Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR Weaknesses, Opportunities and Threats Analysis of the Existing Identification and Registration Systems in Kenya, which recommended the need for a ‘single source of truth’ for citizen data. He averred that in furtherance of the mandate of the Ministry as described in Executive Order No. 1 of June 2018, a Cabinet Memorandum on the establishment of NIIMS was subsequently issued on 10th April, 2018. Under the said Cabinet Memorandum, the Ministry was charged with spearheading implementation of the NIIIMS in collaboration with the Ministry of Interior and Coordination of National Government, and with operating the NIIMS infrastructure including the development of the necessary system design, integration structures, product identification and deployment. 403. To aid and facilitate this exercise, the Registration of Persons Act was amended by the Statute Law (Miscellaneous Amendments) Act No. 18 of 2018 to establish NIIMS. According to Mr. Ochieng, NIIMS is intended to be the primary database and “single source of truth” for personal data and will link and harmonise all the existing databases of personal information collected by different government agencies under different laws. 404. Mr. Ochieng asserted that his Ministry spearheaded the development of the software aspects of NIIMS with the input of other government agencies. He denied the contention by the Petitioners that private entities, particularly IDEMIA Saffron, was involved in the development of the software for NIIMS. Mr. Ochieng confirmed that the NIIMS kits were inspected for any data mining software to completely eliminate the possibility of external access, data mining or even data manipulation by IDEMIA Saffron or any other unauthorized entity. 405. It was Mr. Ochieng’s deposition that NIIMS ensures the security of the nation from external and internal attacks since all persons in the country will be issued with relevant identifiers, including a unique number identifier from birth. He gave instances of the shortcomings of the current systems of registration, including those of access to documents and access to the registration systems themselves. He stated that NIIMS will reduce the duplication of processes common in accessing government services since it serves as a one-stop shop for identification information. 406. On the use of biometric data in NIIMS, Mr. Ochieng deponed that DNA as a unique identifier was not part of the personal information collected by the data capture form in use. He noted, however, that it plays a central role in the identification of individuals and is the only known means of posthumous identification in some instances. That notwithstanding, it was his averment that DNA, GPS coordinates, retina and iris patterns and earlobe geometry were not introduced by the impugned amendments. He averred that they were already provided for under section 5(1)(j) of the Act where it is provided that the Principal Registrar shall be required to keep “such other particulars as may be prescribed”. 407. Mr. Ochieng denied the allegations by the Petitioners that GPS targets an individual’s communication and exact whereabouts. He reiterated, like the other Respondents, that GPS is merely a precise geographical location, whose utility is to facilitate ease of digital identification of an individual’s place of residence and physical delivery of services to citizens by the government. He also echoed the other Respondents in asserting that GPS co-ordinates were not being collected by the NIIMS data capture tool. Accordingly, he averred that the alleged fears regarding the misuse of DNA and GPS coordinates is speculative, presumptuous, unjustified and misleading. It was his averment, however, that there will not be surveillance beyond the geographical location of residence. 408. Mr. Ochieng further deponed that there is an extensive existing legislative framework on the protection of privacy, personal information and integrity of ICT systems. He cited various provisions of the Access to Information Act 2016, the Kenya Information and Communications Act, and the Computer Misuse and Cyber Crimes Act, 2018 in support of this averment. Further, that there exists sufficient safeguards in respect of the security and integrity of information held by NIIMS in the said Acts, and in the Kenya Information and Communications (Consumer Protection) Regulations 2010. Mr. Ochieng explained that the country has a data protection policy which informed the development of the NIIMS software, and which has been reduced into a Data Protection Bill. Accordingly, that it is misleading for the Petitioners to allege that the exchange of data between http://www.kenyalaw.org - Page 59/174