Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR interest to enact the impugned amendments vide an omnibus Miscellaneous Amendment Act. It contended that this concern was brought to the attention of the National Assembly on 28th August 2018 but was ignored. The 2nd Petitioner therefore takes the view that the impugned amendments were enacted into law vide an omnibus Bill to avoid scrutiny or for extraneous purposes. 140. The 2nd Petitioner’s third concern relates to the security of the data collected under NIIMS, and citizens’ rights to privacy. It averred that the impugned amendments impose extensive and unlimited mandatory requirements for citizens’ personal information without concomitant safeguards to prevent abuse or intrusions into people’s privacy by the State or unintended third parties. It was its case that integrating all personal information of the population in one system, whose security and integrity has not been guaranteed by the law, will expose citizens to unimaginable risks should the system be compromised or breached in any way. 141. According to the 2nd Petitioner, the impugned amendments grant the relevant Cabinet and Principal Secretaries extensive powers to gather personal information and to make regulations with regard thereto without substantive framework limitations on the use of the information gathered, or the principles and standards that should be applied in the exercise of the said powers, contrary to Article 94(6) of the Constitution. Further, that these dangers are compounded by the lack of a policy and legal framework for data privacy and protection in Kenya. The 2nd Petitioner contended that the impugned amendments fall short of the United Nations Principles on Personal Data Protection and Privacy, the African Union Convention on Cyber Security and Personal Data Protection, as well as comparable laws from other jurisdictions on limitations to the right to privacy. 142. Lastly the 2nd Petitioner challenged the substantive provisions introduced by the impugned amendments in sections 3 and 9A(2) of the Act and contended that they are intrusive, ambiguous and susceptible to abuse. It set out the legal and operational shortcomings of the amendments under various limbs. 143. The first limb was that the said provisions require, in mandatory and unqualified terms, that all Kenyan citizens, including children, submit their personal information including DNA information without their consent to the State, thereby creating a national population register. Further, that this personal information is susceptible to abuse to advance commercial interests and exposes citizens to negative profiling, which may have serious implications for civil liberties. 144. The second limb relates to the amendments introducing a unique identification number linked to a central access platform that will be assigned to every person. The 2nd Petitioner contended that this will exacerbate the risk of compromise of the system, and by extension, the privacy and security of the people. In addition, that the impugned amendments do not provide for the transitional mechanism from the current registration regime. 145. It was its contention that moreover, persons locked out from registration for any reason risk being left out permanently without access to vital government services necessary for the fulfillment and enjoyment of fundamental rights and freedoms. The 2nd Petitioner noted that it was not opposed to the proposal that citizens be assigned unique national identification numbers, but was concerned with the security and integrity of the system. 146. The third limb particularized by the 2nd Petitioner is on the harmonization of personal information across government databases, which will entail information sharing among different agencies. It was contended that this exposes the NIIMS system to greater risks of intrusion and abuse since the amendments do not specify the operational linkages of the system with the other databases. The 2nd Petitioner contended that in any event there exists a parallel Integrated Population Registration System (IPRS) under the Kenya Citizens and Foreign National Management Service Act No. 12 of 2012 that duplicates the functions of NIIMS. 147. It was its contention further that the harmonization process is prone to breaches such as destruction, deletion or loss of vital records; identity theft and fraud; malicious use of the information, wrongful entries; and mismatch http://www.kenyalaw.org - Page 22/174