Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR that with respect to the NIIMS system, the code used to generate identifiers for Kenyans should be available for public inspection, along with the code used to verify enrolment and send or share information. 237. Ms. Munyua made further averments in her affidavit regarding the dangers of a centralized database like NIIMS with extensive sensitive biometric data. It was her testimony that as an integrated and centralized database of sensitive biometrics, NIIMS creates a significant security risk and is susceptible to breaches by malicious actors or abuse by public authorities. In her view, breach of systems like NIIMS were not a remote risk, and it was a safe operating assumption that the database will be compromised, and she cited by way of illustration the breach of India’s Aadhaar system. 238. While conceding that seamless transfer of information between government departments may be desirable for governance, Ms. Munyua contended that there are better alternatives to achieve this without breaching privacy rights. She supported this contention by referring to the Estonian system in which the databases of each department and service provider are held separately and are connected through the X-Road data exchange layer that manages the exchange of information as needed by each programme. 239. Ms. Munyua expressed the view that an identification database that is primarily meant for welfare delivery should not be misused for law enforcement or intelligence surveillance. She averred that NIIMS may create a transaction log of all authentication requests linked to specific identification numbers. According to Ms. Munyua, access to these logs of metadata about where an individual was authenticated and by which agency could reveal highly specific information about an individual’s movements and affiliations. 240. Ms. Munyua contended that in order to mitigate the risk of misuse for law enforcement or intelligence surveillance, the Kenyan government should look to decentralized models like the United Kingdom’s where the identity provider does not know the purposes for which identification is requested, and the entity requesting is given minimal information restricted to confirming or denying the request. She cited in this regard a paper by Edgar Whitley titled ‘Trusted Digital Identity Provision: GOV.UK Verify’s Federated Approach’. 241. Ms. Munyua further made various averments regarding the shortcomings in the process of establishing NIIMS. She cited in particular the lack of public participation in the process, noting that under the 2010 Constitution, public participation is now a constitutional right and an obligation on the part of the government. It was her averment that NIIMS was authorised through changes made to the Registration of Persons Act through the Statute Law (Miscellaneous Amendments) Act and was not subjected to public participation. She further argued that the amendments to the Act came into force on January 18, 2019, only 19 days after the President gave his assent, without public consultation or parliamentary debate. 242. Ms. Munyua averred that there was insufficient protection for data provided for NIIMS. She contended that while the government asserts that there is a data protection policy and bill that informed the development of NIIMS, the Bill is still pending debate in Parliament. It was her view that no digital identification system should be implemented without strong privacy and data protection legislation; that data protection laws seek to protect people's data by providing individuals with rights over their data, imposing rules on the way in which companies and governments use data and establishing regulators to enforce the laws. 243. Ms. Munyua contended that individuals should always be in control of their digital identities and biometrics, and it was particularly egregious that NIIMS was passed even as a strong data protection law is under consideration by the Kenyan Parliament. In her view, the proposed Data Protection Bill of 2018 is a strong and thorough framework which contains provisions relating to data minimization, collection, purpose and retention and if it was in effect, NIIMS would likely be in conflict with its provisions. 244. According to Ms. Munyua, the data protection law should establish an empowered, independent regulator to http://www.kenyalaw.org - Page 36/174