Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR their personal data. 258. She averred that the principles require special consideration of children when processing their data. She noted that when considering fairness and lawfulness, attention should be given to the fact that children are still in their formation and are therefore likely to change as they mature to adulthood. Consequently, digitalization of their lives should be done in a manner that does not prejudice their future opportunities. 259. She noted, by way of illustration, that while digital systems may be used to capture children’s educational journeys, caution should be applied when capturing subjective aspects. Thus, the system should be designed to take in factual aspects such as the name, parentage and schools the child attended. It should, however, avoid opinions such as reasons for a child’s good or bad performance in school. Should it be necessary to record such opinions, they should be removed from decision making technology, and automated decisions should never be made on the basis of subjective opinions. 260. Ms. Mutung’u cited the United Kingdom Data protection regulator, the Information Commissioner’s Office (ICO)’s recommendations to data controllers processing children’s data. It recommends that they consider the basis for processing of children’s data and design systems and processes that respond to children’s specific needs. Among the principles she cited include consent to the processing of the data, though she avers that this may not be adequate protection of privacy, particularly with respect to children because of the power asymmetry between the data processor and the subject. She noted that in many instances, users of online services need the service and consent is presented as a step one has to accept by clicking on in order to proceed to the service, a challenge that is more profound for children who may not have the full capacity to understand information presented to them. 261. The second principle she cited relates to the purpose for which the data is required. Ms. Mutung’u averred that since children’s data can be used to profile them in prejudicial ways, the purpose for which the data is collected must be very clearly stated. 262. Ms. Mutung’u further noted the need to observe the principle of adequacy in the collection of data relating to children. Her averment was that the nature of big data systems requires collection of as much data as possible for big data analytics, which abrogates the right to informational privacy where one’s data should not be unnecessarily required. It was her averment that children are in an especially vulnerable position in relation to big data as they are ever growing, their biological features are maturing with significant changes, and big data systems would require their data to be constantly updated, leading to constant surveillance. It would therefore be necessary, in her view, in order to ensure safeguards on adequacy, to determine why children’s data is being collected in the first place, a function that would best be covered in laws or regulations. 263. A fourth necessary principle with regard to children’s data, according to Ms. Mutung’u, is accuracy, the need for data processors and controllers to ensure that children’s data is accurate. To achieve this, parents or guardians should be given an opportunity to view the children’s data and to correct and update it as may be necessary. 264. According to Ms. Mutung’u, a data system should also take into consideration the principle of retention in relation to children’s data, given the transitory nature of childhood and the increased capacity that comes with it. She averred that children’s data, which is collected and processed without their full awareness, should therefore not be stored eternally. Upon reaching adulthood or the age of consent, children should be able to make decisions on their data, including moving with it to other systems or having it completely destroyed. 265. Concomitant with this right is the right of children as data subjects. While they may have no capacity to make decisions involving their data, like other data subjects, they can exercise these rights with the assistance of an adult such as a parent or guardian. Ms. Mutung’u averred that regulations should define how children may achieve their data subject rights and the role of parents and guardians in this regard. http://www.kenyalaw.org - Page 39/174