Nubian Rights Forum & 2 Others V Attorney General

Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested
Parties) [2020] eKLR
REPUBLIC OF KENYA
IN THE HIGH COURT OF KENYA AT NAIROBI
CONSTITUTIONAL & JUDICIAL REVIEW DIVISION
CONSOLIDATED PETITIONS NO. 56, 58 & 59 OF 2019
BETWEEN
NUBIAN RIGHTS FORUM.................................................................1ST PETITIONER
KENYA HUMAN RIGHTS COMMISSION......................................2ND PETITIONER
KENYA NATIONAL COMMISSION ON HUMAN RIGHTS.........3RD PETITIONER
VERSUS
THE HON. ATTORNEY-GENERAL.................................................1ST RESPONDENT
THE CABINET SECRETARY, MINISTRY OF INTERIOR &
CO-ORDINATION OF NATIONAL GOVERNMENT...................2ND RESPONDENT
THE PRINCIPAL SECRETARY, MINISTRY OF INTERIOR &
CO-ORDINATION OF NATIONAL GOVERNMENT...................3RD RESPONDENT
THE DIRECTOR, NATIONAL REGISTRATION BUREAU........4TH RESPONDENT
THE CABINET SECRETARY, MINISTRY OF INFORMATION,
COMMUNICATION & TECHNOLOGY.........................................5TH RESPONDENT
THE SPEAKER, NATIONAL ASSEMBLY......................................6TH RESPONDENT
KENYA LAW REFORM COMMISSION.........................................7TH RESPONDENT
AND
CHILD WELFARE SOCIETY..............................................1ST INTERESTED PARTY
AJIBIKA SOCIETY...............................................................2ND INTERESTED PARTY
http://www.kenyalaw.org - Page 1/174

Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR
MUSLIMS FOR HUMAN RIGHTS INITIATIVE.............3RD INTERESTED PARTY
HAKI CENTRE......................................................................4TH INTERESTED PARTY
LAW SOCIETY OF KENYA.................................................5TH INTERESTED PARTY
INFORM ACTION.................................................................6TH INTERESTED PARTY
BUNGE LA WANAINCHI.....................................................7TH INTERESTED PARTY
INTERNATIONAL POLICY GROUP.................................8TH INTERESTED PARTY
TERROR VICTIMS SUPPORT INITIATIVE....................9TH INTERESTED PARTY
JUDGMENT
INTRODUCTION
1. On 20th November 2018, the National Assembly enacted Statute Law (Miscellaneous Amendment) Act No. 18 of
2018. The President of the Republic of Kenya gave his assent to the said Act on 31st December 2018, and it
commenced operation on 18th January 2019.
2. The effect of the Act was to amend several provisions of a number of existing statutes, among them the
Registration of Persons Act (Cap 107 of the Laws of Kenya) (hereinafter referred to as “the Act”). The
amendments to the Act establishes a National Integrated Identity Management System (hereinafter “NIIMS”) that
is intended to be a single source of personal information of all Kenyans as well as foreigners resident in Kenya.
3. A new section 9A was introduced to the Act by the amendments, and it established NIIMS in the following
manner:
“9A (1) There is established a National Integrated Identity Management System.
(2) The functions of the system are —
(a) to create, manage, maintain and operate a national population register as a single source of personal
information of all Kenyan citizens and registered foreigners resident in Kenya;
(b) to assign a unique national identification number to every person registered in the register;
(c) to harmonise, incorporate and collate into the register, information from other databases in Government
agencies relating to registration of persons;
(d) to support the printing and distribution for collection all national identification cards, refugee cards,
foreigner certificates, birth and death certificates, driving licenses, work permits, passport and foreign travel
documentation, student identification cards issued under the Births and Deaths Registration Act, Basic
Education Act, Registration of Persons Act, Refugees Act, Traffic Act and the Kenya Citizenship and
Immigration Act and all other forms of government issued identification documentation as may be specified by
gazette notice by the Cabinet Secretary;

(e) to prescribe, in consultation with the various relevant issuing authorities, a format of identification document
to capture the various forms of information contained in the identification documents in paragraph (d) for
purposes of issuance of a single document where applicable;
(f) to verify and authenticate information relating to the registration and identification of persons;
(g) to collate information obtained under this Act and reproduce it as may be required, from time to time;
(h) to ensure the preservation, protection and security of any information or data collected, obtained,
maintained or stored in the register;
(i) to correct errors in registration details, if so required by a person or on its own initiative to ensure that the
information is accurate, complete, up to date and not misleading; and
(j) to perform such other duties which are necessary or expedient for the discharge of functions under this Act.
(3) The Principal Secretary shall be responsible for the administration, coordination and management of the
system.”
4. Section 3 of the Act on interpretation was also amended to include the following new definitions:
“Insert the following new definitions in proper alphabetical sequence- "Biometric" means unique identifiers or
attributes including fingerprints, hand geometry, earlobe geometry, retina and iris patterns, voice waves and
Deoxyribonucleic Acid in digital form;
"Global Positioning System coordinates" means the unique identifier of precise geographic location on the
earth, expressed in alphanumeric character being a combination of latitude and longitude; "physical form"
means existing in a form that one can see and touch; and "Principal Secretary" means the Principal Secretary
in the ministry responsible for matters relating to registration of persons.”
5. The Nubian Rights Forum (the 1st Petitioner), the Kenya Human Rights Commission (the 2nd Petitioner), and the
Kenya National Commission on Human Rights (the 3rd Petitioner), are aggrieved with the amendments made to the
Act, which they claim were passed in violation of the Constitution and in bad faith and pose serious and immediate
threats to fundamental rights and freedoms protected under the Bill of Rights. They therefore respectively filed
Petitions in this Court, namely Nairobi High Court Petition No 56 of 2019, Nairobi High Court Petition No 58 of
2019 and Nairobi High Court Petition No 59 of 2019, which petitions were subsequently consolidated for hearing
by this Bench.
6. The position taken by the Petitioners was supported by Muslims for Human Rights, Haki Centre, Law Society of
Kenya and Inform Action which were joined to the proceedings as the 3rd, 4th, 5th and 6th Interested Parties
respectively.
7. The Respondents in the Consolidated Petitions are the Honourable Attorney General (the 1st Respondent); the
Cabinet Secretary, Ministry of Interior and Co-ordination of National Government (the 2nd Respondent); the
Permanent Secretary, Ministry of Interior and Co-ordination of National Government (the 3rd Respondent); the
Director of National Registration (the 4th Respondent); the Cabinet Secretary for Information, Communication and
Technology (the 5th Respondent); the Speaker of the National Assembly (the 6th Respondent); and the Kenya Law
Reform Commission (the 7th Respondent).
8. The Child Welfare Society of Kenya, Ajibika Society, Bunge La Mwananchi, International Policy Group and

Terror Victims Support Initiative being the 1st, 2nd, 7th, 8th and 9th Interested Parties joined the Respondents in
opposing the Petitions.
9. The Petitions proceeded to hearing by way of affidavit evidence, oral testimony including by expert witnesses,
and written submissions which were highlighted by the parties. We need at this stage to draw attention to the fact
that after completion of the hearing, and before delivery of judgment, the Data Protection Act No. 29 of 2019 was
enacted by the National Assembly. The 6th Respondent thereupon sought directions from the Court in light of this
development. The Court considered it prudent that the parties be given an opportunity to comment on the Data
Protection Act and set a further hearing date to receive submissions in this regard. We set out hereunder the
respective pleadings and evidence by the parties. For convenience, we shall summarise the cases for the principal
parties alongside the respective cases of the Interested Parties who supported their positions.
THE PETITIONERS’ CASES
The 1st Petitioner’s Case
10. The 1st Petitioner, the Nubian Rights Forum, is a human rights organization that advocates for the rights of the
Nubian community in Kenya. Its Petition is dated 14th February 2019 and is supported by the affidavit of its
Chairman, Mr. Shafi Ali Hussein, sworn on even date and a further affidavit sworn by the said deponent on 12th
April 2019. Additional affidavits filed by the 1st Petitioner were sworn on 11th April 2019 by Dr. Thomas Fisher, a
Research Officer with Privacy International, and on 12th April 2019 by Ms. Fatuma Abdulrahman and Mr. Ahmed
Khalil Kafe, both members of the Nubian community.
11. The 1st Petitioner also filed a witness statement by Mr. Anand Venkatanarayanan, who gave oral testimony as
one of the expert witnesses for the Petitioners. Mr. Shafi Ali Hussein, Ms. Fatuma Abdulrahman and Mr. Ahmed
Khalil Kafe were also cross-examined on their affidavits at the request of the 4th and 7th Respondents.
12. The 1st Petitioner is aggrieved by several aspects of the impugned legislation, including its implementation. The
first aspect of its case is that in order to constitute the NIIMS database established under section 9A of the Act, the
government commanded that Kenyan citizens and foreign nationals provide sensitive personal information
purportedly to establish, verify and authenticate their identity, and subsequently receive a unique identity number,
known as Huduma Namba, through a 30-day nationwide mass biometric registration exercise.
13. The 1st Petitioner contended that the technical specifications and planned practical implementation of NIIMS
was opaque, with inadequate and conflicting information provided to the public. Its position was that the process by
which the NIIMS system has been established and the information revealed to date concerning its design,
implementation and administration strongly suggests that the lessons from international experiences with digital
identity systems have not been sufficiently reviewed and applied by the Respondents. The experiences and
challenges of the Aadhaar system in India were cited as an illustration of the problems likely to be encountered
with NIIMS.
14. The 1st Petitioner further contended that even though the government has stated that it would not collect
Deoxyribonucleic Acid (DNA) and Global Positioning System (GPS) coordinates, the legislative amendments
place no limits on the scope of data that can be captured and stored in the NIIMS database.
15. The second aspect of the 1st Petitioner’s grievance against NIIMS, as we understand it, is with regard to its
linkage to the delivery of an undefined sphere of government services, including access to identification
documents, universal healthcare, fertilizer subsidies, cash transfers, affordable housing and education. The 1st
Petitioner complained that members of the Nubian community have challenges acquiring identity documents under
the existing system under section 8 of the Act. It claimed that the section grants registration officers broad authority

