Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 1029. We considered in this regard the scope and content of the right to privacy including information, and found that biometric data and GPS coordinates required by the impugned amendments are personal, sensitive and intrusive data that requires protection. Even though there was no evidence brought by the Petitioners of any violations of rights to privacy in this respect, we also found that the impugned amendments impose an obligations on the relevant Respondents to put in place measures to protect the personal data. 1030. It was also our holding that the biometric data collected is necessary to the stated purposes of NIIMS in section 9A of the Registration of Persons Act, and the functionalities of NIIMS as an identification and verification system in our view, also justified the utility of NIIMS and the other existing identification and registration databases. It was thus our finding that NIIMS is not superfluous from an identification and verification point of view, as the biometric data collected therein is necessary for identification, and will be used for verification purposes in relation to other existing databases. Lastly, we found the stated benefits of NIIMS given by the Respondents in their evidence to be in the public interest and not unconstitutional. (b) Whether there is a Violation of Children’s Right to Privacy 1031. It was evident that the provisions of section 9A of the Registration of Persons Act on the purposes of NIIMS contradict section 2, and the two provisions cannot operate at the same time with regard to the application of NIIMS to children. After applying the rules of statutory interpretation on implied amendment and repeal detailed out in the judgment, it is our finding that section 9A, being a later amendment, is deemed to have amended section 2 with respect to its application to NIIMS, and to this extent the inconsistency was thereby resolved. We therefore found that section 9A of the Registration of Persons Act and NIIMS applies to children. 1032. We were also of the view and found that the general principles and protections that apply with regard to the right to informational privacy, and our findings in this regard with respect to the biometric data collected under NIIMS are also applicable to children, as much as they apply to adults, and even more. This is because unlike adults, children’s ability to make reasonable choices about what information to share is limited, as a result of their limited capacities, development and education. The additional issue which we therefore considered was whether the impugned amendments and NIIMS provide specific protection with regard to children’s personal data. 1033. In this regard we noted some gaps in the Data Protection Act, namely that there is no definition of a child in the Act, and the rights of the child in relation to the data so collected during minority and majority stages are also not specified, particularly in light of their evolving capacities and best interests. In addition, despite NIIMS being applicable to children, there are no special provisions in the impugned amendments, and no regulations that govern how the data relating to children is to be collected, processed and stored in NIIMS. It was our conclusion therefore that the legislative framework on the protection of children’s biometric data collected in NIIMS is inadequate. (c) Whether there are Sufficient Legal Safeguards and Data Protection Frameworks 1034. We noted that the protection of personal data depends largely on a legal, regulatory and institutional framework that provides for adequate safeguards, including effective oversight mechanisms. This is especially the case with NIIMS, whereby a vast amount of personal data is accessible to The State, and data subjects currently have limited insight into and control over how information about them and their lives is being used. 1035. While we found that the Data Protection Act No 24 of 2019 has included most of the applicable data protection principles, we noted that there are a number of areas in the Act that require to be operationalised by way of regulations, including circumstances when the Data Commissioner may exempt the operation of the Act, and may issue data sharing codes on the exchange of personal data between government departments. It is our view that these regulations are necessary, as they will have implications on the protection and security of personal data. http://www.kenyalaw.org - Page 171/174