Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR consent, the consent must be given or authorised by the verified holder of parental responsibility over the child. The status of the data given by a child upon attaining the age of majority and the rights to that data also needs to be addressed by legislation, particularly where the data subject gives his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data. 822. We note that no such special protection was provided with respect to the biometric data collected from children under the impugned amendments, and there is clearly a risk of violation to children’s right as a result of this inadequacy. We however note that the Data Protection Act No. 24 of 2019 now provides for the processing of personal data relating to a child under section 33 as follows: “(1) Every data controller or data processor shall not process personal data relating to a child unless— (a) consent is given by the child's parent or guardian; and (b) the processing is in such a manner that protects and advances the rights and best interests of the child. (2) A data controller or data processor shall incorporate appropriate mechanisms for age verification and consent in order to process personal data of a child. (3) Mechanisms contemplated under sub-section (2) shall be determined on the basis of— (a) available technology; (b) volume of personal data processed; (c) proportion of such personal data likely to be that of a child; (d) possibility of harm to a child arising out of processing of personal data; and (e) such other factors as may be specified by the (f) Data Commissioner. (4) A data controller or data processor that exclusively provides counselling or child protection services to a child may not be required to obtain parental consent as set out under sub-section (1).” 823. We have noted some gaps in the said provisions, namely that there is no definition of a child in the Act, and the rights of the child in relation to the personal data collected during minority and upon attaining majority are also not specified, particularly in light of their evolving capacities. In addition, as observed earlier, despite NIIMS being applicable to children, there are no special provisions in the impugned amendments, and no regulations that govern how the data relating to children is to be collected, processed and stored in NIIMS. It is thus our finding that the legislative framework on the protection of children’s biometric data collected in NIIMS is inadequate, and needs to be specifically provided for. Whether there are Sufficient Legal Safeguards and Data Protection Frameworks 824. This issue was similarly argued from several fronts by the parties. The first front presented by the Petitioners was that there are insufficient data protection laws to secure the personal information collected in NIIMS. The 1st Petitioner submits that the impugned amendments incorporate a broad, non-exhaustive, definition of “biometric”, however, that there are no laws in place for the protection of such sensitive data to be collected by the Respondents. http://www.kenyalaw.org - Page 136/174