to demand additional evidence from persons from marginalized areas, and entails an onerous process of
establishing their Kenyan nationality in order to receive a national identity card.
16. It was its argument further, that the discriminatory practices against the Kenyan Nubian community has been
recognized at the regional level by the African Commission on Human and People’s Rights in the Nubian
Community in Kenya vs Republic of Kenya (Decision of February, 2015), and by the African Committee of
Experts on the Rights and Welfare of the Child in Children of Nubian Descent in Kenya vs Kenya (Decision of
March, 2011). Furthermore, that both tribunals found that Kenya’s discriminatory registration and identity
documentation practices infringe on the rights of members of this minority.
17. The gravamen of the 1st Petitioner’s case therefore, is that NIIMS will aggravate the discriminatory practices
against the Nubian community, as it will be linked to the provision of essential government services. According to
the 1st Petitioner, their access to identity documents is already unequal, and the mass biometric registration
requiring submission of state-issued documentation, threatens to further exclude and disenfranchise persons from
marginalized areas.
18. The 1st Petitioner’s third challenge to NIIMS related to the process of procurement, design and establishment of
NIIMS. It contended that IDEMIA (previously or concurrently operating as Morpho/OT-Morpho/Safran Identity
and Security) which has been tasked with the process of data collection under NIIMS, has been implicated
regarding lack of proper delivery of services both in Kenya and other countries such as Ghana. It was its contention
that there is no public record of the procurement process for the design of NIIMS, and that the tender could have
been awarded before the impugned law was enacted.
19. The fourth challenge raised by the 1st Petitioner is on the process of enactment of the Statute Law
(Miscellaneous Amendments) Act No. 18 of 2018. It was averred that the Bill was never presented to, debated or
passed by the Senate, yet according to the 1st Petitioner, this is the constitutional way through which members of
the public participate in the passing and amendment of laws.
20. The 1st Petitioner further contended in this regard that counties have a direct interest in the registration of
persons, as part of their functions relate to county planning and development including the use of statistics. It
contended therefore, that failure to submit the Statute Law (Miscellaneous Amendments) Bill to the Senate for
consideration was a violation of Article 96 of the Constitution.
21. It was also the 1st Petitioner’s case that the use of a miscellaneous amendment procedure for the establishment
of NIIMS denied the concerned communities adequate opportunity to know about the issues and participate in its
establishment as required under the Constitution. Further, that the Miscellaneous Amendment Bill was an
“omnibus Bill” which obfuscated and combined many issues, making it extremely difficult for citizens to engage
effectively with the process. According to the 1st Petitioner, it is only proper to use the procedure of Statute Law
Miscellaneous Amendments in cases of minor, non-controversial corrections of legislation.
22. The 1st Petitioner further challenged the process of enactment of the impugned amendments on the basis that
the right to public participation was not observed. It contended that the concerned communities were not accorded a
reasonable opportunity to know about the issues or have an adequate say in the amendments. It further argued that
since the enactments, the government has not sensitized its citizens on the far-reaching effects of data collection.
23. The fifth and last concern raised by the 1st Petitioner was that there is no law in force to guarantee the privacy
provisions in the Constitution, given the invasive process proposed to be implemented through NIIMS. It was its
case that it is the right of every person to have their right to privacy, which includes homes, property, possessions,
information and communication, protected. The 1st Petitioner raised particular concern with the requirement for
Global Positioning Systems Coordinates (GPS) and Deoxyribonucleic Acid (DNA), among other biometrics. It

asserted that GPS targets an individual’s communications and their exact whereabouts, which is very intrusive into
one’s right to privacy, while the definition of “biometric” in the Act permits the collection, storage, and retention
of an inordinate amount of data.
24. The 1st Petitioner contended, in addition, that there are insufficient safeguards in the existing laws to protect the
personal data that will be collected. Further, that there are no effective measures to ensure that the data will not be
accessed by persons who are not authorized by law to receive, process and use it, or that it is not used for purposes
incompatible with the reason for its collection. It was also its contention that the amendments to the Act are silent
on whether citizens will be able to have access to the information gathered, and whether they can ask for incorrect
data to be deleted or rectified.
25. Lastly, it was the 1st Petitioner’s case that the impugned amendments do not comply with core data protection
principles on consent and legitimacy, fair and lawful processing, purpose and relevance of data, management of the
data lifecycle, transparency of processing, as well as confidentiality and security of personal data. It contended that
the Data Protection Bill 2018 that was then going through the legislative process was “confusing, mixes concepts,
lacks clear objectives and key definitions and otherwise leaves many loopholes.”
26. The 1st Petitioner therefore asked the court to grant the following orders:
a) A declaration that section 3, 5 & 9 of the Registration of Persons act as amended by the Statute Law
Miscellaneous (Amendment) Act 2018 are unconstitutional for infringing the right to privacy, dignity, socio-
economic rights, the right to public participation and the right to equality and non-discrimination.
b) A declaration that Sections 3, 5 & 9 of the Registration of Persons Act as amended by the Statute Law
Miscellaneous (Amendment) Act 2018 are unconstitutional because the manner in which they were amended
and the procedure thereto was constitutionally infirm.
c) A declaration that implementation of Sections 3, 5 & 9 of the Registration of Persons Act as amended by the
Statute Law Miscellaneous (Amendment) Act 2018 is unconstitutional because the State has failed to provide
statutory framework to protect the right to privacy and protection of data.
d) A declaration that the State must implement the decisions of the African Commission on Human and
Peoples’ Rights and the African Committee on the Rights and Welfare of the Child in the cases of, respectively,
Nubian Community v. Kenya and Children of Nubian Descent v. Kenya before commencing on NIIMS
registration process.
e) An order declaring that Section 3, 5 & 9 of the Registration of Persons Act as amended by the Statute Law
Miscellaneous (Amendment) Act 2018 are unconstitutional.
f) Costs of this suit be provided for.
The 1st Petitioner’s Evidence
27. In his witness statement, Anand Venkatanarayanan, who testified as PW2, described himself as an expert on
Cyber Security and Computer Fraud Forensic Analysis, with a special interest on Financial Modelling. He stated
that he graduated in 1998 with a Bachelor’s degree, with distinction, in Technology with a Computer Science
Major from the University of Madras. He stated further that he has 21 years’ experience in various aspects of
computer software, and had given affidavit evidence as a cyber-security expert in the Aadhaar case in the Supreme
Court of India in support of the petitioners therein.

28. Mr. Anand stated that upon review of the Petition by the 1st Petitioner, the 1st and 2nd Respondents’ replying
affidavits, and the relevant accompanying documentation, he had made several conclusions on NIIMS. The first
was that NIIMS is functionally and architecturally similar to the Indian Aadhaar system. His second conclusion,
based on the first, was that it would result in the same outcome, namely an endeavour which would pose a massive
risk to personal security and privacy of the Kenyan residents with no demonstrable benefits. Lastly, that it would
also create national security risks to Kenya, which would be impossible to mitigate.
29. Mr. Anand stated that a foundational assumption underlying the logic of the NIIMS system is that the use of
biometrics assures that there is no duplication in the registration of individuals. Further, that the assumption behind
biometric identifiers is that there exists a part of the human body that is unique to an individual, and we can use a
digital representation of that part to uniquely identify the individual from across the entire population. It was his
evidence, however, that biometrics are fallible and cannot be relied upon as unique identifiers for the purposes of
deduplication. His averments, as we understand them, are that firstly, to claim that a particular biometric parameter
is unique across all time is mathematically infeasible. This is for the reason that one would need to have data for
past and future populations to be able to reach this conclusion, which is not possible for future populations.
30. Mr. Anand stressed, secondly, that biometrics are affected by ageing and time, and that every single cell and
part of the human body ages and changes, and events in life such as disease or constant manual work can accelerate
it. It was his averment therefore that the assumption of uniqueness with respect to biometrics is true only within a
time range. He nevertheless noted that biometrics are stable after the age of 15 years, but “wildly variable before
that.”
31. It was his averment, thirdly, that the identification of a person by a human being is a different process from that
of identification by a machine or algorithm, and that human beings can identify others accurately because of the
‘evolutionary pressure to reproduce.’ It was his view therefore, that while a human being cannot fail to identify the
gender of another human being, an algorithm uses different means to identify people through computation and has
to use different conceptual constructs.
32. Mr. Anand explained in technical detail the concepts that are used in algorithms, including the use of points in
fingerprints matching, to illustrate that a perfect overlap of points and matching of fingerprints is impossible
because of extraneous factors such as sweat, tears, physical position and other mechanical factors. It was his
averment therefore that thresholds are specified to identify a person through such matching of points. Mr. Anand’s
contention was that there is an inherent conflict with the said thresholds for the reason that if a very high threshold
is set, such as 99% matching of the points, it will enable a person to enroll twice at different points of his life,
because ageing changes biometrics. On the other hand, that if the threshold is low, then some enrolments will be
identified as duplicates and genuine persons would not be registered.
33. Mr. Anand’s testimony was that this is a problem that arises from the nature of biometrics and cannot be
worked around or fixed. Our understanding of his argument, which was made in relation to the Aadhaar system in
India, is that a person who had not previously enrolled or registered in the system could be identified as having
been registered and rejected. Conversely, a person who was already enrolled could, after some lapse of time, be
identified as not having been enrolled, and allowed to register a second time because of ageing biometrics. His
assertions on this point were based on an article he had published on the internet on the Aadhaar project, the
relevant website address of which was given, which made reference to a paper published in the Economic and
Political Weekly by the Centre for Internet and Society (CIS). It was his contention, on the basis of this paper, that
enrolment rejection rates will accelerate as the size of the database increases.
34. Mr. Anand gave an example of the errors of duplication noted in the Aadhaar system which is operated by the
Unique Identification Authority of India (UIDAI). He observed that UIDAI used OT Morpho’s algorithms, the
same algorithms which, to his knowledge, are also being used in the NIIMS in Kenya. He placed reliance on an

