South Africa: Kenya's Huduma Namba: Ambition Fraught With Risk

Digital identity programs in jurisdictions with weak privacy regulations face the risk of commodification, breach and misuse. This risk is exacerbated when governments link digital identity with citizenship, voting rights, public services, and employment. This piece discusses Kenya's digital identity program, Huduma Namba.

Huduma Namba

Kenya's Huduma Namba, meaning service number in Swahili, is a biometric digital identity program. It is intended to be the 'single source of truth' about a person's identity. Kenya established the National Integrated Identity Management System ("NIIMS") in 2019 through a miscellaneous act amending the Registration of Persons Act, 1949. The NIIMS is intended to administer the collection and storage of personal data for the Huduma Namba program. This amendment faced criticism for being inadequate and obfuscatory.¹ Kenya then released a draft of the Huduma Bill, 2019 ("Huduma Bill"). The Huduma Bill is a standalone statute intended to provide firm legal backing to the NIIMS and govern its functioning.² The draft of the Huduma Bill has been released for public consultation. Kenya has already collected extensive information about its citizens and residents, including biometric information such as fingerprints, hand geometry, retina and iris patterns, voice waves, as well as DNA and GPS data.³

Legal challenge

In early 2019, the Kenya Human Rights Commission, Kenya National Commission on Human Rights and the Nubian Rights Forum filed petitions before the High Court of Kenya challenging the establishment of the NIIMS and the collection of data for the Huduma Namba. Their concerns were: limited public consultation, collection of sensitive personal data in a centralised database without adequate data protection safeguards, compulsory registration, interlinking digital identity with welfare services, and the potential for exclusion of marginalised groups. On April 1, 2019, the High Court delivered a significant interim ruling ("Interim Judgement").⁴ The Court found that there was no specific data protection legislation for the protection of personal data collected by the government.⁵ Therefore, while the Kenyan Government was permitted to proceed with the Huduma Namba program, it was specifically prohibited from:⁶

• Making participation in the program mandatory;
• Setting any deadlines for registration;
• Making the Huduma Namba mandatory for government welfare programs or public services; and
• Sharing the personal data collected with any third party.

In contrast with the decoupling of the Huduma Namba from the delivery of welfare services in the Interim Judgement, the Indian Supreme Court in Justice Puttaswamy (Retd.) and Anr. v Union of India and Ors. upheld Section 7 of the Aadhaar Act which made the number a necessary pre-requisite for subsidies, welfare programs and public services.

Despite the Interim Judgement, Kenya signaled its intention to require a service number for various government and private services including passport, driving license, bank account, access to public education, voting and marriage registration.⁷ There are also steep fines and/or imprisonment in case of violations.⁸ These penalties have been criticised for being disproportionate, unnecessary, and in violation of international privacy law. ⁹ After the Interim Judgement was delivered, Kenya also passed the Data Protection Act on November 25, 2019 ("Data Protection Act").¹⁰ Intended to give effect to the right to privacy in Kenya's Constitution, it is a comprehensive data protection legislation that covers the collection, storage, processing and sharing of personal data.

On January 30, 2020, the High Court held that the Huduma Namba was unconstitutional in the absence of adequate data protection regulations ("High Court Judgment").¹¹ It held:

• As such, data was collected by the NIIMS with consent and was accordingly consistent with the Constitutional right to privacy in Kenya;
• The initial legislative process followed to establish the NIIMS through a miscellaneous amendment legislation was constitutional;¹²
• The collection of DNA and GPS data was disproportionate and unnecessary;¹³
• The storage and use of data collected was unconstitutional without data protection legislation governing these activities;¹⁴
• For the Huduma Namba to proceed, the Data Protection Act passed by the Kenyan Parliament was required to be implemented, along with specific regulations governing storage and use of personal data;¹⁵ and
• Exclusionary consequences of NIIMS, such as its effects on marginalised communities, were considered but not held to be dispositive to the question of constitutionality because of the lack of evidence of such exclusion in the text of the law.¹⁶

Gaps in privacy protection

The Kenyan Constitution recognises the right to privacy.¹⁷ The Constitution also states that international law will form a part of Kenyan law.¹⁸ Therefore, the right to privacy under international law also creates obligations for Kenya under its domestic law. As such, these obligations require the enactment of a data protection law to give effect to the constitutional right to privacy.¹⁹ Therefore, the collection of data person without the protection offered by a data protection law would be violative even of the Constitutional right of privacy.

