Across the globe, countries are strengthening data privacy laws to safeguard citizens’ digital rights.
The European Union’s General Data Protection Regulation continues to set the benchmark, insisting on user consent, transparency and strict accountability for breaches.
Brazil has the General Data Protection Law, South Africa has the Protection of Personal Information Act and India has the Digital Personal Data Protection Act. All have followed suit, establishing legal regimes grounded in the principle that digital rights are human rights.
Kenya took a commendable step in this direction by enacting the Data Protection Act in 2019. The law introduced vital safeguards for collecting, processing and storing personal data, with the Office of the Data Protection Commissioner tasked with enforcement.
However, enforcement challenges exist, including low public awareness, limited institutional capacity, and the ever-evolving nature of digital technologies.
Unfortunately, just as the country is finding its footing with these protections, new threats are emerging—not from foreign actors or rogue corporations, but from within the government itself.
The Finance Bill, 2024, first raised alarm when it proposed exempting the Kenya Revenue Authority from compliance with the Data Protection Act under the pretext of improving tax enforcement.
Civil society and legal experts pushed back, citing constitutional violations and the risk of unchecked surveillance.
Currently, the proposed Finance Bill, 2025, goes a step further, seeking to repeal Section 59 A (1B) of the Tax Procedures Act. This section prohibits the KRA commissioner from compelling taxpayers to disclose personal data or trade secrets obtained during business.
This is a crucial legal safeguard against state overreach; its repeal would dismantle a vital privacy shield and expose sensitive personal and corporate data to arbitrary access.
This move contravenes Article 31 of the Constitution, which guarantees the right to privacy and undermines Kenya’s commitments under international human rights law, enshrined in Articles 2(5) and 2(6).
Disguised as an enhancement of efficiency, the repeal is part of a dangerous global trend where mass surveillance is normalised under the guise of governance.
In a country already struggling with allegations of unlawful surveillance, abductions and enforced disappearances—often linked to illegal access to personal data held by telecommunications companies—such a move is deeply troubling.
Beyond individual privacy, the political consequences are dire. With unrestricted access to vast troves of data, there is a real risk of voter targeting, political profiling and electoral interference.
In the wrong hands, this data becomes a weapon not for tax collection but for political control, eroding public trust in institutions and further weakening democratic processes.
The erosion of data protection is not an isolated issue; rather, it represents a broader tension between the march of technology and the preservation of fundamental freedoms.
As the state becomes more digitised, its commitment to rights-based governance must deepen, not weaken, considering that legal safeguards are not obstacles to progress but the foundation of a democratic digital future.
As author and scholar Shoshana Zuboff reminds us, “If we allow surveillance capitalism to flourish, it won’t be because it was irresistible, but because we failed to resist.”
The proposed repeal of Section 59A(1B) must be firmly opposed to protect personal data and defend the integrity of our democracy.