online article by Dr. Hans Varghese Mathews titled “Flaws in the UIDAI Process” published in the Economic
and Political Weekly, 26 February 2016, Ll No. 9 which found that in India’s population of approximately 1.2
billion, approximately 10 million people (0.8%) would be excluded from the system as a result of false positive
matches.
35. According to Mr. Anand, independent research conducted over a period of time had established that
deduplication is by no means a natural consequence of the introduction of an identification system that relies on
biometrics. His opinion was that the Kenya government had not taken this body of evidence into account, given its
over-reliance on the assumption that biometric uniqueness is beyond question. He further expressed the view that
because the reliability of any biometric-based identification system depends on mathematical calculations, it is
critical to have public disclosure of the technical data on the deduplication algorithm, and that this should be
published along with the sample data so that experts can analyse it. His testimony was that he was not aware that
the Kenyan State had publicly disclosed the algorithms used to identify “duplicate” biometric data.
36. It was Mr. Anand’s evidence that there could also be failure of biometrics at authentication stage. He defined
‘biometric authentication’ as a comparison between the biometric parameter (iris or fingerprint) versus what was
stored during enrolment and termed it as a biometric comparison across time. He took the position that for this to
succeed all the time, an important pre-condition must exist, namely the condition of immortality or, in other words,
that the individual’s chosen biometric parameter does not change across their entire life time. This, he stated, is not
the case for both iris and fingerprints, and even for DNA, as mutation or a radiation exposure alters DNA.
37. Mr. Anand testified that while laboratory results on biometric authentication show a high probability of success
of around 99%, the real-world data is very different. It was his testimony that women and poorer citizens, including
manual labourers, domestic workers, homeless people, and agricultural workers were the most likely segments of
the population to be excluded by biometric authentication. He supported his averment by citing the experience in
India, where studies demonstrated high rates of exclusion. He further cited section 5 of India’s Aadhaar Act which,
although not yet adequately implemented to date, at least recognizes that special measures would be needed to
address exclusion of large categories within the population. He concluded that to his knowledge, Kenya has no
such provision in connection with the implementing legislation authorizing the establishment of NIIMS.
38. On the security of data collected through NIIMS, Mr. Anand averred that it is self-evident in computer security
that nothing is truly secure, and the relevant considerations are the costs and benefits of collecting and keeping
data. His view was that centralised databases such as Aadhaar and NIIMS hold so much data that the cost- benefit
ratio tilts in favour of hackers or those who want to compromise the personal data. It was his testimony that the
number of times the Aadhaar database has leaked is beyond counting. Further, that data leaks caused by
centralization is not a perception, but an outcome that can neither be avoided nor mitigated. According to Mr.
Anand, this realization forms the basis of the design of modern-day computer systems where decentralization
becomes the central design principle. He termed NIIMS as an archaic design compared to modern-day system
architectures and equated it to “a horse-bungee drawn by a lame horse on the digital highway” whose digital
journey was bound to end in failure.
39. With regard to how NIIMS would negatively affect Kenya’s security, Mr. Anand averred that given the
complexity of the NIIMS project, all parts must be audited through public disclosures or else terrorists or spies can
infiltrate the NIIMS system by exploiting its inherent weakness. It was his averment that this happened in Aadhaar,
where numerous cases of enemies of the state masquerading as citizens obtained Aadhaar numbers. He made
reference to various internet sources for this statement, and concluded that it is in the public interest that the state
discloses the algorithms and systems used to construct the NIIMS project for national security reasons.
40. Mr. Anand’s conclusion was that the NIIMS project is functionally, architecturally and technologically similar
to the Aadhaar system and suffers from the same flaws. In his view, while the Kenyan government may promise

that it will not repeat the same mistakes, it does not have the technological capability to honour the promise, as is
evident from its claim that NIIMS is different from Aadhaar. Further, that while the harmonization of the various
databases that contain personal data is a laudable goal, the Kenyan government has not done a detailed cost- benefit
analysis of such an approach and other alternatives. Mr. Anand referred to and cited studies done in India on the
Aadhaar project which indicated that the costs were high compared to the benefits it offered. His parting shot was
that the NIIMS project would thus be a waste of public money, which money could have effectively been used
elsewhere.
41. When cross-examined by Dr. Nyaundi for the 5th Respondent, Mr. Anand stated that he was self-taught on
computer security. Further, that he has taught cyber security classes to the police. He, however, conceded that he
had not attended any class to receive training on cyber security. His testimony was that he had written articles
which he posted on the internet but had not been published in any peer-reviewed academic journals. However, that
one of his articles was edited and discussed by people interested in the subject of cyber security.
42. Mr. Anand conceded that he had written the said articles prior to the implementation of NIIMS. He also
accepted that he had not worked on NIIMS, reviewed any documents on it, or interacted with the system. He,
however, stated that he studied the objectives of NIIMS, the architecture of the system, and the need for a single
identifying number based on biometrics. It was his evidence that he could not tell whether Kenya had used the OT
Morpho algorithms, but had reached the conclusion that it had because the OT Morpho algorithms are the ones
normally used for biometric deduplication. He also confirmed that he did not know the software Kenya used in
NIIMS.
43. Mr. Anand agreed that one of the problems with the Aadhaar system was that the data was inaccurate because
the data collectors were paid by the number of persons enrolled, hence leading to the temptation to exaggerate the
numbers. He nevertheless maintained that the Kenyan system was similar to the Aadhaar system. He conceded that
he was not part of the team that designed the Aadhaar system but asserted that he had investigated its design and
architecture from available public material.
44. Mr. Anand explained that a centralised system means that all the data is kept in a single database. His evidence
was that most countries divide the data into smaller functional databases and only retain the personal core data in a
central database. Further, that the functional databases are referred to as federated databases, and are not
decentralized databases, as they do not have any link to the central database. It was his position that NIIMS is both
centralised and federated, which is what informed his criticism of the system, as the federated databases still have
back references to the central database. His view was that the NIIMS system is a single central national data base
having all records of the individual.
45. According to Mr. Anand, biometric identification is in itself not bad technology, as it can improve security, and
a single identity system is a global trend. Further, that electronic data was under constant threat globally.
Additionally, electronic storage is gaining global currency as that was where the world was going, and he was not
advising any country to go back to the age of paper.
46. His evidence was that every electronic storage system must have protection, but that the protections provided
by governments are usually not sufficient. According to Mr. Anand, electronic data is usually protected by layers of
access. That some people have full access, some less access and others minimal access. He was not aware of the
Kenyan laws on protection of data, and without public information, he could not specifically say what the
weaknesses of NIIMS were. He nonetheless asserted that his complaint about NIIMS was not about digitisation but
its architecture, which has no limitations on the purposes of the system, and which allows breaches, frauds and
exclusion.
47. In response to questions from Mr. Njoroge Regeru for the 2nd and 3rd Respondents, Mr. Anand told the court

that the Open Society Foundation had sourced him as a witness in the petition. His brief was to make the court
understand the various aspects of the NIIMS project, and he reiterated that he understands the architecture of
NIIMS from its technical purposes which have been disclosed to the public.
48. It was his evidence that while he had filed an affidavit in the Supreme Court of India to oppose Aadhaar, the
Court had restricted the use of Aadhaar but did not outlaw it. He had not testified before the Supreme Court. He
disagreed with the proposition that he is not an expert of international standing on cyber security, insisting that he
gives industry- wide technical talks on the subject, and is a key panelist in an international cyber security
conference held annually in India. He stressed that based on the pleadings filed in this Petition, he had formed the
opinion that NIIMS and Aadhaar are functionally and architecturally similar. He conceded that he had not read any
technical document on NIIMS.
49. He disputed various statements made in the pleadings filed by the Respondent’s experts, and his evidence was
that deduplication is not based on biometrics alone, and that minimal personal information is required for
identification. His opinion was that NIIMS did not observe data minimization and purpose limitation standards. He
admitted that most countries develop their data capture programmes and encryption algorithms locally, and stated
that he had not seen any such software that was locally developed for NIIMS, nor talked to any of the local experts
who designed the system.
50. Mr. Anand stated that although he did not doubt the technological competence of Kenyans, there should be
information made available on the NIIMS to build confidence in the system. He stated that identity projects create
mistrust for lack of information. Mr. Anand also testified that he was familiar with the distinction between open
source and closed source software but disputed that data in closed source software will guarantee the safety of
personal data. His opinion was that open source software invites continues scrutiny and improvement, and gave an
example of the public disclosure of the Aadhaar system in India. In his opinion, the technology design for NIIMS
should be publicly disclosed.
51. Mr. Anand disputed the demonstrable benefits of NIIMS, stating that they are not based on any data. He was
emphatic that given its current architecture, NIIMS will not achieve its stated objectives, and that its costs outweigh
its benefits. He admitted that he had discussed the disadvantages of NIIMS but not its benefits, stating that people
tend to overestimate the advantages and fail to talk about the disadvantages. Further, that the statement that NIIMS
is a single source of truth is a conflation between identification and identity, and the database is used for
identification not identity purposes. He was also doubtful whether such a biometric system can isolate terror risks
or enhance security, asserting, by way of illustration of his position, that there were 45 – 50 reported cases of
attempted infiltration of the Aadhaar system in India.
52. Mr. Anand denied that his conclusions on the weaknesses of biometric systems are limited to those that use
fingerprints alone, noting that the Aadhaar system used other biometric and demographic markers. In his view,
irrespective of whether a system is a single modal or multimodal, it is still exposed to the risk of deduplication. He
explained that a multi-modal system uses various demographic and biometric parameters as opposed to only one
parameter that is used in a single-modal system. He testified that it was reasonable to state that NIIMS is a multi-
modal system, but did not accept that it had factored in deduplication. He reiterated that he was skeptical about the
use of fingerprints and that data from India had shown the ageing of fingerprints of persons who undertake manual
work.
53. While agreeing that biometric identifiers cannot be discounted, Mr. Anand pointed out that there is a threshold
required to be met to ensure probability of success, which has not been publicly disclosed about NIIMS. He also
noted that the fundamental problem of using biometrics is the impact of failure, and although no system is perfect,
there is need for the right architectural design of the system and mitigation measures.

54. When cross-examined about his statement on the likely exclusion of women and the poor by the system, Mr.
Anand stated the statement was made in reference to South Asian countries. He nevertheless insisted that unless he
sees data-based evidence, he would still hold the same opinion about NIIMS.
55. Mr. Anand agreed that terrorism is a threat worldwide. His evidence was that terrorists will try to hack and gain
access to systems. However, the threats would be minimised where correct expertise is applied. He denied
suggestions put to him by Mr. Regeru that he was not an expert; that he was a partial witness; that he did not have
any experience or knowledge of NIIMS; that his conclusions were based on conjecture and speculation; and that he
was dismissive of local content and expertise.
56. In cross-examination by Mr. Bitta, the Counsel for the 1st Petitioner, Mr. Anand conceded that digitisation
brings better service delivery and that countries cannot go back to the paper age. In his view, however, the law
cannot fix what technology has broken, so that if there are mistakes in the system design, the law may not assist. He
also stated that a functional data protection law will only exist where the system has the right architecture. He
denied that he was a hacker, stating that he is a security researcher, and that he was contacted to give evidence for
the 1st Petitioner based on the work he did on Aadhaar.
57. On re-examination by Mr. Waikwa, Counsel for the 1st Petitioner, Mr. Anand stated that the company he works
for organizes technology conferences for technology practitioners. Further, that the papers presented in those
conferences are in the computer science field. It was his view that the law should come before architectural design,
noting that it is important to align projects to human rights. He contended that public confidence would be boosted
where information on a project is in the public domain.
58. With regard to his contention in cross-examination that he knew what NIIMS was, he stated that he reached his
opinion by considering its goals as set out in the pleadings of the Respondents, which showed that the system is
centralised. According to Mr. Anand, a perusal of the data capture form disclosed that there were many other data
bases by the number of identity documents required by the form. Further, as the system was going to link all the
databases to the central database, it was a centralised and federated database linked to other functional databases.
59. Asked to define certain technical terms that he had used in his evidence, Mr. Anand stated that ‘enrolment’ is
the process of giving personal information and biometrics for use in an identification system. Further, that
‘deduplication’ is an outcome in which no two entries should belong to the same person in a database, and every
person should have only one entry in the database. He stated that ‘deduplication’ is a process of algorithms and
thresholds that give a person an identity and links it with the system by giving the person a unique number for
authentication.
60. Mr. Anand explained that multi-modal systems are used to achieve deduplication. He further explained that
multi-modal systems combine data, whether biometric or otherwise, of a person, and compare it with previous data
and assign a unique number to the person. He stated that one could not get an identification number from NIIMS if
the database indicated that there was another like person in the system.
61. With regard to the meaning of the term ‘deterministic,’ he stated that it meant that something was going to
happen no matter what. On the other hand, that the term ‘probabilistic’ meant that it was not known for certain if
something will happen. In Mr. Anand’s view, it was mathematically impossible to say that the NIIMS system will
be deterministic as one can only set thresholds for each biometric parameter in order to determine identity.
62. Mr. Anand also described how databases are linked. He stated that the linking would require similar fields of
entry across all the databases which are then connected. He noted that databases cannot be linked if they are not
harmonised, a term which he defined to mean that structures are similar across all databases. On ‘identity’ and
‘identification’, he stated that ‘identity’ means giving legal recognition to a body that exists, whereas