The Huduma Bill specifically allows for the applicability of other data protection legislations.²⁰ Therefore, the Data Protection Act is applicable to the Huduma Namba program. However, there appears to be a protection gap. The Huduma Namba registration process started in April 2019 and involved the collection of vast amounts of personal information of Kenyan citizens. The Data Protection Act, which does not have retrospective effect, received Presidential assent on November 8, 2019 and became effective only on November 25, 2019. Accordingly, the Data Protection Act would protect first, any collection of personal data under the Huduma Namba program post November 25, 2019 and second, the continued storage and processing of personal data already collected and to be collected. The collection of personal data prior to November 25, 2019 as part of the Huduma Namba registration, remains unaddressed.²¹ Also, the Huduma Bill, the very legislation that governed the Huduma Namba program, was released for public comment much after the Huduma registration process commenced.²² Kenya collected vast amounts of personally identifiable information, including biometric information, of both citizens and non-citizen residents without either an enabling legislation or an operational data protection statute. Therefore, while the High Court Judgement acknowledged the need for implementing the Data Protection Act, the relief granted ignored the gap in dealing with collection already completed by the Kenyan government.

Exclusion of marginalised groups

A separate concern that the Huduma Namba has triggered is its impact on Kenya's vulnerable minority and refugee population.²³ As noted by Amnesty International, these communities may already be marginalised from welfare schemes and impacted by discriminatory state policies. Many fear that the digitisation of citizenship would altogether erase their existence.²⁴ The minority Nubian community, for instance, has historically found it hard to access national ID cards. There remains a high risk that this marginalisation will be exacerbated through the 'vetting' system that the Huduma Bill employs to prevent non-Kenyan residents from registering.²⁵ Activists argue that the vetting process is being weaponised against minorities like the Nubian community, to delay and interfere with the process of granting the Huduma Namba card.²⁶ Reports of Nubian persons who have misplaced documentation, children of single parents or those who belong to remote border territories being sent back from registration centres have added to such concerns.²⁷ In 2018, India also witnessed reports of a death by starvation due to exclusion from pension and food rations on account of mismatched biometrics in the Aadhaar card.²⁸ The High Court Judgement acknowledged the challenge of discrimination and exclusion. However, apart from reiterating the need for a clear regulatory framework to prevent such exclusion, it did not mandate any modifications to the NIIMS framework.

In its Interim Judgement, the High Court prohibited the imposition of deadlines for Huduma Namba registration. This would have allowed for marginalised communities with lower awareness of and access to registration centres to submit their details. The Interim Judgement also decoupled NIIMS from government and welfare services, thereby minimising the consequences of exclusion. Unfortunately, the January 30 judgement has not accounted for these issues in its reasoning. This has allowed the government to impose successive registration deadlines coupled with threats of denying access to mobile phone networks and other public services for unregistered Kenyans.²⁹

It is expected that the High Court Judgement will be appealed. Looking forward, the Kenyan appellate court may consider some of the interim protections awarded earlier by the High Court and also account for the consequences of exclusion of the Nubian peoples through indirect discrimination.³⁰ Public consultation around the draft Huduma Bill requires careful consideration surrounding questions of privacy, data protection and discrimination. This participatory approach to legislation will ensure that the Huduma Namba exercise lives up to its promise as an emancipatory measure for all Kenyan peoples.

This post is authored by Varun Baliga, a consultant working with Ikigai Law, with inputs from Nehaa Chaudhari, Director (Public Policy), Ikigai Law. Please reach out to us at contact@ikigailaw.com

Footnotes

1. Frankline Sunday, Questions over Huduma Namba as mass registration takes shape, Standard Digital, April 9, 2019, available at https://www.standardmedia.co.ke/business/article/2001320101/which-way-huduma-namba.

2. The Huduma Bill, 2019, available at https://www.ict.go.ke/wp-content/uploads/2019/07/12-07-2019-The-Huduma-Bill-2019-2.pdf.

3. Keren Weitzberg, Kenya's Controversial Biometric Project Is Shrouded in Secrecy, Coda, May 3, 2019, available at https://www.codastory.com/authoritarian-tech/kenya-biometric-project-shrouded-in-secrecy/.

4. Nubian Rights Forum & Ors v. The Honourable Attorney General & Ors., High Court of Kenya, Ruling No. 3, April 1, 2019. Available at http://kenyalaw.org/caselaw/cases/export/172447/pdf.

5. Ibid, paragraph 100.

6. Ibid, paragraph 107.

7. Section 8, Huduma Bill, 2019.

8. Sections 48, 56, Huduma Bill, 2019.

9. Amnesty International, Memorandum on Huduma Bill presented to the Cabinet Secretary, Ministry of Interior and Coordination of National Government, July 31, 2019, available at https://mobile.twitter.com/AmnestyKenya/status/1156589319819280386/photo/1.