Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 760. A similar definition of an identifiable natural person is now provided for in the Data Protection Act No. 24 of 2019. We note that the unique attributes and identifiers that are included in the definition of biometric data as defined in section 3 of the Registration of Persons Act, GPS coordinates, and the data collected by NIIMS as evidenced by the NIIMS Data Capture Form, clearly fall within the above definition of personal data. The quali"cation of biometric data as personal has important consequences in relation to the protection and processing of such data, and as such invites a risk of violation of the right to privacy in the event of inadequate protection measures. 761. The Petitioners also urged that the amendments introducing biometric data allow collection of sensitive data about persons. The concept of sensitive data has its origin in the European Union jurisprudence on the right to privacy and data protection, and the GDPR also recognizes that in addition to general personal data, there are special categories of personal data, known as sensitive personal data, which are subject to a higher level of protection. Similar provisions on sensitive data are provided in Article 1 of the African Union Convention on Cyber Security and Personal Data Protection. The Data Protection Act No. 24 of 2019 likewise defines sensitive personal data as data revealing the natural person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details including names of the person’s children, parents, spouse or spouses, sex or sexual orientation of the data subject. 762. We note that such data is considered sensitive data because of the more serious impact of its loss or unauthorized disclosure, particularly in terms of the attendant social, reputational, or legal risks and consequences. It is thus evident that biometric data and in particular DNA must be protected against unauthorized access, and access to such data should also be limited through sufficient data securitypractices designed to prevent unauthorized disclosure anddata breaches. 763. The last allegation by the Petitioners was that biometric data and personal information being collected as a result of the impugned amendments is intrusive. Intrusion is defined in Black’s Law Dictionary, Ninth Edition at page 900 as “a person entering without permission”. Therefore, personal data is intrusive when it is collected without a person’s knowledge of consent. 764. The Respondents testified in this regard that the data collected by NIIMS was with the consent of the subjects, while the Petitioners have contended that data collection was mandatory, and as such there was no informed consent. The Respondents brought evidence of the Data Capture Form used during the collection of the biometric data, which had a caption on the consent of the data subject, and also testified that they had removed the statement in the said Form that registration would be mandatory, in compliance with this Court’s orders. The Petitioners did not bring any evidence of any person who was forced to give the consent, or did not understand the nature of the consent being given. In addition, this Court in its ruling delivered on 1st April 2019 had directed that the collection of the data would not be mandatory. 765. We however observe that at the time of the said data collection, there was no legal requirement for consent to be given by a data subject to the collection of biometric data. The Data Protection Act 24 of 2019 which has since been enacted now specifically provides for the rights of the data subject, including the right to object to the processing of his or her personal data in section 26 thereof. The Act also further provides in section 30(1) that the data subject must consent to processing of his or her personal data. We are therefore constrained to find that the data collection exercise undertaken pursuant to the impugned amendments was done with the consent of the data subjects. 766. As to whether the categories of personal data that will be collected pursuant to the impugned amendments is in their nature intrusive, this Court is guided by the observations in the Working Document on Biometrics P 80 by the Article 29 Data Protection Working Party, which was an independent European Union Advisory Body on Data Protection and Privacy established pursuant to Article 29 of the then EU Directive 95/46/EC. The working Group http://www.kenyalaw.org - Page 125/174