Data Rights and their Kenyan partner organisations the Kenya Human Rights Commission and the Nubian Rights Forum (NRF) are suing IDEMIA, one of the leading biometric tech companies in the world, before the Paris judicial tribunal.
The case alleges that IDEMIA failed to adequately address human rights issues in its vigilance plan.
The claimants specify that the company did not undertake human rights due diligence in the course of its 2018/2019 contract with the Kenyan government to furnish technology to capture the population’s biometric data for the development of a national digital ID system in Kenya, the so-called National Integrated Identity Management System (NIIMS) or Huduma Namba.
The claimants argue that NIIMS runs the risk of excluding already marginalized communities who struggle to register.
At the same time, the centralized storage of data without proper checks and balances carries the risk of being exploited for new purposes, including surveillance.
Despite these apparent risks to human rights, IDEMIA sold the enabling technology to Kenya without conducting proper due diligence as required under the French Due Vigilance Law.
“Under French law, companies like IDEMIA must identify adverse human rights risks that may result from their business operations and take mitigating measures,” said the claimants’ attorneys Henri Thulliez and Slim Ben Achour.
“Looking at IDEMIA’s due vigilance plan, it is clearly lacking any considerations of the risks that the use of their technology entail.”
The claimants are asking the Parisian court to order that IDEMIA adequately assess the risks inherent in Information Technology System (ITS) products and design appropriate mitigating measures.
Data Rights emphasizes the need for tech companies to adopt proper and efficient human rights due diligence procedures, especially when entering business relationships with governments.
“Bio-metric digital ID systems are often seen as an efficient way to modernize the public sector, but if this is done without due regard to its human rights impact, it can cause more harm than good”, said Lori Roussey from Data Rights.
“Any new bio-metric technology and personal data processing solution can be misused. Companies must pay particular attention to whom they sell their services to.”