‘identification’ is a process defined by a third party which confirms the identity of a person. In his view, NIIMS
was an identification project as confirmed by statements made by the Respondents.
63. Mr. Anand stated that there was a possibility that people who had not enrolled would be rejected by the system
as duplicates. He enumerated five concerns that he had in regard to NIIMS. The first was its purpose-free
architecture, meaning that the data could be used for any purpose and has no limitation. On the other hand purpose-
limited architecture requires the data to be used only for specified purposes.
64. His second concern related to the enrolment system design. He stated that the data capture form asked for
detailed information which is not required for giving a person a unique identity number that in other words, there is
no data minimisation. Thirdly, he was concerned that the system was exclusionary by its architecture and design in
that citizens may be prevented from getting their rights by, for instance, the requirement that they must have an
existing identity card or good quality biometrics in order to be registered in NIIMS.
65. The fourth concern related to fear of mass surveillance. He expressed the view that government is able to
conduct surveillance of its citizens from the data it collects because it has the decryption key. Further, that such
surveillance is also a possibility with respect to functional and subsidiary databases which are not encrypted. In
addition, that commercial surveillance can also arise from profiling of persons using the data collected.
66. Mr. Anand’s fifth concern related to breaches of the system and fraud. He stated that even though the
Respondents alleged that the data would be protected through encryption, data must be decrypted before use,
leading to security risks. He stated that hacking occurs when data is used and the encrypted data in this respect will
need to be used for authentication purposes thus raising the opportunity for hacking. Mr. Anand explained that
fraud is committed for a specific purpose, mostly financial gain, and centralising data raises the benefits of hacking
to the fraudsters.
67. Finally, he expressed the opinion that the NIIMS system is archaic and there was failure to consider modern
designs and alternatives. He gave examples of alternatives as including removing the linkages to functional
databases such as in Austria and Estonia, or the use of PIN-based cards to authenticate identity instead of
biometrics.
68. Questioned about the use and implication of open versus closed source technology, Mr. Anand stated that an
open source technology project is constantly being peer-reviewed by a larger community of digital experts, which
makes it more robust. With respect to whether such a system will deter terrorism, he stated that because of the large
number of people trying to fix any loophole in the system, there is disclosure about loopholes which is a way of
preventing the loopholes being used. He stated that in relation to NIIMS, there is no documentation or knowledge
on the design, and one could not therefore know what loopholes there were in NIIMS. He stressed that in India, the
information on the design of Aadhaar was in the public domain and he had even identified the loopholes and
informed the government about it.
69. Mr. Anand stated that a cost-benefit analysis ought to have been carried out prior to implementation. He
reiterated that NIIMS, being a digital infrastructure project, required a detailed cost-benefit analysis, and there was
no evidence of such a process in NIIMS, which he concluded was not a well-thought out project.
70. Answering questions put to him in re-examination by Mr. Awele for the 2nd Petitioner, Mr. Anand stated that
NIIMS is not deterministic, and that for a system to be deterministic, one needed to collect a lot of personal data
using a multi-modal identity system. He stressed that the State will have to have a lot of data points for the system
to be deterministic. He acknowledged that the Respondents had indicated in their replies their preference for closed
source software. He had not, however, seen the design and architecture of the NIIMS system, but his view was that
the government should have disclosed information about its technical architecture and algorithms to illustrate the

soundness of the design and open it to scrutiny.
71. In response to questions put to him by the Court, Mr. Anand stated that centralised databases usually hold a lot
of information and the risk of such a system is twofold. First, the impact of a breach will be massive, and secondly,
the risk of a breach is higher when there is a linkage between the central and functional databases. He explained
that where there is no linkage between the functional and the central databases, the impact of a breach is reduced.
He emphasised that this is why data minimisation is important and stated that only the data required for
identification should be kept in the central database. He conceded, however, that the risks can be mitigated through
the law, design architecture and technology.
72. Mr. Anand also expressed the view that the system architecture should not allow mass surveillance but may
allow targeted surveillance, which should occur under judicial supervision or oversight processes. He accepted that
there is no system that is immune to fraud but the impact can be minimised.
73. Mr. Ahmed Khalil Kafe testified as PW3. The evidence gleaned from his affidavit sworn on 12th April, 2019, is
that he is a Kenyan citizen of Nubian descent born on 18th March 1946. He served as a police officer under the
Kenya Police Force from 1965 to 1972, and that in 1968 he specifically served in the Presidential Escort. After
retiring from the Police Service in 1972, he engaged in small-scale business in order to earn a livelihood. At around
that time, he lost his identification documents namely an identification card, a driving licence and police card
through a theft that occurred in his home. As required, he obtained a police abstract, but because of the size and the
quality of the abstract issued at that time, it became worn out and eventually all the writings disappeared.
74. Mr. Kafe’s testimony was that he made an application for the replacement of his national identification card on
19th November 2018. When he reached the fingerprint verification stage during the replacement process, he was
informed that his fingerprints were not available in the records at the National Registration Bureau. He was then
asked by the officials at the Office of the Registrar of Persons to swear an affidavit for the lost documents to
facilitate the replacement of the national identification card. However, despite swearing two affidavits and
following up on the matter, he had not obtained a national identity card. He deposed that it has been four years
since he lost his documents and all his efforts to have replacements were constantly rendered futile. He stated that
due to illness he had stopped following up on the documents and was thus unable to procure simple services like
registration of a phone number, opening an M-pesa account, registration of a small business, or even to travel.
75. It was Mr. Kafe’s closing statement that on 10th April, 2019 at the Makina Mosque in Kibera, he applied for the
Huduma Namba but his efforts were rendered unfruitful by the officials who sent him away without attending to
him.
76. When cross-examined by Mr. Nyamodi, Mr. Kafe told the court that his complaint was in regard to the
difficulty of obtaining a national identity card. He confirmed that his national identity card got lost long ago, after
he left the police force in 1972, and that he applied for the replacement of his identity card on 19th November,
2018.
77. On re-examination by Mr. Bashir, Mr. Kafe stated that he applied for his first identity card in 1961 or 1962,
before independence. He confirmed that he had a waiting card with his photograph which was issued to him on 5th
September 2019. His testimony was that his problem in this case is that without an identity card, he cannot get a
Huduma Namba.
78. Mr. Shafi Ali Hussein, who identified himself as the Chairman of the Nubian Rights Forum, testified for the 1st
Petitioner as PW4. His evidence as it emerged from his affidavits was that the NIIMS database would be linked
with other official registries to form a single, government-mandated identity system. Further, that this system will
be linked to the delivery of an undefined sphere of government services, including access to identification

documents, universal healthcare, fertilizer subsidies, cash transfers, affordable housing and education.
79. Referring to a report titled Statelessness and Citizenship in the East African Community by the United
Nation High Commission for Refugees dated September 2018, he stated that the Kenya Government continues to
subject its citizens of Asian, Somali, and Muslim heritage to vetting procedures prior to issuing identity documents.
While the vetting is intended to counteract fraudulent acquisition of documents, it was his averment that the same
controls are not applied to other ethnic groups. He averred that this had resulted in many people in the targeted
groups remaining without national identity cards.
80. Mr. Shafi averred that the current registration system for identity cards, which is a simpler system, has
complications for residents in marginalized areas who cannot access services, either due to discrimination or lack
of resources. Further, that the Registration of Persons Act allows for the establishment of “identification
committees” by the Registrar for the purpose of “authentication of information”, whose composition and nature is
increasingly security-based, reflecting a widely observed trend towards systematic state surveillance of the
population.
81. It was therefore Mr. Shafi’s averment that since these historical issues have not been addressed, rolling out a
more complicated process of registration will only serve to increase the difficulties. His view was that there is a
danger of people from such communities being left out of the registration, which will render them unable to access
any public facilities, leading to discrimination in violation of the Constitution.
82. While referring to the kipande system which he termed as a “diabolical system of fingerprints”, Mr. Shafi
deposed that the history of identity systems is that they are not universal but are used to monitor, exclude and even
to assimilate or “erase” specific groups. He expressed the view that the capture of biometric information has also
tended to intrude deeper into people’s lives during moments of crisis, actual or perceived, and to target specific
groups on the basis of ethnicity. He cited as an example the fact that during the Mau emergency period, the
authorities began collecting full fingerprints as opposed to just a single digit or thumbprint, imposing this new
system on all “members of the Kikuyu and allied tribes.” He cited in support an article by Keith Breckenridge titled
The Failure of the “Single Source of Truth about Kenyans” : The National Digital Registry System,
Collateral Mysteries and the Safaricom monopoly dated 23rd August 2017.
83. Mr. Shafi averred that Kenya’s civil registration system has been harshly criticized by international institutions
like the African Commission on Human and Peoples’ Rights and the United Nations Committee on Elimination of
Racial Discrimination (CERD), as well as national bodies, such as the Truth, Justice and Reconciliation
Commission (TJRC), the Ethics and Anti-Corruption Commission and the Commission on the Administration of
Justice. Further, that the discriminatory impact of identity registration practices in Kenya upon national minorities
has also faced criticism. He cited the TJRC report as demonstrating that Muslims in particular “suffered
discrimination for decades in relation to their right to citizenship and associated identity documents.”
84. Turning specifically to the Kenyan Nubian community, Mr. Shafi averred that the community had filed
complaints with the African Union institutions in the cases of Nubian Community in Kenya vs Kenya and
Children of Nubian Descent in Kenya vs Kenya in which decisions were rendered that found Kenya’s
registration and identity documentation practices discriminatory and infringed the rights of members of the
community. Further, that specific recommendations were made to the Kenyan government to cure the violations.
85. Relying on a study carried out by the Open Society Foundation in 2015 titled Legal Identity in the 2030
Agenda for Sustainable Development: Lessons from Kibera Mr. Shafi averred that empirical research has
confirmed that inability to access documentation of citizenship in Kenya results in serious restrictions on one’s
ability to enjoy rights and freedoms guaranteed in the Constitution and international and regional human rights
instruments. According to Mr. Shafi, the study revealed that “in Kenya a national identity card issued at age 18,

