Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR personal life; (iii) whether it involved data provided by an applicant for one purpose which was then used for another purpose and (iv) whether it was disseminated to the press or the general public or persons from whom an applicant could reasonably expect that such private information would be withheld. 754. In the present Petition, the Petitioners have alleged that the amendments to the Registration of Persons Act violates the right to privacy as it seeks to introduce the collection of biometric data, which is sensitive personal data and is intrusive. Particular mention was in this regard made of the collection of DNA, which the Petitioners claim can not only be used to reveal and profile a person’s genetic, health and other physical characteristics, but also that of their relatives. Also challenged was the requirement to provide Global Positioning System (GPS) co-ordinates, which the Petitioners claim can be used to track and conduct mass surveillance on the people in Kenya. 755. The Respondents did not dispute that biometric data in digital form will be collected in NIIMS, and argued that such biometric data is in any event already being collected in existing identification and registration databases, and was allowed by section 5(1)(j) of the Act which allowed the Principal Registrar to keep any other particulars about the identity of a person. The Respondents specifically denied that DNA and GPS coordinates data will be, or was collected in NIIMS. The Respondents however did point out and explain why DNA data and GPS co-ordinates is necessary for identification. 756. In normal parlance, biometric data is any physical, biological, physiological or behavioral data, derived from human subjects, which has the potential to identify an individual. Biometric data identifies an individual through one or more unique factors specific to the physical identity of a person. It is in this regard not in dispute that section 3 of the Registration of Persons Act was amended by the impugned Act to include a definition of “biometric” as “unique identifiers or attributes, including fingerprints, hand geometry, earlobe geometry, retina and iris patterns, voice waves and Deoxyribonucleic Acid (DNA) in digital form” It also introduces a definition of Global Positioning Systems (GPS) coordinates to mean “unique identifier of precise geographical location on the earth, expressed in alphanumeric character being a combination of latitude and longitude”. 757. In addition section 5 (1)(g) of the Act was also amended to include GPS coordinates as part of the information to be provided on place of residence, and a new paragraph 5 (1)(ha) inserted that provides for biometric data to be kept in the register of all persons in Kenya by the Principal Registrar. Lastly, a new section 9A was included, which is the one that establishes NIIMS which will inter alia harmonise, incorporate and collate data relating to registration of persons from all registers, including biometric data. 758. We start our analysis by addressing the legitimacy of the privacy concerns raised by the Petitioners about biometric data. The first observation we make in this regard is that biometric data, by its very nature, provides information about a given person, and is therefore in this regard personal information that is subject to the protection of privacy in Article 3. The Data Protection Act No. 24 of 2019 has adopted at section 2 the definition of personal data that is in the European Union’s General Data Protection Regulations (GDPR) and in the African Union Convention on Cyber Security and Personal Data Protection, namely, any information which is related to an identified or identifiable natural person. 759. The GDPR details the elements of such information as follows in Article 4(1); “The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social identity of these natural persons. In practice, these also include all data which are or can be assigned to a person in any kind of way. For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data”. http://www.kenyalaw.org - Page 124/174