Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR information technology. Yet, that no such information has been shared with the Kenyan public despite the clear constitutional directive under Article 10. Therefore, that the inevitable conclusion in the circumstances is that the public was deliberately misledwith promises of better services by NIIMS, without any information on risks attendant to centralized mass personal data in the system whose security, if any, is clouded in opaqueness and mystery. 873. The 5th Respondent responded to this argument by submitting that information on NIIMS ought not to be made available to every well-wisher as that would make it susceptible to compromise. That in the interest of national security, access to information is limited to avoid placing national data into jeopardy. Reliance was placed on the decision inTrusted Society of Human Rights Alliance & 3 Others v Judicial Service Commission [2016] eKLR, where the Court held that exceptions to the right to access information apply where there is a risk of substantial harm which is greater than the overall public interest in having access to the information. 874. Our analysis will address all the three limbs of argument made, as they all relate to the safety and security of the NIIMS design and its implementation framework. We received detailed testimony on the architecture and design of NIIMS, in particular as to it procurement, whether it is a centralized database or decentralized database or both, the standards that apply to the architecture of identification systems, and whether NIIMS is using closed or open source technology. We note in this regard that even though arguments were made on the procurement of NIIMS, and participation of the companies known as OT Morphi or Idemia in the process, no evidence was tabled before this Court on the process of tendering and of the award of the tender of NIIMS. We are therefore not able to make any findings on the procurement of NIIMS. 875. In addition, while the architecture and the design of a biometric identification determines how the components of the system are organized and integrated, including the ways the flows and transfers of data take place, and the specifications of where the data will be stored and how it will be accessible, it is beyond the scope of this Court’s jurisdiction and capabilities to prescribe the choices that can be made in such a system’s architecture and design. We are also of the view that legislation that aims to regulate technology driven innovations should not depend on the particularities of a given technology at a particular time, as biometric technologies will further evolve, and cannot be the criterion for issuing legislative obligations. For these reasons, we are also not able to make any specific finding as invited by Mr. Anand, the 1st Petitioner’s expert witness to do, on the archaic, progressive or other nature of NIIMS. 876. We will therefore restrict ourselves to the risks to the right to privacy and to data protection of data attendant with the design of, and security of NIIMS, that will require legal intervention. In this respect we are persuaded by the evidence of Dr. Fisher, the 1st Petitioner’s expert witness as to the risks that may arise with biometric identity systems. He deposed that identity systems can lead to exclusion, with individuals not being able to access goods and services to which they are entitled, thus potentially impacting upon other rights, including social and economic rights. He stated that exclusion as a result of an identification system can come in two forms. Firstly, in cases where individuals who are entitled to but are not able to get an identification card or number that is used for service provision in the public and private spheres. Secondly, that even people enrolled on to biometric systems can suffer exclusion arising from biometric failure in their authentication. 877. On data breaches, Dr. Fisher averred that breaches associated with identity systems tend to be large in scale, with rectification either being impossible or incurring a significant cost. Further, that the breaches affect individuals in a number of ways, whether identity theft or fraud, financial loss or other damage. His view was that the more data and the more sensitive that data, the higher the risk. With regard to the concern of function creep, Dr. Fisher averred that the mere existence of data in a centralised identification system leads to the temptation to use it for purposes not initially intended, what he referred to as ‘mission or function creep’. 878. The concerns of access to and retention of data was explained by Dr. Fisher as arising from the fact that the http://www.kenyalaw.org - Page 145/174