• Process called illegal; judge ordered the government to carry out the impact assessment before rolling out the Huduma cards.
•“State did not appreciate import, extent of Data Protection Act on data collected under National Integrated Identity Management System, (NIIMS), judge ruled.
Calling the Huduma Nama process illegal, the High Court has directed the government to conduct a data protection impact assessment before rolling out the cards.
It cited a lack of data protection.
Many Kenyans have already been issued with the cards.
“An order of mandamus is hereby issued compelling the government to conduct a data protection impact assessment in accordance with Section 31 of the Data Protection Act before processing of data and rolling out the Huduma cards,” Justice Jairus Ngaah ruled.
He further quashed the decision by the Ministry of Interior and Coordination of National Government to roll out the Huduma Namba cards, saying it was illegal.
“An order is hereby issued to bring into this honourable court to quash the government's decision of November 18, 2020, to roll out Huduma cards for being ultra vires of the Data Protection Act 2019,” the court ruled.
The judge ordered the government to carry out the impact assessment before rolling out the Huduma cards
However, Justice Ngaah noted the order quashing the rollout of Huduma Namba was of no consequence because the state has already rolled out the cards.
The court also ruled that the state failed to ensure that the Bill of Rights, including the right to privacy, was respected and protected during the processing and rollout of the cards.
“The state had not appreciated the import and extent of the Data Protection Act with respect to the data collected under the National Integrated Identity Management System,” Ngaah ruled.
He said if the state followed due process then they would have given effect to Section 31 of the Data Protection Act and conducted a data impact assessment before processing personal data and issuing Huduma cards.
Ngaah said NIIMS, which the state used to collect data, relied on Section 9(a) of the Registration of Persons Act which in turn came about as a result of the Miscellaneous Amendment Act No.19 of 2018.
He said the Miscellaneous Amendment Act No.19 of 2018 was nullified by a three-judge bench among 23 laws that were purportedly enacted by the National Assembly without any involvement of the Senate.
He said no other court has overturned the said judgment that nullified the said laws, so it remains illegal.
The court said individual constitutional rights and basic rights were under threat by the exercise of the state in collecting and processing data without a legal framework to ensure the right to privacy was protected.
“I will stand with the individual against the might of the state and hold that fairness is in the interpretation of Section 31 as being retrospective in its application. I am satisfied that the applicant has made out a case against the respondents,” judge Ngaah ruled.
In the case, The Katiba Institute moved to court last year challenging the decision by the state to roll out Huduma Namba cards without carrying out a data protection impact assessment.
Katiba Institute, through lawyer Dudley Ochiel, argued the data protection impact assessment is a necessary mechanism for mitigating the risks associated with the system, including the production and rollout of Huduma Namba cards.
The state had strongly opposed the petition by Katiba Institute, saying due process was followed in the rollout.
Speaking after the judgment, Ochiel said it was a major win for the right to privacy, even though it is a baptism by fire to the Data Protection Commissioner.
“I remember we sued her within 48 hours after she was sworn into office as a commissioner," Ochiel said.
Edited by A.N