Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR digital personality was suggestive of the creation of a new legal regime or a new law of personality, a digital personality, on the basis of which one would receive services. This, in her view, goes to the core of the Constitution and the sovereignty of the people of Kenya, raising the question whether one was no longer a person in the eyes of government if one does not have digital personality. She further expressed the apprehension that NIIMS, which was touted as a single source of truth, could be taking the country back to centralization of power as the person who can view the data has a lot of power. 284. Ms. Mutung’u reiterated the views that she had expressed in her witness statement regarding the absence in the law of the principles that are a requisite for data protection in relation to the special nature of children and therefore provide special protection for children when processing their data. She maintained that the law does not provide for the principle of fairness and lawfulness, and no consent was sought or any explanation given to children or their guardians with regard to the purpose for the collection of their data. 285. Ms. Mutung’u asserted that no explanation was given on whether there were no less invasive means of achieving the same purposes sought to be achieved with the impugned law, without putting the lives of children at risk. She testified that the principle of adequacy, which requires that only what is sufficient for the intended purposes is collected, was not adhered to. It was her contention that we are now living in an age where data is the new oil, and there is a push to collect as much data as possible on people. In her view, however, the principles of data protection, especially the principle of adequacy, requires that only such data as is sufficient for the intended purpose, which purpose should be stated beforehand, should be required. Considering that children are still in their formation, if the government starts collecting data on them now and keeps collecting more and more data and profiling them, a lot of decisions on the lives of children will be made based on this data. It was therefore necessary to collect only what is sufficient for the stated purposes. 286. As regards the principle of accuracy, it was Ms. Mutungu’s testimony that from the design of NIIMS, there is absolutely no opportunity for children or their caregivers to view what data the government has on them and to correct what is incorrect. Yet, such data is used to make decisions, including legal decisions, that affect their lives. With respect to the principle of retention which Ms. Mutung’u testified is related to the principle of adequacy, her view was that data should not be kept in perpetuity but only for the period when it was required. These issues, in her view, were not addressed in the impugned amendments, and it was not known how long the data was going to be stored, the possibility being that it would be kept eternally. 287. As for the rights of data subjects, it was her testimony that these should have been captured in regulations; that the Act should have been made in a way that would have allowed for regulations that would define how children may achieve their right to access, correct, and update the data, and the manner of transiting with the data upon reaching adulthood, to decide what should be done with the data collected prior to adulthood. 288. With regard to security of children’s data, Ms. Mutung’u testified that it was not known how secure the data was. Further, that there is no publication that states what measures have been put in place to secure the data, and in the event of a breach, that there are good systems to mitigate any harm that may arise from the breach. On the issue of cross-border transfer of data, Ms. Mutung’u testified that the Petitioners just needed an assurance that children's data will not be exported to be used to train artificial intelligence systems; and that if it is exported, it will be used in jurisdictions that have adequate data protection laws. 289. In countering suggestions from the Respondents that she did not have the expertise that she claimed in children’s digital rights, Ms. Mutung’u explained in re-examination that she had studied information technology at Strathmore College specialising in management of information systems. She had studied law at the University of Nairobi and had interned under Professor Ben Sihanya, a Professor of IT and intellectual property. She had studied Internet Governance at the University of Malta, and thereafter was awarded a fellowship in 2016-2017, renewed in 2017-2018, at the Berkman Klein Center for Internet and Security housed at Harvard Law School. She had http://www.kenyalaw.org - Page 42/174