Summary:

The High Court of Kenya declared the rollout of the Huduma Namba (National Integrated Identity Management System - NIIMS) illegal due to violations of the Data Protection Act, 2019. The court found that the government had collected and processed personal data without conducting a required Data Protection Impact Assessment (DPIA) as mandated by the Act. The court's decision was based on Section 31 of the Act, which necessitates a DPIA when processing personal data poses a high risk to data subjects' rights and freedoms. The case was brought forward by the Katiba Institute, led by legal scholar Yash Pal Ghai, on grounds of inadequate protection of citizens' personal information.

The court issued orders of certiorari to annul the government's decision to roll out Huduma Cards and mandamus to compel the government to conduct a DPIA before further processing data and distributing cards. It also halted Phase II registration until compliance with the Data Protection Act was ensured.

Despite the government having processed and distributed millions of Huduma Cards, the court's orders imply that these cards cannot be used until the government fulfills the requirements outlined in the ruling, including conducting a DPIA.