Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR rather than a birth certificate, is the necessary document to access many services and exercise rights.” 86. Mr. Shafi stated there are several questions regarding the impugned statutory amendments, as there are no clear provisions indicating how the process of data collection shall be done, and no specific reason given for the collection and use of the private data. Further, that there is no provision on how one can amend the data once it is collected, which can lead to people being locked out from accessing government services because of wrong data. In addition, that the data to be collected is personal and private, and mishandling of the same shall amount to grave breach of the right to privacy, among other rights. 87. Mr. Shafi stated that IDEMIA (previously or concurrently operating as Morpho/OT-Morpho/Safran Identity and Security) is the company awarded the contract to build the NIIMS system. It was his evidence that this was the same company contracted to develop the voter registration system in the 2017 General Election known as Kenya Integrated Election Management System (KIEMS). He contended that the data contained in KIEMS was compromised, the implication being that IDEMIA could not be relied upon to develop NIIMS. Furthermore, that there is no public record on when the tender for NIIMS was floated, which companies applied, the selection process and the decision. Further, that he had not seen any public record on any due diligence carried out to ensure the privacy of the information collected by IDEMIA. 88. While reiterating his claim that IDEMIA is unreliable, Mr. Shafi averred that the same entity was contracted by the Ghanaian government to collect data, print identity cards, and manage the system, but that when its contract was terminated it refused to release the registration data to the government until payment was made. This, in his view, put at risk the right to privacy. 89. Mr. Shafi further averred that the right to privacy was threatened with violation by the fact that there are no proper data protection laws in place to guarantee privacy. In addition, that no mention is made with respect to who exactly can access the data and for what purpose, leaving an opening for unauthorized persons to access the sensitive data. Further, that the World Bank in its 2016 report titled ID4D Country Diagnostic: Kenya advised that the national legal framework for registration and identification should be strengthened “around data protection and privacy”, and had made detailed comments on the weaknesses of the Data Protection Bill. 90. Referring to the African Union Commission’s Personal Data Protection Guidelines for Africa, Mr. Shafi averred that the principles for data protection include consent and legitimacy, fair and lawful processing, purpose and relevance of data, management of the data lifecycle, transparency of processing and confidentiality and security of personal data. It was his deposition that the impugned legislation does not comply with the said core data protection principles. 91. Mr. Shafi faulted the Respondents for rolling out NIIMS without benchmarking with developed and wellknown systems such as Aadhaar in India. Citing the State of Aadhaar Report 2017-18 dated May 2018, he averred that the Aadhaar system was introduced in India to provide identification to citizens and residents, and its processes were relatively similar to the NIIMS system. His evidence was that the Aadhaar system has reported more errors than benefits. Further, that the report established that nearly two million people in three Indian states were excluded from accessing food subsidies as a result of Aadhaar-related factors. He further contended that India has also struggled with ensuring data security. He cited in this regard a report by the Center for Internet and Society (CIS) which had revealed that the Indian government inadvertently published the biographic and demographic data linked with Aadhaar numbers on 135 million Indians on the open internet. In his view, there is a possibility of Kenya facing the same problem in different ways. 92. Mr. Shafi also expressed the fear that just like in India, the data in NIIMS may be used for personal benefit. He averred that Aadhaar is the subject of dozens of lawsuits in Indian courts, and the Supreme Court of India has restricted the linkage of private sector services to Aadhaar enrolment; limited the mandatory use of Aadhaar for http://www.kenyalaw.org - Page 15/174