Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR ensure that rigorous regulations and standards are set on how to handle personal data processing. It was also her view that an independent data protection authority is critical to ensure the data protection law is enforced. 245. It was also Ms. Munyua’s averment that the main features and processes of the identification system, especially those affecting the rights of users, must be enshrined in the primary law. She contended that leaving implementation details of the NIIMS entirely to government discretion without this framework creates unacceptable risks for citizens of profiling, social exclusion, privacy violation, and security compromise. In her view, an independent regulator can help to protect the rights of Kenya’s residents, but those rights must first be established in law. 246. With respect to the security of the system, Ms. Munyua took the view that the position taken by the respondents that the system was secure because section 20 of the Computer Misuse and Cyber Crimes Act, 2018 provides enhanced penalties for offences involving protected computer systems does not make the NIIMS system secure. It was her averment that making an attack of a system a crime does not actually make it secure. Her opinion was that legal penalties alone have never served as a sufficient deterrent against malicious actors. She cited in this regard the situation in India where, despite the legal prohibitions against publishing Aadhaar numbers and breaching the system, there have been multiple public leaks and breaches, including by state governments, citing the case of the State of Andhra Pradesh which had allegedly build India’s first police state using data from Aadhaar. 247. Ms. Munyua further contended that relying aggressively on laws that criminalize accessing a computer system without authorization had another downside in that it can disincentivize and threaten security researchers. She averred that security researchers play a critical role in finding and reporting vulnerabilities in a system so that they can be patched in an expeditious manner. She argued that some of the most effective security research involves probing computer systems without the explicit permission of the owner of that system. Her position, as we understand it, is that governments should not criminalise accessing computer systems as this would deter security researchers, thus leaving the systems vulnerable and making the identity system and the deeply private information stored in it less secure. 248. Ms. Munyua argued further that the NIIMS process should not be used for exclusion. She observed that possessing identity is increasingly a precondition to accessing basic services and entitlements from both state and private services. Given that access to vital government services will require a Huduma Namba, the potential consequences of being excluded from enrolment in the system were immense. It was, consequently, important that no one is excluded from the identification system because of their physical, social, demographic, or economic characteristics. She noted in particular the potential exclusion of marginalized communities through the process of enrolment into the system as officials will be using existing documents to prove and verify who is a citizen, thus locking out people who do not have these documents. She averred that the gap of conclusive proof of citizenship already affects many Kenyan communities, including the Makonde, the Shona as well as pastoral communities and tribes. 249. It was her averment further that those who are already enrolled in the system might also be at risk of exclusion due to the features of NIIMS that might end up enabling discrimination. She observed that collection of DNA data can be used to identify an individual’s ethnic identity, and given Kenya’s history of politicization of ethnic identity, collecting this data in a centralized database like NIIMS, which can be linked to other databases, could reproduce and exacerbate patterns of discrimination. Reliance for this averment was placed on a report from the 2nd Petitioner titled ‘Politicization of Ethnic Identity in Kenya: Historical Evolution, Major Manifestations and the Enduring Implications’. 250. She further noted that in India, the requirement of the Aadhaar ID number for access to HIV medication was feared to increase the risk of stigmatization and further discrimination, citing a report in which it was noted that http://www.kenyalaw.org - Page 37/174