Why does a data protection framework remain elusive?

Thursday April 25 2019

The ongoing Huduma Number registration and discussions have elicited considerable debate, including a court injunction against forceful and limiting timelines for registration. There is no doubt that at some point, all Kenyans will get the number, but the contention is largely the process and safeguards.

It is building into a bigger conversation on data protection in the country. A strong argument by naysayers of Huduma Number is the insufficient legal safeguards to protect the collected data. The government in its response has argued that it already has these details in one form or another but only wants to physically verify Kenyans and create a central repository of identity details for Kenyans and foreigners in the country.


Certainly, time and again, breaches of data, like basic phone and identity numbers, have been misused. A marketer sends you an unsolicited request for purchase and politicians illegally acquire your data and request for votes and spamming are some of the many ways our data is already in the public and gets misused. These experiences inform discourse on the need to better plan future data collection, storage and usage by everybody, not just government.

In 2016, Kenya ushered in a new legal regime affirming access to information as a fundamental right to Kenyans. It took a painstaking process, led by various stakeholders, key among them the Kenyan Section of the International Commission of Jurists (ICJ Kenya) and Article 19 to make it possible. One of the fundamental aspects of the law was to make it possible for both natural persons and juristic persons to seek this information and relevant agencies, both private and public, have obligations to abide by time limits set by the law. Courts have proceeded to interpret the law robustly, all protecting and advancing this right.

What is often forgotten is that it took a champion at the National Assembly to make it possible. Then Member of Parliament Priscilla Nyokabi took it upon herself to risk it all with the Bill at the time and no amount of distractions, especially from the Executive, derailed her quest. The Executive tried to take over the Bill but she stood firm, knowing well that it had failed to take leadership of the process and would likely stall it.


At the beginning of that journey, the data protection framework was also being discussed. However, it lacked its own champion and at the risk of not getting any of the two, the realisation of Article 35 was given greater priority. It still has gaps, especially the policy that should be proposed by Ministry of ICT but it has yet to.


The discussions on data protection first got a champion in Baringo Senator Gideon Moi who sponsored a private members Bill at the Senate. The discussions on it continue with input from stakeholders. But the ICT ministry also jumpstarted its own framework last year with both policy and draft law. The latest information on it was when Interior Cabinet Secretary Fred Matiang’i speaking recently in an interview with NTV’s Dennis Okari said the cabinet approved the draft Bill and it should be presented to the National Assembly.

Kenyans are therefore starring at a double process by Parliament. Civil Society groups are wondering why government cannot harmonise both processes to come up with one Bill to harness time and expertise, other than parallel draining initiatives of which both could come to naught.

At the heart of this is the ICT ministry’s inactions to spearhead the process and get the country a data protection framework – access to information policy and law. In previous legal framework processes like the ICT Practitioners Bill, the ministry was not consistent in its contributions to either have it or dismiss it as it was proposed as a private members Bill by Majority Leader Aden Duale. Today, Nominated MP Geoffrey Osotsi decided to take it over and is receiving comments on it, again as a private members Bill.


It should be remembered that a court stopped the Directorate of Criminal Investigations (DCI) from publishing and publicising arrested citizens data on social media but it continues to do it unabated. Justice Wilfrida Okwany issued temporary orders restraining the DCI from posting such photographs specifically on Twitter and Facebook, but with impunity being the mantra, they continue to do it to this day. They have neither challenged nor obeyed the temporary orders.

That Kenyans are asking vital rights to be respected is informed by practice, especially by government, to disregard these rights. They are asking for important safeguards to be put in place, not as a favour but as expected in Article 31 of the Constitution. Dismissing them as activists flies in the face of exactly why their concerns are genuine.

The author is passionate about freedom of expression. @oleshitemi