Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR over ten (10) patents filed at the United States Patent and Trademark Office. 429. Mr. Omwenga averred that in 2017, he undertook research and authored a report titled ‘Government Wide Enterprise Architecture’, which seeks synergies and efficiencies through combining common shared technical business services across government agencies and guides the journey of government’s digital transformation. Further, that this reduces costs by eliminating duplication of roles and efforts and promotes greater depth and expertise through the creation of centers of excellence for such shared business services. That subsequently, he was part of a team that carried out a feasibility study of the Government Enterprise Architecture and recommended various flagship projects including the unified unique digital identity project which was contained in a report titled ‘Digital Government Transformation Project.’ 430. Mr. Omwenga averred that identity, in relation to access and security, utilizes three common modes of authentication being something you know (such as a password), something you have (such as an access card) and something you are (such as biometrics) and any or all of the said three authentication modes may be incorporated in identity systems. However, the most robust factor of authentication and identification is based on something you are, that is, biometrics. It was also his averment that identity systems entail the maintenance of population registers which contain selected personal information (including biometrics) pertaining to each member of the resident population of a country in such a way as to provide the possibility of determining the identity of individual members comprising the population, the size of the population and the characteristics of such population. 431. Mr. Omwenga contended that the said population registers may either be centralized, decentralized or a combination of both, and could also be manual or electronic. He noted that the United Nations Principles and Recommendations for a Vital Statistics System provides that a population register need not take a specific form and states have unfettered discretion regarding the choice of the form, and the content of their respective population registers. It was his deposition that the rationale for this unfettered discretion is logically informed by the need to allow states to customize their respective population registers to suit their unique circumstances, which discretion enjoys adequate expression in international law. He cited Article 86 of the European Union General Data Protection Regulation 2016/679 (GDPR) which gives Member States the discretion to determine the specific conditions for the processing of a national identification number or any other identifier of general application. 432. In his view, capturing the value of good digital identity is by no means certain or automatic. Careful system design and well-considered government policies are required to promote uptake, mitigate risks like those associated with large-scale capture of personal data or systematic exclusion, and guard against the challenges of digital identity as a potential dual use technology. He stated that preconditions for digital identity include a minimal level of digital infrastructure, sufficient trust in the identity provider, and a policy landscape that provides safeguards to individuals. That in determining the content and the form of a population register, States take various factors into account including universality, accuracy and reliability, ease of operationalization, cost and security. Consequently, the form of an identity system that a State may opt to adopt may be a centralized identity system or a decentralized identity system or a combination of both. 433. It was his averment that a centralized identity system entails the maintenance of personal identity information of a country’s population in one database (national master population register), whereas decentralized identity system entails the distribution of respective personal identity information in identity cards which are then issued to individuals. That a comparative analysis of the pros and cons of a centralized and decentralized identity system would weigh in favour of a centralized identity system for several reasons. First, that from a data security perspective, decentralized biometric identity systems are more susceptible to personal identity theft than centralized ones. He observed that a fake set of biometric features may easily be cast on a lost or stolen electronic identity card which is then used to facilitate identity theft. 434. Secondly, that from a cost perspective, it would be illogical and ineffective use of limited resources to http://www.kenyalaw.org - Page 63/174