rather than a birth certificate, is the necessary document to access many services and exercise rights.”
86. Mr. Shafi stated there are several questions regarding the impugned statutory amendments, as there are no clear
provisions indicating how the process of data collection shall be done, and no specific reason given for the
collection and use of the private data. Further, that there is no provision on how one can amend the data once it is
collected, which can lead to people being locked out from accessing government services because of wrong data. In
addition, that the data to be collected is personal and private, and mishandling of the same shall amount to grave
breach of the right to privacy, among other rights.
87. Mr. Shafi stated that IDEMIA (previously or concurrently operating as Morpho/OT-Morpho/Safran Identity
and Security) is the company awarded the contract to build the NIIMS system. It was his evidence that this was the
same company contracted to develop the voter registration system in the 2017 General Election known as Kenya
Integrated Election Management System (KIEMS). He contended that the data contained in KIEMS was
compromised, the implication being that IDEMIA could not be relied upon to develop NIIMS. Furthermore, that
there is no public record on when the tender for NIIMS was floated, which companies applied, the selection process
and the decision. Further, that he had not seen any public record on any due diligence carried out to ensure the
privacy of the information collected by IDEMIA.
88. While reiterating his claim that IDEMIA is unreliable, Mr. Shafi averred that the same entity was contracted by
the Ghanaian government to collect data, print identity cards, and manage the system, but that when its contract
was terminated it refused to release the registration data to the government until payment was made. This, in his
view, put at risk the right to privacy.
89. Mr. Shafi further averred that the right to privacy was threatened with violation by the fact that there are no
proper data protection laws in place to guarantee privacy. In addition, that no mention is made with respect to who
exactly can access the data and for what purpose, leaving an opening for unauthorized persons to access the
sensitive data. Further, that the World Bank in its 2016 report titled ID4D Country Diagnostic: Kenya advised
that the national legal framework for registration and identification should be strengthened “around data protection
and privacy”, and had made detailed comments on the weaknesses of the Data Protection Bill.
90. Referring to the African Union Commission’s Personal Data Protection Guidelines for Africa, Mr. Shafi
averred that the principles for data protection include consent and legitimacy, fair and lawful processing, purpose
and relevance of data, management of the data lifecycle, transparency of processing and confidentiality and
security of personal data. It was his deposition that the impugned legislation does not comply with the said core
data protection principles.
91. Mr. Shafi faulted the Respondents for rolling out NIIMS without benchmarking with developed and well-
known systems such as Aadhaar in India. Citing the State of Aadhaar Report 2017-18 dated May 2018, he
averred that the Aadhaar system was introduced in India to provide identification to citizens and residents, and its
processes were relatively similar to the NIIMS system. His evidence was that the Aadhaar system has reported
more errors than benefits. Further, that the report established that nearly two million people in three Indian states
were excluded from accessing food subsidies as a result of Aadhaar-related factors. He further contended that India
has also struggled with ensuring data security. He cited in this regard a report by the Center for Internet and Society
(CIS) which had revealed that the Indian government inadvertently published the biographic and demographic data
linked with Aadhaar numbers on 135 million Indians on the open internet. In his view, there is a possibility of
Kenya facing the same problem in different ways.
92. Mr. Shafi also expressed the fear that just like in India, the data in NIIMS may be used for personal benefit. He
averred that Aadhaar is the subject of dozens of lawsuits in Indian courts, and the Supreme Court of India has
restricted the linkage of private sector services to Aadhaar enrolment; limited the mandatory use of Aadhaar for

delivery of government services; permitted children to opt out of the system entirely until they turn 18; mandated
an effective redress mechanism when data is misused; minimised the kind of data the government is permitted to
collect; and reduced the storage period for authentication logs from 5 years to 6 months.
93. In Mr. Shafi’s view, the introduction of NIIMS in a legal and regulatory context in which ethnic and religious
discrimination prevents minorities like the Nubians from accessing identity documents exacerbates their
discrimination without any reasonable justification. He asserted that the effect of rolling out the system will defeat
the stated purpose of NIIMS, which is to provide universal access to government benefits, services and the digital
economy.
94. Mr. Shafi explained the context in which he wrote a letter dated 8th April, 2017 in his further affidavit sworn on
12th April, 2019. He stated that the letter was a response to a mobile identity card registration campaign carried out
by the 2nd and 3rd Respondents. His explanation was that the letter illustrated that the Nubian community has faced
discrimination, hence the need for special registration initiatives. Further, that the appreciation by the 1st Petitioner
in the said letter of the work of the National Registration Bureau did not mean that the discrimination against the
Nubian community has ceased, but merely signified the 1st Petitioner’s goodwill and cooperation.
95. Mr. Shafi deposed that the plight of the Nubian community with respect to registration of persons was not
unknown to the 2nd Respondent and its respective agencies. This was because it was an issue in the case of The
Nubian Community in Kenya vs The Republic of Kenya at the African Court on Human and Peoples’ Rights.
His testimony was that the requirement for a national identity card number in the NIIMS enrolment form was
meant to target the members of the Nubian community who do not have such details because of the numerous
vetting processes conducted by the 2nd Respondent.
96. Mr. Shafi stated that the NIIMS enrolment form clearly indicated that a Huduma Namba was a mandatory
requirement for receipt of all services, and this would expand the scope of discrimination already suffered by the
Nubians. He deposed that he had personally witnessed a significant number of members of the Nubian community
being turned away for lack of various requirements like the identification card during the NIIMS pilot project phase
launched on 15th February 2019. It was his averment that the registration for NIIMS was mandatory, and hence
violated the spirit of Article 31 of the Constitution.
97. Referring to the disclaimer in the NIIMS enrolment form which stated that the data may be shared with third
parties, Mr. Shafi reiterated that there is no comprehensive data protection framework in Kenya. His opinion was
that the enactment of the data protection laws should have preceded the NIIMS registration process.
98. When cross-examined by Mr. Nyamodi for the 4th and 7th Respondents, Mr. Shafi stated that at the time he
swore his supporting affidavit on 14th February 2019, the NIIMS enrolment exercise had not commenced, but could
not remember whether the enrolment had started by the time he swore his further affidavit on 12th April, 2019. He
did not respond to the question whether he had, in his affidavit, indicated the provisions of the Constitution that had
been violated.
99. Mr. Shafi stated that the issue of vetting procedures prior to the issuance of identity documents preceded
NIIMS. His testimony was that his problem with the vetting committees was that they were becoming more
security-based. He conceded that the vetting procedure is provided for by section 8(1A) of the Registration of
Persons Act, and that an elder of the Nubian community is a member of the vetting committee. His view, however,
was that the issues of discrimination in the vetting process have not been addressed, though he disclosed that he had
not personally been vetted for purposes of obtaining a passport, nor had he ever been a member of a vetting
committee.
100. Mr. Shafi further conceded that although he had averred that there were no clear provisions indicating how the

data collection was to be done, he had not enrolled for the Huduma Namba, and had no experience on how the data
was collected.
101. When asked about his averments regarding the process of procurement for NIIMS, Mr. Shafi indicated that he
was not familiar with the procurement processes but was aware of the Procurement Act. He conceded further that
procurement was not raised as an issue in the 1st Petitioner’s petition but asserted that they searched for
information on the procurement for NIIMS on the government domain. He insisted that the information for the
Huduma Namba was collected by IDEMIA, and that this was the same company which was contracted by the
Independent Electoral and Boundaries Commission during the elections.
102. When shown an averment by Jerome Ochieng on behalf of the 5th Respondent that no private entity, including
IDEMIA, was used to develop the software for NIIMS, he stated that he did not remember if he had specifically
responded to that particular statement. When confronted with the averment by the said deponent that benchmarking
trips were made to countries with similar systems, he could not defend his allegation that the Respondents failed to
compare the system with other systems such as Aadhaar in India.
103. When shown a copy of the letter he wrote dated 8th April 2017 referenced “Appreciation Letter” and
addressed to the 4th Respondent, he asserted that the letter did not reflect the sentiments of the Nubian community
about the issuance of identity cards.
104. On re-examination, Mr. Shafi stated that he wrote the letter dated 8th April 2017 to appreciate a good deed, as
there is normally a problem between civil society and government. Further, that he had written the letter on behalf
of the 1st Petitioner which was partnering with the Registrar of Persons and mobilizing the residents in the issuance
of identity cards and birth certificates. He stated that his only problem with the vetting process was that it is only
specific communities that are vetted.
105. Mr. Shafi named the members of the vetting committee as the Registrar of Persons, Registrar of Births and
Deaths, a District Commissioner or District Officer, an intelligence officer, a senior police officer, an officer from
the Directorate of Criminal Investigation, and one Nubian elder. That other than the one Nubian member, the rest
of the members are government officials.
106. Mr. Shafi clarified that his grievance with NIIMS and Huduma Namba was that members of the Nubian
community would be left out of the exercise. He urged that the issues of discrimination should first be addressed,
so that Nubians can walk together with other Kenyans in the NIIMS project.
107. Ms. Fatuma Abdulrahman, who identified herself as a member of the Nubian community, testified as PW5. In
her affidavit sworn on 12th April 2019, she gave a background to the challenges facing the Nubian community. She
stated that there was no significant discrimination against the community prior to 1990, and they accessed identity
documents like other Kenyans. From the 1990’s, however, they started facing severe challenges in accessing
documentation and were subjected to differential treatment in terms of access to birth certificates, national identity
cards, and passports. They also started experiencing delays in the issuance of documentations and rejection of
documentation without any justifiable reasons. In her view, these challenges coincided with their aggressive quest
for the Kibra land in Nairobi, and the new generation of Nubians started being branded non-Kenyans. Her opinion
was that this was a strategy of disinheriting their children from the Kibra land.
108. Ms. Abdulrahman testified that the differential treatment further worsened after the 7th August 1998 bomb
attack and subsequent terrorist attacks in Kenya. She stated that at this juncture, some minority groups like the
Nubian community were profiled as a security threat, and had to undergo extra scrutiny or vetting to prove that they
are Kenyans. She asserted that the security vetting intensified after its legalisation in the Security Laws
Amendments Act 2014.

