Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR Moreover, that the amendment does not provide with precision the persons that shall have access to the sensitive data collected and with what persons the data can be shared. 825. The 1st Petitioner further argues that the laws in place such as the Access to Information Act and Computer Misuse and Cybercrimes Act were not enacted to implement Article 31 of the Constitution. It was contended that the effect of such a void in the law is that the data could fall in the hands of unauthorized third parties which is a contravention of the right to privacy and no one shall take responsibility for the damages suffered. 826. The 2nd Petitioner’s submissions were that the impugned amendments sanction mandatory or non-consensual collection of personal information without concomitant data protection laws. Further, that the data protection laws legislate and operationalize key data protection principles that strike the balance between the use of information and communication technologies and the protection of the privacy of citizens. The said principles of data protection were detailed by the 2nd Petitioner. It was its submission that contrary to international standards and best practices that advocate for the clear and explicit regulation of the entire spectrum of data collection, retrieval, processing, storage, use and disclosure, the impugned amendments appear to place a premium on what the Government believes will make its work easier with least or no regard whatsoever to the effect of its actions on privacy rights. 827. Furthermore, that the Principal Secretary in the Interior Ministry has been given free rein to prescribe subsidiary regulations on critical aspects of personal data, which should otherwise be regulated by a substantive data protection law, which is in breach of Article 94(6) of the Constitution which provides for conditions that apply when regulation making power is given to any public officer. 828. The 2nd Petitioner further submits that the risks of the foregoing weaknesses of NIIMS are further exacerbated by the absolute lack of data protection laws for the sensitive personal biometric data proposed for collection under the impugned amendments. In its view, the conceptualization of NIIMS and its operationalization contravene every known data protection law, rule, standard, policy and best practices, most of which were adduced as evidence by the Respondents, including the Data Protection Policy and Bill of 2019 and the EU GDPR . 829. In conclusion, the 2nd Petitioner submits that criminal sanctions cannot be sufficient safeguards to mitigate against the risks of data misuse and privacy breaches. Further, that by its very nature, technology is borderless and can be breached from anywhere including overseas. Accordingly, for the operationalization of NIIMS to give effect to the right to privacy under Article 31, it is imperative that appropriate technical and legal standards be formulated to ensure the security of the proposed digital identification system and the privacy of personal data collected by the same, and that no prejudice will be occasioned to any person in suspending the impugned laws until then. 830. The submissions by the 3rd Petitioner were that there is no data protection law or policy in place that would adequately address the concerns in the event there is misuse of information, and yet Article 24 of the Constitution sets out clear, concrete and objective circumstances in which a right or fundamental freedom in the Bill of Rights may be limited. 831. The 5th Interested Party joins the Petitioners in reiterating that the law under which all the activities under NIIMS are purported to be done, including collection of personal information, lacks the safeguards required of a law that authorizes the processing of personal information. It relied on the Julian Robinson Case where the Supreme Court of Jamaica directed that the law must afford appropriate safeguards to prevent use of the data in a manner inconsistent with the guaranteed right. Further, that the GDPR also prohibits the processing of biometric information, which may only be allowed where the data subject has given explicit consent and in specified circumstances, and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. It was also pointed out that these standards are replicated in the African Union Convention on Cyber Security and Personal Data Protection, which is evidence that data protection standards may be elevated to the level of a general rule of an international law, making it a valid source of law in Kenya. http://www.kenyalaw.org - Page 137/174