Thread by @lawyershubkenya

We are in court ready for to give you live updates on the NIIMS petiton.
#GoodID #DigitalID #africalawtech #hudumanamba #NIIMS @BonyoLinda @AfricaLawTech @NubianRights @thekhrc @OmidyarNetwork @iam_anandv

We are in session. The court renders its apologies for keeping us waiting.

The court will offer summary judgements now as their full judgement is about 500pages.

The advocates are now entering appearance for both petitions

There are two judgements as there are two petitions
One: by @NubianRights, @thekhrc @HakiKNCHR
The other by @OkiyaOmtatah

Government is represented by the Office of the AG

The court begins judgement on consolidated petition 56,58 &59 by @NubianRights
They read a summary of their findings.

1. The passing of the Statute Law Miscalleneous Act of 2018 which amended the registration of Persons Act.
It allows for collection of GPS data and sets up NIIMS

The petitioners challenged the Act as it violates fundamental freedoms granted by the Constitution
The petitioners @NubianRights @thekhrc Were joined by @MUHURIkenya @InformAction_KE

The respondents are :
AG
Director of NRB
Speaker of National Assembly
Cs interior
Ps interio
CS ICT

Issues by petitioners
Lack of senate participation
Marginilization of Nubian community and other vulnereable communities
Threat to privacy
Lack of public participation.

Issues by the court:
I. The process of enactment of the Act was constitutional

2. Whether the ammended act violates the right to privacy?
Is the informatiom collected intrusive?
Are rights of children violated?
Is there sufficient data protection laws ?

Does the ammended Act threaten the right against discrimination with regards to the Nubian Community

Public participation is important. The advertisment for public participation in national dailies was sufficient.
The court notes there are roles to be played by Parliament, the Executive and Civil society.

6th respondents annexed a copy of their advertisement in the national dailies. It invited members of the public to submit their views on the Bill.

The courts view is that the fact that time was available for public participation must be considered. The public was aware of the Bill and after expiry of 7 days in the advertisement members could still participate in committee proceedings

Court looked to the case of LSK v AG 2013 to determine if there is adequate public participation: from formulation of the bill to enactment of the Act

The court notes that use of statute miscellaneous bill to effect substantive ammendments to a statute : has its short comings. It may deny the public the opportunity of public participation

The court states the question is in using a miscallenous bill the question to act is : has using it limited the right of public participation. If there is evidence to demostrate that there was sufficient p. Participation then court may allow it.

3. Whether the bill concerned counties and thus required involvement of the senate.

The supreme court in their advisory opinion dealt with issue of involvement of counties.
It explains the role of senate in enactment of Law.
The functions given to the county under the constitution did not include enactment of a national register.

The court finds that the provisions didn't require involvement of the senate

Issue 2: Right to privacy

The provision of collection of biometric data was unncessary.

The data collected isn't supported by stated purposes.
Article 31 of the constitution guides against the right to privacy

Court in its detailed judgement considered cases from kenya and abroad regarding the right to privacy

There is information that is intimate and an individual wishes to keep private which includes information about their unique human characteristics

This includes DNA n GPS.

Court notes data collected by NiIMS allows collection of sensitive data from the individual. It refers to definition of sensitive personal data under the Data Protection Act 2019 because of more serious impact of loss

Therefore collection of biometric data must be protected.

Personal data is intrusive when its collected without a person's knowledge or consent
Court notes that the data capture form issued during registration of Niims allowed one to.give consent

Petitioner failed to demonstrate that data subjects didn't understand the nature of the consent.
There was also no existing legislation at the timeof collection of data that required data subjects to give consent

It is necessary to lay down specific safeguards in collection of sensitive data.
With regard to the fact the collection of GPS information will lead to surveillance

The court finds that gps n DNA are personal sensitive data that require protection. Therefore the relevant respondents have an obligation to put in place security safeguards.

Therefore question remains was whether collection of biometric data was necessary.
The respondents submit that reliable data is necessary for the state to offer security to its citizens and establish a single source of identification
Further right to privacy isn't absolute

The court finds that biometric data is necessary for idsntification purposes.
The court referred to report of Art 29 which states : data should have attributes that are universal,unique and permanent
Thus biometric data required meets this criteria

The only reservation is use of DNA for identification as it doesn't provide real time results and is complex.

Its the court's view is that the combination of two or more personal characteristics improves identification.

With regard to the setting up of centralised single source of identity: Identification and verification will always need a database which may be done centrally.

