Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR freedoms attendant on the said databases. 860. The 3rd Petitioner did not specifically address this limb in their submissions, while the 5th Interested Party counsel contends that while collation of information into one database would make work easier, this does not constitute a necessary reason to violate one’s privacy. Furthermore, that one of the effects of collating all the information into one database would be that of State surveillance, as acknowledged by the Supreme Court of Jamaica in the Julian Robinson Case (supra). 861. Closely related to the first limb of the Petitioners’ arguments on the design of NIIMS, is the second limb that the legal and technical principles on data protection and security were not incorporated in the NIIMS system design and architecture. This aspect was mainly addressed by the 2nd Petitioner, who submitted that by their own testimonies, the Respondents have demonstrated that the NIIMS software was developed contrary to established international norms, standards and best practices for similar identity systems, including the recommendations of their own expert witness ,Mr. Brian Omwenga, in his report titled Principles Of Government Enterprise Architecture. 862. The 2nd Petitioner further submits that some of the core principles of data protection is that personal data should be collected for specified, explicit and legitimate purposes. In addition, that the principle of data minimization requires that personal data collected be adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected. The 2nd Petitioner further argued that at the very least, the digital identification related technical standards employed for NIIMS should be well documented including standards for platform independence for interoperability, network security, incident handling, database security, and critical infrastructure security. As it were, they argued that those omissions offend the principles of transparency and accountability under Article 10 of the Constitution and essentially surrender the safety and security of vital personal information to the whims of the State. 863. Lastly, the 2nd Petitioner submits that any and all implementation tools designed by the Respondents for NIIMS, including the data capture forms, ought to be anchored in law and regulations for certainty and oversight. Therefore, that all information gathered under the impugned amendments was unlawfully gathered using a data capture form whose legal status is, by the Respondents’ own admissions, unknown in law. 864. The Respondents defended the NIIMS architecture and design in their submissions. The 2nd and 3rd Respondents submit that the NIIMS database would be linked with functional databases for purposes of enabling functional institutions such as the Directorate of Criminal Investigations to request for authentication of identity of individuals. To that effect, the NIIMS database will be accessible to functional databases, whilst functional databases will be inaccessible to the NIIMS database, which is a concept of data-minimization architectural design that ensures high security and integrity, and that it retains purely identity information. 865. The 2nd and 3rd Respondents further submit that there are measures in place to ensure the safety of personal identity information collected in NIIMS as follows: (a) Encryption of the requisite biometric and biographical information at the point of capture by the NIIMS data capture kits (at the point of registration). (b) Transmission of the encrypted data to the requisite servers for deduplication. (c) The templates of biometric and biographical information stored in the NIIMS database are encrypted as well. It was their submission that any data breach of the NIIMS database would only reveal encrypted templates of personal identity information, which cannot be unmasked without the requisite decryption key. http://www.kenyalaw.org - Page 143/174