Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 1036. We also observed that once in force, data protection legislation must also be accompanied by effective implementation and enforcement. The implementation of the Data Protection Act 24 of 2019 requires an implementation framework to be in place, including the appointment of the Data Commissioner, and registration of the data controllers and processors, as well as enactment of operational regulations. It was our finding therefore that while there is in existence a legal framework on the collection and processing of personal data, adequate protection of the data requires the operationalisation of the said legal framework. 1037. On the safety and security concerns raised related to the design of NIIMS, it was our conclusion that all biometric systems, whether centralised or decentralised, and whether using closed or open source technology, require a strong security policy and detailed procedures on its protection and security which comply with international standards. For our purposes, what was relevant is that the said principles and standards should be provided and actualized in regulations that will govern the operation of NIIMS. In addition, it was our view that the biometric data and personal data in NIIMS should only be processed if there is an appropriate legal framework in which sufficient safeguards are built in to protect fundamental rights. 1038. In this respect, while the Respondents explained the measures they have put in place to ensure the safety of the data collected by NIIMS and the security of the system, including the encryption of the data and restricted access, it was not disputed by the Respondents that there is no specific regulatory framework that governs the operations and security of NIIMS. The Respondents also did not provide any cogent reason for this obvious gap. To this extent we found that the legal framework on the operations of NIIMS is inadequate, and poses a risk to the security of data that will be collected in the system. (d) Whether the Impugned Amendments are an Unnecessary, Unreasonable and Unjustifiable Limitation. 1039. It was our finding that because of the speci"city of the information that DNA may disclose and the harm disclosure may cause not just to the data subject but other family members in terms of both identi"cation and genetic information, DNA information requires and justi"es a particular and specific legal protection. Likewise, we found that specific authorization anchored in law is required for the use of GPS coordinates in light of the privacy risks we identified in terms of their possible use to track and identify a person’s location. Accordingly, we found that the provision for collection of DNA and GPS coordinates in the impugned amendments, without specific legislation detailing out the appropriate safeguards and procedures in the said collection, and the manner and extent that the right to privacy will be limited in this regard, is not justifiable. 1040. We also noted that an inadequate legislative framework for the protection and security of the data is clearly a limitation to the right to privacy in light of the risks it invites for unauthorized access and other data breaches. To this extent we found the lack of a comprehensive legislative framework when collecting personal data under the impugned amendments, is contrary to the principles of democratic governance and the rule of law, and thereby unjustifiable. Whether there was a Violation of the Right to Equality and Non-Discrimination 1041. There were two facets of the alleged denial of the right to equality and non-discrimination disclosed. The first relates to the argument that the impugned amendments and the implementation of NIIMS will perpetuate discrimination against members of the Nubian community and other marginalised groups. The second relates to the contention that the impugned law makes it mandatory for everyone to obtain a Huduma Namba, failing which one will be denied government services. (a) On Discrimination against the Nubian Community 1042. We found that the impugned legislation did not contain a differentiation between members of the Nubian http://www.kenyalaw.org - Page 172/174