109. In her view, the security vetting results in many Nubians experiencing extreme delays in their applications for
documentation, or going without documentation. Further, that the delays result in missed educational, employment
and other opportunities. According to Ms. Abdulrahman, this profiling has been detrimental to the community, and
has also caused clashes and tension between its members and neighbouring communities, and she gave the example
of the ethnic clashed in Kibra in 2001.
110. Ms. Abdulrahman testified that due to the challenges the community faced, it had tried to seek legal redress in
the High Court of Kenya but was unsuccessful. It had then moved to the regional level to get a remedy, and she
cited the two decisions of the African Commission on Human and Peoples’ Rights and the African Committee of
Experts on the Rights and Welfare of the Child (ACERWC) referred to in the 1st Petitioner’s Petition. The two
cases had been resolved in favour of the community.
111. Ms. Abdulrahman’s deposition was that despite the decisions and the fact that international law is part of
Kenyan law, the government is yet to implement the recommendations in the two decisions. It was her evidence
that some discriminatory practices had in fact become more severe, and included increased requests for supporting
documents, as well as the introduction of a requirement of an applicant’s parent’s thumb print on an identity card
application form.
112. Ms. Abdulrahman also narrated in detail the steps taken by the 1st Petitioner to improve access to government
documentation by her community. It was her testimony that over 3,200 people had been assisted to apply for birth
certificates, identity cards, passports, and death certificates. She stated that Nubians in Kibra are only able to apply
for identity cards on Tuesdays or Thursdays, as these are the days that the vetting committees sit. Further, that a
Nubian applicant must first provide their documentation to Nubian elders for review and for signing of an affidavit
that confirms that the elders know the applicant as a member of the Nubian community. She went on to explain the
vetting process at length, and presented what she termed empirical findings and observations on the time taken and
delays in applications for documentation by members of the Nubian community.
113. In cross-examination by Mr. Nyamodi for the 4th and 7th Respondents, Ms. Abdulrahman clarified that she is
an official of the 1st Petitioner working on citizenship rights issues for the Nubians. It was her testimony that the 1st
Petitioner was in court because the Nubian community experiences difficulties in getting documents such as
identity cards, passports and birth certificates, which are used in the Huduma Namba registration.
114. In re-examination by Mr. Bashir, she expounded on the decisions they obtained from the regional bodies and
stressed the challenges that a Nubian child undergoes before getting an identity card. In her view, the difficulty in
obtaining documents would make it difficult to register for the Huduma Namba.
115. The 1st Petitioner also filed an affidavit sworn on 11th April 2019 by Dr. Thomas Fisher, a Research Officer
with Privacy International since February 2016. Dr. Fisher averred that he swore the affidavit on behalf of Privacy
International, a non-profit, non-governmental organisation based in London and established in 1990, which has
been working on issues relating to identification systems. His affidavit was intended to provide expert evidence in
support of the 1st Petitioner’s case.
116. It was his deposition, on the basis of various articles in international instruments, that the right to privacy is a
fundamental right enshrined in many constitutions around the world, as well as in international human rights law.
He noted that as early as 1988, the UN Human Rights Committee had recognised the need for data protection laws
to safeguard the fundamental right to privacy.
117. Dr. Fisher averred that his organisation had noted concerns with identity systems around the world. In his
view, some of the concerns can be partially mitigated by legal, procedural and technological safeguards, as
explained by the World Bank ID4D initiative in its publication titled Principles on Identification for Sustainable

Development: Toward the Digital Age (2017). Further, that these mitigations should be implemented at the design
stage, rather than later, in order to ensure that privacy is embedded at the outset into the systems. He was of the
view, however, that mitigations cannot solve all problems with identity systems, and challenges still remain.
118. Dr. Fisher’s affidavit focused on identity systems that use biometrics and unique identifiers. He defined the
term biometrics as the measurement of unique and distinctive physical, biological and behavioural characteristics
used to confirm the identity of individuals. He gave examples of the modalities that can be used to include
fingerprints, iris, facial photographs, and vein patterns and explained the processes involved in extracting, storing
and using biometrics.
119. Dr. Fisher addressed various challenges that arise with biometric databases. He referred to the report by the
United Nations High Commissioner for Human Rights (UNHCR) on The Right to Privacy in The Digital Age
dated 3rd August 2018 and the report by the European Union Agency for Fundamental Rights titled Fundamental
Rights Implications of Storing Biometric Data in Identity Documents and Residence
120. Cards, (2018) which highlight significant human rights concerns with the creation of mass and centralized
databases of biometric data. According to these reports, due to the scale and sensitive nature of the data which is
stored, the consequences of any data breach could seriously harm a potentially large number of individuals.
Further, that if such information fell into the wrong hands, the database could become a dangerous tool against
fundamental rights.
121. Dr. Fisher further deposed that some individuals may have biometric features that make it challenging or
impossible to enrol or authenticate them, citing the case of manual labourers who may have worn fingerprints. It
was also his deposition that in some occasions, it may be inappropriate and an invasion of an individual’s privacy
to collect facial photographs, for example for those who wear headgear for religious reasons, or are part of
communities who object to having their photographs taken. His averment therefore was that enrolling in a
biometric system can be physically impossible or privacy invasive.
122. Another challenge identified by Dr. Fisher is that biometrics can potentially be used to identify an individual
for their entire lifetime. This means that caution has to be shown in the face of changing regimes or political
contexts, and also the changes in technology. The technology surrounding biometrics is continually evolving,
which places new pressures and risks on biometric systems. For example, it is possible to clone a fingerprint from a
photograph, using commercially-available software. Another concern identified by Dr. Fisher is that unlike a
password, an individual’s biometrics cannot be changed.
123. A further challenge identified by Dr. Fisher is that biometrics are essentially probabilistic and there are other
means of authenticating the individual that are deterministic. He gave the example of the use of Personal
Identification Numbers (PIN), which either matches or does not match with the stored PIN. He deposed that
biometrics are different and do not make a definitive decision on whether an individual is who he or she claims to
be, but rather a probabilistic one. This meant, according to Dr. Fisher, that some individuals are going to be
excluded from what they are entitled to, or falsely accepted as somebody they are not.
124. Dr. Fisher also addressed the challenges arising from the use of unique identifiers. He defined a unique
identifier as a unique number or code, for example an identity number. He stated that a unique identifier is a feature
of an identity system that is particularly problematic, arising from the ‘seeding’ of identity numbers across multiple
government or private sector databases. This, he stated, creates the risk of providing a “360 degree view” of an
individual. His evidence was that the linking and seeding of databases with a single number gives the opportunity
for all information about an individual, across multiple databases, to be accessed. Citing a statement in the United
Kingdom case of Marcel vs Commissioner of Police of the Metropolis [1992] Ch 225 (Browne- Wilkinson VC),
he contended that the gathering of information about an individual from several government agencies in one

database places his or her freedom at risk.
125. Dr. Fisher observed that dangers also exist in the use of unique identifiers by the private sector, as it can lead
to the exploitation of individuals and their data. He referred to a report by the London School of Economics
titled The Identity Project: An Assessment of the UK Identity Cards Bill and its Implications (2005), for the
proposition that service providers can profile individuals who interact with them using electronic identifiers. He
also cited the ruling of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) and Another v. Union of
India and Others Writ Petition (Civil) No. 494 of 2012 where a section of the Aadhaar Act that allowed private
companies to use Aadhaar authentication was declared unconstitutional. The Court had held that allowing private
entities to use Aadhaar numbers will lead to commercial exploitation of individuals’ personal data without their
consent, and could lead to individual profiling.
126. Dr. Fisher averred that there are also new opportunities for fraud presented by the use of unique identifiers,
particularly an identity number with a broad purpose which present more opportunities for a malicious actor to act
fraudulently. He averred that an identity number with limited purposes limits the harms that can be caused to the
individual.
127. Dr. Fisher identified some of the concerns that arise in relation to identity systems that use biometrics and
unique identifiers exclusion, including data breaches, mission creep, access to and retention of data, and data
protection. In his opinion, the above considerations are especially valid as regards the protection of special
categories of more sensitive data and more particularly of DNA information. He also noted the need to place
limitations on access by law enforcement and intelligence services to identification databases.
128. Dr. Fisher made averments with regard to the importance and necessity of data protection. He averred that as
of January 2019, over 120 countries had enacted comprehensive data protection legislation, and many other
countries were in the process of doing so. In addition, frameworks and instruments for data protection have been
introduced by international and regional institutions such as the African Union, the Organisation for Economic
Cooperation and Development, and the Council of Europe. In his view, data protection is necessary to safeguard
the fundamental right to privacy by regulating the processing of personal data, providing individuals with rights
over their data, and setting up systems of accountability and clear obligations for those who control or undertake
the processing of the data.
129. Dr. Fisher averred that although a strong comprehensive data protection law will not cure the concerns he had
identified, it is an essential safeguard in the introduction of any identity system. He identified the core principles for
safeguarding of data that should be contained in data protection laws.
130. Dr. Fisher made averments with respect to mitigation measures that could be taken in order to protect data. He
noted that in recognition of the particular concerns raised on the use of biometrics, consideration should be given to
whether the stated purpose could be achieved by a less intrusive approach. Further, that use of data requires legal,
procedural and technical safeguards. He cited the recommendation of the High Commissioner for Human Rights
that States should ensure that data-intensive systems are only deployed when, demonstrably, they are necessary and
proportionate to achieve a legitimate aim. He further cited the U.N. General Assembly Resolution on the Right to
Privacy in the Digital Age, U.N. Doc. A/RES/73/179 (17 December 2018) which recommended that in collecting,
processing, sharing and storing sensitive biometric information from individuals, States must respect their human
rights obligations, especially the right to privacy. This should be done by the adoption of data protection policies
and safeguards.
131. A second mitigation measure proposed by Dr. Fisher is avoiding storing the biometric templates in a
centralised database. He asserted that this may avoid the risks of a system being used for identification, rather than
just authentication. He recommended the use of a smartcard alternative to a centralised database, citing the UK’s

