Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 832. The Respondents in their submissions sought to illustrate that there were sufficient data protection laws. The 1st Respondent submits that there are ample statutory and regulatory safeguards for data protection, and that active steps are being taken to make the said safeguards even more robust. To that end, that section 28 of Access to Information Act 2016 makes provisions for the punishment of three years imprisonment or a fine not exceeding 1 million or both to any person who knowingly discloses exempt information, including information that entails unwarranted invasion of the privacy of an individual. It was its submission further, that the Kenya Information and Communication Act No. 2 of 1998, and Computer Misuse and Cybercrimes Act No.5 of 2018 provide additional protection that enable timely and effective detection, prohibition, prevention, response, investigation and prosecution of computer and cybercrimes. 833. In this respect, it was contended that NIIMS as introduced by the impugned amendment is a “protected computer system” which by definition means a computer system used directly in connection with, or necessary for the provision of national registration systems. Further, that the penalty for any unlawful interference is enhanced to 25 million shillings or imprisonment of a term not exceeding twenty years or both. In view of the foregoing, the 1st Respondent submits that there exists legal and institutional framework for the promotion and protection of personal data. 834. The 2nd and 3rd Respondents urge that that the constitutionality of the subject amendments cannot be challenged on the basis of alleged absence of adequate data protection law. They based that submission on the reasoning of Chief Justice Sykes in the Julian Robinson Case, where he opined that “constitutionality or lack of it cannot be decided on what legislation is to come; and is determined on what is.” The said Respondents further relied on the case of Bernard Murage v Fineserve Africa Limited & 3 others [2015] eKLR, where the Court declined the invitation to halt the roll out of Thin SIM technology pending the enactment of the Data Protection Bill, and observed that it cannot order Parliament to make specific laws but only test both the process leading to those laws and their contents against the constitutional muster. 835. The 4th and 7th Respondents also submit that there are safeguards in place to ensure the security of the information through extensive legislative framework on data protection, information security, modalities on access to information as well as protection of the integrity of government records and information. Furthermore, that the Access to Information Act, 2016 contains safeguards for the protection of the data to be stored in NIIMS, and provides that it is an offence for any person to disclose exempt information in contravention of the Act. 836. The above submissions were echoed by the 5th Respondent, who acknowledged that there is no exclusive data protection law, save for a data protection policy which is in operation. It was further its submission that there is a Data Protection Bill currently under debate in the National Assembly. That once passed, the Bill shallgive effect to Article 31(c) of the Constitution, and shallalso regulate the collection, retrieval, processing, storing, use and disclosure of personal data. In addition, the 5th Respondent submits that notwithstanding the lack of a specific data protection law, numerous statutes offer safeguards to State held data. 837. To that end reference was made to the Kenya Information and Communication Act (KICA) which provides for specific offences in this regard. The 5th Respondent further submits that the Official Secrets Act classifies government information and protect personal data and the Computer Misuses and Cyber Crimes Act 2018, provides for offences and penalties relating to computer systems. With particular respect to Registration of Persons Act, it was the 5th Respondent’s submission that it has a limitation on who may access personal data and who can use it or share it. Furthermore, that there has been no previous breach of the data, that would have required an amendment to cater for NIIMS. 838. In light of the intervening events after the hearing of this case in terms of enactment of the Data Protection Act of 2019, we will address the arguments on the legal framework for data protection at this stage, before dealing with the other arguments made by the Petitioners on the adequacy of the safeguards for data protection. In this respect, http://www.kenyalaw.org - Page 138/174