Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR database places his or her freedom at risk. 125. Dr. Fisher observed that dangers also exist in the use of unique identifiers by the private sector, as it can lead to the exploitation of individuals and their data. He referred to a report by the London School of Economics titled The Identity Project: An Assessment of the UK Identity Cards Bill and its Implications (2005), for the proposition that service providers can profile individuals who interact with them using electronic identifiers. He also cited the ruling of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) and Another v. Union of India and Others Writ Petition (Civil) No. 494 of 2012 where a section of the Aadhaar Act that allowed private companies to use Aadhaar authentication was declared unconstitutional. The Court had held that allowing private entities to use Aadhaar numbers will lead to commercial exploitation of individuals’ personal data without their consent, and could lead to individual profiling. 126. Dr. Fisher averred that there are also new opportunities for fraud presented by the use of unique identifiers, particularly an identity number with a broad purpose which present more opportunities for a malicious actor to act fraudulently. He averred that an identity number with limited purposes limits the harms that can be caused to the individual. 127. Dr. Fisher identified some of the concerns that arise in relation to identity systems that use biometrics and unique identifiers exclusion, including data breaches, mission creep, access to and retention of data, and data protection. In his opinion, the above considerations are especially valid as regards the protection of special categories of more sensitive data and more particularly of DNA information. He also noted the need to place limitations on access by law enforcement and intelligence services to identification databases. 128. Dr. Fisher made averments with regard to the importance and necessity of data protection. He averred that as of January 2019, over 120 countries had enacted comprehensive data protection legislation, and many other countries were in the process of doing so. In addition, frameworks and instruments for data protection have been introduced by international and regional institutions such as the African Union, the Organisation for Economic Cooperation and Development, and the Council of Europe. In his view, data protection is necessary to safeguard the fundamental right to privacy by regulating the processing of personal data, providing individuals with rights over their data, and setting up systems of accountability and clear obligations for those who control or undertake the processing of the data. 129. Dr. Fisher averred that although a strong comprehensive data protection law will not cure the concerns he had identified, it is an essential safeguard in the introduction of any identity system. He identified the core principles for safeguarding of data that should be contained in data protection laws. 130. Dr. Fisher made averments with respect to mitigation measures that could be taken in order to protect data. He noted that in recognition of the particular concerns raised on the use of biometrics, consideration should be given to whether the stated purpose could be achieved by a less intrusive approach. Further, that use of data requires legal, procedural and technical safeguards. He cited the recommendation of the High Commissioner for Human Rights that States should ensure that data-intensive systems are only deployed when, demonstrably, they are necessary and proportionate to achieve a legitimate aim. He further cited the U.N. General Assembly Resolution on the Right to Privacy in the Digital Age, U.N. Doc. A/RES/73/179 (17 December 2018) which recommended that in collecting, processing, sharing and storing sensitive biometric information from individuals, States must respect their human rights obligations, especially the right to privacy. This should be done by the adoption of data protection policies and safeguards. 131. A second mitigation measure proposed by Dr. Fisher is avoiding storing the biometric templates in a centralised database. He asserted that this may avoid the risks of a system being used for identification, rather than just authentication. He recommended the use of a smartcard alternative to a centralised database, citing the UK’s http://www.kenyalaw.org - Page 20/174