Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR HIV positive people had dropped out of treatment programmes as treatment centres insisted on Aadhaar registration. It was her averment that for such vulnerable communities, the possibility of a record being maintained and potentially shared in unauthorized ways was an unacceptable risk. 251. With regard to the question of best practices on digital identification systems, Ms. Munyua criticised the examples of best practices cited by the 5th Respondent, notably United Kingdom, Estonia, India, and Malaysia. She contended that the projects in these countries have been highly criticized or are not relevant comparisons. With regard to the Estonian model, it was her averment that it is a federated system and is in stark contrast to the integrated model put forth by the government of Kenya. As for the Malaysian and Indian models, her averment was that serious concerns have been raised with regard to privacy, data protection, governance, and cyber security as well as concerns related to system design and the inclusion or exclusion of people from government and some private services. In relation to the United Kingdom DNA database, it was her averment that it was not an identification system at all. It was, rather, a forensic DNA database maintained by the United Kingdom police for those implicated in crimes and was governed by strict data retention norms which require that the records of individuals found innocent be deleted. Her averment was that this system was in stark contrast to NIIMS which would take the DNA data of the entire population, rather than merely those suspected or convicted of crimes. 252. Ms. Munyua asserted that the United Kingdom’s government’s identification system, Verify, does not include biometrics and has a completely federated identification architecture which has been commended for its decentralized approach that gives users control. It was also her averment that the United Kingdom was not an appropriate comparison since, like most of the other countries mentioned by the Respondents, it has had strong data protection law and enforcement in place since 1984. 253. She noted that while the Respondents had taken the position that India’s Aadhaar identification project has been heralded as a success story, they had ignored much of the criticism that has plagued the project. She averred that with the demographic data in Aadhaar reportedly compromised, it was hard to see how the system can be trusted for authentication. According to Ms. Munyua, a more worrying aspect of Aadhaar was that hundreds of thousands of people have been denied access to basic services, including access to food, because they either do not have an Aadhaar (digital identity) card, or their digital identity is “incomplete” because their fingerprints have not been uploaded to the national database due to poor internet connectivity. 254. Expert evidence was presented for the 2nd Petitioner by Ms. Grace Bomu Mutung’u through her witness affidavit sworn on 12th April 2019. She was also cross-examined at the instance of the 2nd and 3rd Respondents. 255. Ms. Mutung’u described herself as an Advocate of the High Court of Kenya and a researcher and specialist in digital rights and internet governance. She stated that she had over 10 years’ experience in internet governance digital rights work and held advanced certifications on information controls from Harvard University. Her witness affidavit was sworn in support of the 2nd Petitioner’s petition, and particularly in addition to paragraph 10(a), (corrected at the hearing to paragraph 14(a)) of the further and supplementary affidavit of Mr. George Kegoro sworn on 12th April 2019. 256. Ms. Mutung’u averred that Kenya is a signatory to international conventions that call for the protection of the privacy of children. She cited Article 10 of the African Charter on the Rights and Welfare of the Child which guarantees to all children the right to privacy; the Convention on the Rights of the Child which also protects a child’s right to privacy at Article 16; as well as Article 40 with respect to legal proceedings. 257. Ms. Mutung’u averred that universal principles on digital privacy laws acknowledge that processing of children’s data requires additional protection. She cited the European Union’s General Data Protection Regulations (GDPR), recital 38, which provides that children merit specific protection with respect to their personal data as they may be less aware of the risks, consequences and safeguards and their rights with respect to http://www.kenyalaw.org - Page 38/174