Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR b) the means used must violate the right as little as possible; and c) there must be proportionality between the measure and the effect, that is to say, the benefit must be greater than the harm to the right. 916. The propriety and sufficiency of the impugned amendments for the collection of personal data has been challenged with respect to two types of data, namely DNA and GPS coordinates. As noted by Dr. Malombe in his evidence, DNA information can have far reaching consequences as it not only reveals the identity of a given person, but also genetic properties, which include the likeliness to develop particular diseases, parentage and also family links. In addition, it can be recovered from a multitude of sources, and it provides or is likely to provide scienti"c, medical and personal information pertinent for a person throughout his or her life. 917. It is thus our finding, that because of the speci"city of the information that DNA may disclose, and the harm this disclosure may cause not just to the data subject but other family members in terms of both identi"cation and genetic information, DNA information requires and justi"es a particular and specific legal protection. This was confirmed by the Article 29 Working Party in its Report on the Processing of Genetic Data. 918. Likewise, specific authorization anchored in law is required for the use of GPS coordinates, in light of the privacy risks we have already identified in terms of their possible use to track and identify a person’s location. There is also the added risk that centralized databases can use GPS information, to create “watchlists” or “blacklists” to create information on individuals to be watched and tracked. These individuals as a result become suspects, leading to a reversal of the presumption of innocence. 919. Accordingly, we find that the provision for collection of DNA and GPS coordinates in the impugned amendments, without specific legislation detailing out the appropriate safeguards and procedures in the collection, and the manner and extent that the right to privacy will be limited in this regard, is not justifiable. The Respondents in this respect conceded that they will not collect DNA and GPS coordinates, and that in any event they have no capacity to do so. However, our position is that as long as the collection of DNA and GPS coordinates remain a provision in the impugned amendments, there is the possibility that they can be abused and misused, and thereby risk violating the rights to privacy without justification. 920. This Court has also discussed at length the necessity of the biometric data that is required by the impugned amendments and the necessity of NIIMS as an identification and verification system. We have also noted that such system that stores biometric data is susceptible to risks and any breaches can cause irreparable harm to the data subjects. An inadequate legislative framework for the protection and security of the data is therefore clearly a limitation to the right to privacy, in light of the risks it invites for unauthorized access and other data breaches. 921. In addition, a law that affects a fundamental right or freedom should be clear and unambiguous. This principle was stated in the case of Andrew Mujuni Mwenda vs Attorney General (supra), and was echoed in the case of Geoffrey Andare vs Attorney General (supra) where the court stated;“…The principle of law with regard to legislation limiting fundamental rights is that the law must be clear and precise enough to enable individuals to conform their conduct to its dictate…” 922. This position equally applies to any law that seeks to protect or secure personal data, particularly in light of the grave effects of breach of the data already alluded to. To this extent the lack of a comprehensive legislative framework when collecting personal data under the impugned amendments, is contrary to the principles of democratic governance and the rule of law, and thereby unjustifiable. It is also notable in this respect that no justification or reasons were given by the Respondents for this lapse, leading to our earlier conclusion that the process of NIIMS appeared to have been rushed. http://www.kenyalaw.org - Page 152/174