biometric passport as an example. He further averred that designing systems without a centralised database also
reduces the risk of a major breach of biometric data.
132. Dr. Fisher expressed the opinion that a unique, single, persistent identifier or ‘identity number’ for citizens is
not necessary for an identity system. He gave illustrations from the UK’s Verify.gov system which does not require
a single, unique identity number for individuals to authenticate their identities; Germany where the law prohibits
the use of a unique identification number of general application; and India where, since the launch of Aadhaar in
2009, the system has undergone design changes that include the introduction of virtual identity and tokenisation as
alternatives to the use of Aadhaar numbers to access services.
133. Dr. Fisher also cited the situation in Singapore in which a single identifier is used and can potentially unlock
large amounts of information relating to the individual. This poses the risks of identity fraud and theft, and as a
result, the data protection authority in Singapore prohibits the collection, use, or disclosure of the single identity
numbers by non-public sector organisations, except when required by law or when it is necessary to identify
individuals to a high level of fidelity.
134. Finally, Dr. Fisher observed that the Estonian system involves a platform known as X-Road that allows
institutions to exchange data. However, the system also allows citizens to monitor how their data has been used by
government departments since a log record is created whenever an individual’s data is accessed.
The 2nd Petitioner’s Case
135. The 2nd Petitioner, Kenya Human Rights Commission (KHRC), is a non-governmental human rights
organization registered in Kenya on 20th January 1994. Its mandate is to inter alia secure human rights in states and
societies through fostering human rights, democratic values, human dignity and social justice. The 2nd Petitioner
filed a petition dated 18th February 2019, supported by an affidavit and a further affidavit of George Kegoro, its
Executive Director, sworn on 18th February 2019 and 12th April 2019 respectively.
136. The 2nd Petitioner also relied on affidavits sworn on 12th April 2019 by its Deputy Executive Director, Davis
Malombe, and by Alice Munyua, a Policy Adviser of the Mozilla Corporation. It also filed a witness affidavit dated
12th April 2019 by Grace Mutung’u, an Advocate of the High Court of Kenya, who was called to testify as an
expert witness.
137. The 2nd Petitioner impugns the Act on four main grounds. The first is that there was a denial of the right to
public participation in the process of enactment of the impugned amendments. The 2nd Petitioner avers that neither
it nor the public were given a reasonable opportunity to comment on or contribute to the substantive provisions of
the amendments at any stage prior to their passage by the National Assembly. Further, that any engagements with
the public concerning the impugned amendments, if at all, were a wholly cosmetic public relation exercise designed
to create the false impression of constitutional compliance.
138. It was further averred that the impugned amendments significantly alter the process of acquiring vital identity
documents, which will impact every sphere of the day to day lives of Kenyans, and by extension, have far reaching
consequences on the enjoyment of fundamental rights and freedoms. It contended therefore, that it would have been
fair, just and in the public interest that the amendments be subjected to public participation, which did not happen
in this case.
139. The 2nd Petitioner was aggrieved, secondly, by the enactment of the impugned amendments through an
omnibus statute. It averred that it is a universally settled precept that substantive amendments with far-reaching
consequences such as the instant ones should be effected through a substantive Act and not through a
miscellaneous amendment in an omnibus Act. Consequently, that it was inappropriate and contrary to public

interest to enact the impugned amendments vide an omnibus Miscellaneous Amendment Act. It contended that this
concern was brought to the attention of the National Assembly on 28th August 2018 but was ignored. The 2nd
Petitioner therefore takes the view that the impugned amendments were enacted into law vide an omnibus Bill to
avoid scrutiny or for extraneous purposes.
140. The 2nd Petitioner’s third concern relates to the security of the data collected under NIIMS, and citizens’
rights to privacy. It averred that the impugned amendments impose extensive and unlimited mandatory
requirements for citizens’ personal information without concomitant safeguards to prevent abuse or intrusions into
people’s privacy by the State or unintended third parties. It was its case that integrating all personal information of
the population in one system, whose security and integrity has not been guaranteed by the law, will expose citizens
to unimaginable risks should the system be compromised or breached in any way.
141. According to the 2nd Petitioner, the impugned amendments grant the relevant Cabinet and Principal Secretaries
extensive powers to gather personal information and to make regulations with regard thereto without substantive
framework limitations on the use of the information gathered, or the principles and standards that should be applied
in the exercise of the said powers, contrary to Article 94(6) of the Constitution. Further, that these dangers are
compounded by the lack of a policy and legal framework for data privacy and protection in Kenya. The 2nd
Petitioner contended that the impugned amendments fall short of the United Nations Principles on Personal Data
Protection and Privacy, the African Union Convention on Cyber Security and Personal Data Protection, as well as
comparable laws from other jurisdictions on limitations to the right to privacy.
142. Lastly the 2nd Petitioner challenged the substantive provisions introduced by the impugned amendments in
sections 3 and 9A(2) of the Act and contended that they are intrusive, ambiguous and susceptible to abuse. It set out
the legal and operational shortcomings of the amendments under various limbs.
143. The first limb was that the said provisions require, in mandatory and unqualified terms, that all Kenyan
citizens, including children, submit their personal information including DNA information without their consent to
the State, thereby creating a national population register. Further, that this personal information is susceptible to
abuse to advance commercial interests and exposes citizens to negative profiling, which may have serious
implications for civil liberties.
144. The second limb relates to the amendments introducing a unique identification number linked to a central
access platform that will be assigned to every person. The 2nd Petitioner contended that this will exacerbate the risk
of compromise of the system, and by extension, the privacy and security of the people. In addition, that the
impugned amendments do not provide for the transitional mechanism from the current registration regime.
145. It was its contention that moreover, persons locked out from registration for any reason risk being left out
permanently without access to vital government services necessary for the fulfillment and enjoyment of
fundamental rights and freedoms. The 2nd Petitioner noted that it was not opposed to the proposal that citizens be
assigned unique national identification numbers, but was concerned with the security and integrity of the system.
146. The third limb particularized by the 2nd Petitioner is on the harmonization of personal information across
government databases, which will entail information sharing among different agencies. It was contended that this
exposes the NIIMS system to greater risks of intrusion and abuse since the amendments do not specify the
operational linkages of the system with the other databases. The 2nd Petitioner contended that in any event there
exists a parallel Integrated Population Registration System (IPRS) under the Kenya Citizens and Foreign National
Management Service Act No. 12 of 2012 that duplicates the functions of NIIMS.
147. It was its contention further that the harmonization process is prone to breaches such as destruction, deletion
or loss of vital records; identity theft and fraud; malicious use of the information, wrongful entries; and mismatch

of information and hacks through cybercrimes, as it is currently not clear which institution or person will be
accountable for the registration process.
148. Fourthly, the 2nd Petitioner impugned the provisions on verification and authentication of information relating
to identification of persons. It contended that NIIMS is only capable of verifying and authenticating documents
issued by it, and the impugned amendments do not therefore provide for mechanisms for inter-agency or inter-
governmental cooperation necessary to support the function of verification and authentication. Its view was that the
power of authentication of personal information is left to one system, without checks and counter-checks, thereby
negating the principle of accountability.
149. The fifth challenge to the impugned amendments related to the question of access to the data. The 2nd
Petitioner contended that the provisions on collation of information does not specify any limitations on the
circumstances and/or persons to whom personal information may be shared, making it possible to share citizens’
personal information with third parties, including foreign States.
150. In its sixth limb, the 2nd Petitioner contends that section 9A (2)(h) of the Act does not contemplate or prescribe
any consequences or penalty in law for unauthorized or accidental access, damage, loss or other risks presented by
the proposed system. It was its case further that it also fails to guarantee protection of personal information from
unscrupulous and corrupt officers, nor does it set immutable standards that the system must comply with in order to
protect personal data.
151. The 2nd Petitioner contends, lastly, that section 9A (2)(i) affords ‘any person’ the right to apply for
rectification of ‘any errors’ in the register instead of restricting it to the owner of the information only. It contends
that the State cannot, on its own initiative, determine what is or is not accurate, complete or up to date and not
misleading information. The 2nd Petitioner contended that the State should accordingly specify the applicable
standards and principles of amendment of information, for example by defining the scope and nature of personal
information required under the Act. Its view was that this would make it possible to anticipate with reasonable
certainty whether an amendment is necessary and what ‘complete’, ‘up to date’ and/or ‘not misleading’
information is.
152. The 2nd Petitioner therefore seeks the following orders:
a) A declaration that the amendments to the Registration of Persons Act, Cap 107 Laws of Kenya, vide the
Statute Law Miscellaneous (Amendment) Act No. 18 of 2018 are unconstitutional null and void.
b) A declaration that the amendments to the Registration of Persons Act, Cap 107 Laws of Kenya, by the Statute
Law Miscellaneous (Amendment) Act No. 18 of 2018 were enacted unprocedurally and without public
participation contrary to Articles 10(2)(a) and 118(1)(b) of the Constitution.
c) A declaration that the amendments to the Registration of Persons Act, Cap 107 Laws of Kenya, by the Statute
Law Miscellaneous (Amendment) Act No. 18 of 2018 are inconsistent with the Bill of Rights and are
unconstitutional null and void.
d) A declaration that the amendments made to the Registration of Persons Act, Cap 107 Laws of Kenya, by the
Statute Law Miscellaneous (Amendment) Act No. 18 of 2018 are otherwise unreasonable and unjustifiable in an
open and democratic society based on human dignity, equality and freedom, contrary to Article 24(1) of the
Constitution.
e) An order prohibiting the Respondents, by themselves, their employees, agents and or servants from installing
and operationalizing the National Integrated Information Management System in any manner howsoever until

policy, legal and institutional frameworks compliant with the Constitution are put in place.
f) Any other orders and/or reliefs as the court may deem fit.
g) Costs of the petition.
The 2nd Petitioner’s Evidence
153. In his supporting and further affidavits Mr. George Kegoro reiterated the contents in the Petition with respect
to the enactment and effect of the Statute Law (Miscellaneous Amendment) Act No. 18 of 2018. He averred that
unless the orders sought in the 2nd Petitioner’s Petition are granted, the substantive objects of the said amendments
shall seriously dilute fundamental rights and freedoms protected under the Bill of Rights, or subject them to serious
threats of violation by the State and or unintended third parties. He listed five reasons why the amendments to the
Act and the establishment of NIIMS violated or pose a threat of violation of fundamental rights and freedoms.
154. The first reason pertains to the threat of violation of the right to privacy and associated rights. Mr. Kegoro
averred that any interference with the Bill of Rights amounts to a collateral attack on the dignity and potential of
the people. It was his averment that in the digital age, personal information is vital data. Consequently, integrating
all personal information of the population of Kenya in one system whose security and integrity has not been
guaranteed by the force of law will expose citizens to unimaginable risks should the system be compromised or
breached in any way. The result of such breach would, in his view, be to disrupt or curtail, in material respects, the
enjoyment of almost all fundamental rights and freedoms under the Bill of Rights.
155. According to Mr. Kegoro, the impugned amendments of the Act impose excessive and unnecessarily extensive
mandatory requirements for citizens’ personal information without providing for concomitant safeguards to
prevent abuse or intrusions by the state or unintended third parties. The effect of the amendments would be to
breach Article 31(c) of the Constitution that guarantees every person the right to privacy, which includes the right
not to have information relating to their family or private affairs unnecessarily required or revealed.
156. Mr. Kegoro averred that in view of the stated functions set out in sections 3 and 9A (2)(c) and (d), the
impugned amendments are bound to impact every aspect of people’s lives including access to the right to
education and health as well as related services, the protection of property, freedom of movement, right to receive
public services, right to presumption of innocence, freedom from self-incrimination, right to privacy and security of
the person, human dignity. In his view, since the impugned amendments do not specify how sensitive personal
information will be collected, verified, stored, secured, accessed and utilized, there is real threat that the system is
susceptible to breach, which would occasion irreparable harm and damage to the people and the country at large.
He attributed this danger to the fact that Kenya does not have legislation or policy on data protection.
157. Mr. Kegoro further averred that in his view, the impugned amendments are almost certainly ultra vires the
standards of limitation of fundamental rights set out in Article 24(1) of the Constitution. He averred that as a matter
of fact, the amendments ostensibly repeal Article 31(c) of the Constitution.
158. The second reason advanced by Mr. Kegoro is that the amendments have elementary law defects, ambiguity
and susceptibility. He cited in this regard sections 3 and 9A (2) of the impugned Act which he termed particularly
intrusive, ambiguous and susceptible to abuse. He then proceeded to point out the shortcomings of each of the sub-
sections of section 9A (2) of the impugned Act.
159. With regard to section 9A (2)(a) which creates NIIMS, he averred that the provision requires, in mandatory
and unqualified terms, that all Kenyan citizens, including children, submit their personal information to the State.
He contended that the section does not define what constitutes ‘personal information’, or the applicable standards

