Kenya’s Data Protection Act came into effect in November 2019 but soon thereafter, in January 2020, the High Court, in the Nubian Rights Forum Case, declared that the legislation was, in the absence of regulations and institutions necessary for its implementation, still deficient in providing adequate safeguards for the protection of personal data.

At the heart of this pivotal litigation was the collection by the state of personal data for purposes of establishing an integrated identity system and issuing digital identity cards. The High Court excluded DNA and GPS information from the data that could be legitimately collected from citizens, saying it was too invasive to privacy and unnecessary for the intended purpose of civil registration and issuance of identity documents. In addition, the court directed the state to put in place adequate measures for safeguarding personal data legitimately collected to advance the policy objectives of the state.

Translate »