Therefore: Other than DNA n GPS informatiom collected by niims is necessary

Was there violation of privacy to children: the court must act in the best interest of children and thus the act doesn't apply to children and collection of their biometric data violates their right to privacy.

Prior to the Amenmdent the registration of persons Act didn't apply to children.

This inconsitency is solved ny the fact that section 9A of the RPA ammended prior provisions and thus niims applies to children.

No special protection was provided to collection of children's data and thus there id clearly a risk of childrens data.
The #DPA 2019 provides provision for protection of children' s data.

Court agrees with the petitioner that there is no definition of children under the Act.

With enactment of data protection act, parties were given opportunity to make submissions of it. The parties were given an opportunity to address the court on the same and all agreed that court should take judicial notice of the act

In addition to taking judicial notice of the DPa and its provisions, court was also guided by the OECD privacy principles

This include prinicples on collecting. Processing and transfer of data

The RPA isn't one of the acts to which DPA applies, the court finds that the DPA does apply to NIIMs
Including subsidiary legislation to be made by the data protection commissioner

Data protection : requires operationalize of the legal framework , data protection act, that is creation of the office of data protection commissioner and registration of data controllers and processors.

Court received detailed testimony on the architecture of niims regarding whether its centralised/decentralised
open source or not

There will.be risks Of Attacks which exist eith storage of data but most crucial risk is that related to misuse of biometric data which can result in profiling.
They however don't depend on the centralisation of the database.

Thus all biometric systems require sufficient security safeguards and regulations e.g. Aadhar sharing of information regulation, which regulated various aspects of processing of collected data

Thus to this extent we find the legal framework wanting and poses a risk to privacy.

Limitation is justfiable under article 24?
The right to privacy isn't absolute and can be limited where its justifiable under art. 24

The court finds that info on DNA n GPS without legislation determining the manner it will be used is a limitation that is unjustifiable.
It also may cause harm to the data subject. Therefore the can be no collection of DNA n GPS without empowering legislation

On inadewuate legislative framework: law limiting fundamental rights must be clear n unambigous. Thus to this extent its unjustfiable not to have a comprehensive legal framework when collecting personal data

The conclusion is that the process of niims appears to have been rushed.

Right to equality n non discrimination:
The implemenntation of niims will affect members of nubian community
Further implementation of huduma number will deny them servuces

Court has considered various court decisions that define what is discrimination.
Court notes that differential treatment is in allowed in certain circumstances

Court must however consider whether that differentiatial treatment is allowed.

Court has considered section 9a that sets up niims system. Noted that impugned laws applies to both nationals and foreigners

Thus every person resident in Kenya are entitled to register for huduma number. The challenge however with regarding to vetting that is provided under section 8 of the RPA

The gist of the matter petition is that the vetting is discriminatory.
There are conditions to be issued with identity documents.

Different legislations apply to various categories of people in accesing identification documents

There is no differential treatment intoduced by the amendments to the RPA

As a general rule, Petitioners have an obligation to show how a right to equality has been violated by the state.

The evidence given by one of the petitioners witness wasn't enough to establish equality and non- discriminatiion for a whole community.

Court was unable to find evidence supporting violation of right to equality and non- discrimination to the nubiam community

On the issue of access to governement services:
Parties presented two scenarios 1. Mandatory use of niims will lead to exclusion fr govt service due to lack of citizenship documentation
2. Access will Be easy as data will Be available

Court must find a balance between these two scenarios. There maybe a segment of population that run the risk of exclusion from.niims

The court finds the need for a regulatory framework that ensure registration for all

petitions partially succeed.
Each party shall bear its own costs

Declaration that collection of dna n gps is intrusive , unconstitutional and violates right to privacy.

Respondents are at liberty to continue with implementation of niims and data collected on the requirement that the necessary legal framework identified under the judgement is enacted.

Each party shall bear its own costs.

With regard to the second petition:
Court finds nothing from its analysis that supports the enjoinder of a person in the suit for acting in their official capacity.

Secondly, there was no legislation prohibiging parliamnet from using omnibus bills

PFMA s24 2012 that introduces s2a was effected without public participation and thus unconstitutional

Amendments to s6 of KICa by the statute law 2018 is unconstitutional
As it violates freedom of media

Orders s6 KICA as amended is uncostittutional
Amendment to s24 of pFMA is unconstitutionan null & void
Collection of DNA is uncostitutional

Order : respondents can proceed with implementation of niims subject to enactment of comprehensive legislation framework dealing with all issues.

Court shall provide i
Final orders issued in the summary judgement. Final judgement available from Tuesday