owalo, who subsequently promised that his ministry will complete the rollout of digital IDs by February 2024.
“This was expected,” says Mercy King’ori, policy analyst in the Nairobi office of the Future of Privacy Forum, a nonprofit organization that examines the challenges posed by technological innovation globally. “People knew this would be coming because the process had already begun, so it was just a matter of time.”
A vast database of biometrics
The process began a few years ago.
In January 2019, the government of Uhuru Kenyatta, Ruto’s predecessor, enacted a law that established the National Integrated Identity Management System, a database for storing personal information and biometrics such as fingerprints, DNA and GPS co-ordinates of all citizens and residents.
Based on the database, the government was to give each person a unique digital ID, known as the Huduma Namba.
By May 2019, the government had registered 36 million Kenyans out of a population of 47.5 million in the database. However, it soon ran into controversies.
“At the time, Kenya did not have a data protection law, so it was not very clear how all the personal information stored in the database will be protected,” King’ori said.
Discrimination by computer code
There were also concerns that the system would discriminate against marginalized communities.
“People had to present legal identity and nationality documents such as birth certificates to be registered in the database,” says Mariam Jamal, digital rights program officer at the Haki na Sheria Initiative, a nonprofit organization working on digital justice and citizenship rights in Garissa County in eastern Kenya. “We found that communities who had challenges obtaining these documents would be left out of the system.”
The Nubians, whose ancestors were brought from Sudan to Kenya to serve in the British Army more than 100 years ago, are one such community. Their representatives, along with other civil society and human rights organizations, challenged the new law before the high court of Kenya. As the court’s decision was awaited, the Kenyan government enacted a data protection law in November 2019.
Despite this, the high court stopped the government from registering Kenyans in the database until regulations and systems for ensuring the safety and security of their data are put in place. Subsequently, it held that rolling out the Huduma Namba, which entailed collecting massive amounts of personal information without conducting a “data protection impact assessment,” was illegal.
The assessment, mandated under Kenya’s data protection law, is carried out to identify and minimize the risks associated with processing personal data.
“The digital ID system itself was not declared unconstitutional,” says Jamal. “It was halted till certain legal thresholds were met. So the whole thing was conditional.”
Can privacy be protected in digital ID programs?
The petitioners have appealed the court’s decision on the basis that the court declined to review the constitutionality of the digital ID system itself.
In the past decade, digital identities have proliferated around the world, including the Aadhaar system in India, Ndaga Muntu in Uganda, eID in Estonia and e-KTP in Indonesia. The proponents of these systems argue they are essential for improving efficiency and access to government and other services.
But critics argue they pose substantial risks to individual privacy and have in fact ended up excluding already-marginalized communities. It was believed that the court rulings in Kenya would have global implications for privacy rights and inform similar debates on the challenges posed by digital IDs in other countries.
In Kenya, the Kenyatta government did take steps to follow the court’s directions. For instance, it appointed a data protection commissioner and enacted rules and regulations to govern enrolment in the database and implement the data protection law. However, there are concerns that the commissioner’s office is not equipped to perform its duties and the regulations are too technical for laypersons to understand.
The government also conducted a data protection impact assessment of the Huduma Namba system.
“A copy was submitted to the data protection commissioner but she has not spoken to its adequacy,” says King’ori. “So we don’t know whether the assessment was satisfactory.”
Digital IDs leave out those without Internet access
In 2021, the government proposed a new law to regulate Huduma Namba but was criticized for not consulting the public on it.
“The last I heard about the proposed law was in July last year,” says Jamal. “There were still questions around the exclusion of marginalized communities and whether the bill had considered the fact that many people do not have documents to prove their legal identity and nationality. There were also issues around storing the data in a centralized database and lack of clarity on which government agencies will have access to it.”
Even as these developments are in limbo, the newly elected Ruto government has renewed plans to roll out digital IDs within a year.
“I think it is a mammoth task,” says Tom Fisher, senior research officer at Privacy International, a nonprofit organization based in London. “Experiences of countries around the world show how hard it is to set up these systems. Governments need to get their departments on board as well as gain the trust of the people. In the context of Kenya, people also don’t have access to the Internet. So, it sounds like an extraordinarily tight timeframe.”
Although the Kenyan government has not yet revealed the details of its plans, Fisher said that the system should be built from the perspective of groups that are hard to reach and likely to be excluded.
“The government should be open about its design, undertake broader long-standing consultations and provide more information to the people so there is a more inclusive system at the end,” Fisher said.
(This article was corrected. A previous version misidentified Ruto’s predecessor as Jomo Kenyatta)
Three questions to consider:
- Why did the high court of Kenya declare that the Huduma Namba is illegal?
- Has the Kenyan government taken adequate steps to comply with the court’s directions?
- How can the Kenyan government make its digital ID system trustworthy and inclusive?
Shefali Malhotra is a health policy researcher based in New Delhi, and a fellow in global journalism at Dalla Lana School of Public Health, University of Toronto.