and principles to be observed in gathering the said information including where, when and how the said
information may be gathered and by whom. He further contended that in essence, the provision permits the State to
require all manner of private information, including DNA, from citizens without their consent.
160. Mr. Kegoro averred, on the basis of advice from various experts and his own knowledge obtained from
various research papers on the subject, that DNA information can be used for a variety of purposes which makes it
susceptible to abuse and exposes citizens to negative profiling. It was his view that such negative profiling would
have serious implications for civil liberties and could allow the State or unintended third parties to compile files
containing highly personal data such as a person's racial origins, medical history or psychological profile. He
averred that such information can be abused by the State to suppress civil liberties or by business enterprises to
advance commercial interests without the subject persons’ consent.
161. It was his further averment that the impugned amendments also purport to confer functions ordinarily
performed by a legal person, usually a legal officer or corporation, on a system. In his view, this essentially renders
the system supreme and unquestionable and thereby yields control of sensitive personal information to the inventor
or author of the system.
162. With respect to section 9A (2)(b) which provides for the assignment of a unique national identification number
to every registered person, Mr. Kegoro averred that the 2nd Petitioner was not, in principle, opposed to the
assignment of such a number to citizens. He averred, however, that unless the concerns regarding the security and
integrity of the system were addressed, a unique identification number as a central access platform will exacerbate
the risk of compromise of the system and, by extension, the privacy and security of the people.
163. It was his averment further that persons locked out from registration for any reason risked being left out
permanently without access to vital government services necessary for the fulfilment and enjoyment of
fundamental rights. This, in his view, would be inconsistent with Articles 12(2) and 24 of the Constitution. He also
contended that the impugned Act does not provide for transitional mechanisms from the current registration regime.
There was no indication, for instance, as to when the unique identification number will be issued in the current roll
out phase. In his view, this lacuna exposes citizens to unfair inconveniences that may be occasioned by whimsical
administrative orders or directives for the implementation of the system.
164. The 2nd Petitioner also challenged the provisions of section 9A (2)(c) of the impugned Act. This provision
requires the harmonisation, incorporation and collation into the register of all information from other databases in
government agencies relating to registration of persons. Mr. Kegoro averred that such harmonisation entails
information sharing amongst different agencies, which exposes the system to greater risks of intrusion and abuse.
He averred that the amendments do not specify the interoperability modalities of the system. This was so, in his
view, particularly in light of the fact that there currently exists a parallel Integrated Population Registration System
(IPRS) under the Kenya Citizens and Foreign National Management Service Act No. 12 of 2012 which essentially
duplicates the functions of NIIMS. According to Mr. Kegoro, the harmonisation process is prone to breaches as it is
currently not clear which institution or person under the impugned Act and the Kenya Citizens and Foreign
National Management Service Act will be accountable for the registration process.
165. Mr. Kegoro averred that the breaches in the harmonisation process could include destruction, deletion or loss
of vital records, identity theft and fraud, malicious use of the information, wrongful entries, mismatch of
information and hacks through cybercrimes. In his view, there would be no prejudice occasioned to any party if all
these duplications and mismatches are harmonised in law before the system is operationalised.
166. The 2nd Petitioner further impugns the provisions of section 9A (2)(f) which relates to the verification and
authentication of information relating to the registration and identification of persons. Mr. Kegoro averred that
NIIMS is only capable of verifying and authenticating documents issued by itself. He contended that the

amendment does not therefore provide for mechanisms for inter-agency or inter-governmental cooperation
necessary to support the function of verification and authentication. It was his deposition that this failure negates
the principle of accountability as it vests the power of authentication of personal information on one system without
checks and counter-checks.
167. With regard to the provisions of section 9A (2)(g) which provides for the collation of information obtained
under the Act and its reproduction, as required, from time to time, Mr. Kegoro averred that the provision lacks in
specificity. He contended that the authority to ‘collate’ and ‘reproduce’ essentially presupposes discretion to
manipulate personal information to suit varying circumstances at the State’s convenience. He averred that the
provision does not specify any limitations on the circumstances or the persons to whom personal information may
be shared. In his view, this makes it possible to share, without notice, citizen’s personal information with third
parties, including foreign States and private business enterprises that would otherwise not be entitled to access such
information.
168. The 2nd Petitioner also impugns the provisions of section 9A(2)(h) of the Act. This section provides that
NIIMS shall ensure the preservation, protection and security of any information or data collected, obtained,
maintained or stored in the register. Its grievance with respect to this provision is that it does not contemplate or
prescribe any consequences or penalty in law for unauthorized or accidental access, damage, loss or other risks
presented by the proposed system. It was Mr. Kegoro’s averment that weighed against the nature and importance
of the right to privacy, the provision is inadequate to guarantee the protection of personal information from
unscrupulous and corrupt officers given the accountability loopholes identified in the system. The 2nd Petitioner’s
position is that this risk is further compounded by the lack of clear minimum or immutable standards that the
system must comply with in order to ensure the preservation and protection of personal information, instead
leaving such standards to the whims of the State.
169. The 2nd Petitioner also challenges the provisions of section 9A(2)(i) of the impugned Act which provides for
the correction of errors in the register by a person or by the system on its own initiative to ensure that the
information is accurate, complete, up to date and not misleading. The basis for the challenge of this provision is
that it has been poorly drafted. This is because it affords to ‘any person’ the right to apply for rectification of ‘any
errors’ in the register. Mr. Kegoro averred that this right should be restricted to the owner of the said information.
170. With regard to the provision for the State to rectify errors ‘of its own motion’, Mr. Kegoro averred that as a
secondary recipient of information, the State cannot, of its own initiative, determine what is or is not accurate,
complete, up to date and not misleading information. It was his averment that the right of the State to amend any
personal information should be exercised only with the consent and after consultation with the primary owner of
the said information.
171. Mr. Kegoro averred further that the provision should also specify the applicable standards and principles for
amendment of information. He gave as an illustration standards defining the scope and nature of personal
information required under the Act in order to make it possible to anticipate with reasonable certainty whether an
amendment is necessary.
172. The third reason advanced by the 2nd Petitioner for challenging the impugned Act relates to the process of its
enactment. Mr. Kegoro averred that the impugned Act was enacted in a manner that denied the public the right to
participate, a violation of Article 10(2)(a) of the Constitution. He stated that under Article 10(2) (a) and 118 (1) (b)
of the Constitution as read together with Standing Order No. 127(3) of the National Assembly – 4th Edition, the
National Assembly is enjoined in mandatory terms to facilitate public participation and involvement in the
legislative and other business of Parliament and its committees. It is also enjoined to take into account the views
and recommendations of the public made pursuant to such public participation.

173. It was his averment that to the best of his knowledge and the publicly available information, neither the public
nor the 2nd Petitioner was given a reasonable or meaningful opportunity to comment on or contribute to the
impugned amendments at any stage of the legislative process prior to their passage by the National Assembly. He
deposed that given the nature, scope and effect of the impugned amendments, there is a real threat that as drafted,
they will have far reaching, unintended and undesirable consequences on the enjoyment of all fundamental rights
and freedoms under the Bill of Rights.
174. He averred that in the circumstances, it was imperative that concerns of members of the public arising from
the amendments should be taken into account before the impugned amendments are operationalised. He noted in
particular that the impugned amendments significantly alter the process and substantive right of identification and
registration of persons from birth to death, including the right to acquire vital documents like birth registration
certificates, student registration for enrolment and issuance of examination certificates, national identity cards,
refugee cards, work permits, passports, driving licenses and death certificates. In his view, permitting the
amendments to stand without public participation or contribution shall render the provisions of the Constitution and
the Parliamentary Standing Orders that require public participation academic.
175. Mr. Kegoro deposed that from his position as the 2nd Petitioner’s Executive Director in which he interacts
with many members of the public from diverse backgrounds, he is aware that there exist grave concerns regarding
the impugned amendments which would have been substantially addressed through the relevant committees of the
National Assembly had the public been accorded the opportunity prescribed by law.
176. The 2nd Petitioner’s second concern relating to the process of enactment of the impugned Act relates to the
propriety of the procedure adopted. Mr. Kegoro averred that it is a universally settled precept that substantive
amendments with far reaching consequences such as the impugned amendments should be effected through a
substantive Act and not through a miscellaneous amendment in an omnibus Act. It was his averment that this
position has been expressed by the courts and even by members of the National Assembly during debates in the
house on similar Bills, including in the debates recorded in the Hansard of 20th November 2018 on the impugned
Act. He contended that given the substantive and controversial nature of the impugned amendments, it was
inappropriate and contrary to public interest that the amendments were enacted into law through an omnibus Statute
Law (Miscellaneous Amendments) Act.
177. Mr. Kegoro averred that the concern with respect to the manner of amendment was brought to the attention of
the National Assembly on 28th August 2018 through a point of order raised by Hon. Otiende Amollo but was
ignored. He sets out in his affidavit the portions of the Hansard in which the Hon. Member’s concerns were
captured.
178. He asserted that using an omnibus Bill for a substantive subject such as is covered by the impugned Act is
tragic given that there have been ongoing legislative efforts since 2012 aimed at achieving the same objectives as
the impugned amendments, but through substantive Acts of Parliament. He cited the National Registration
Identification Bill 2012 and the Registration and Identification of Persons Bill, 2014 (Senate Bill No. 39) which
concerned the same issue as the impugned amendments. It was his averment that all these efforts have been short-
circuited by an omnibus Miscellaneous Amendment Act. He observed that the two Bills contained safeguards
relative to the impugned amendments in the impugned Act. He specifically pointed to the Kenya Citizens and
Foreign National Management Service Act No. 12 of 2012 as containing similar functionalities as the impugned
amendments but with better in-built safeguards. In his opinion, the impugned amendments were passed through an
omnibus Bill in order to avoid strict scrutiny that they would otherwise undergo in stand-alone substantive Acts of
Parliament.
179. The final ground of challenge to the Act set out in the affidavit of Mr. Kegoro is that the Act is ambiguous and
lacks specificity, which he terms a violation of Article 94 of the Constitution as well as international law standards

and practice. According to Mr. Kegoro, Article 94 (6) of the Constitution decrees that every Act of Parliament that
confers on any State organ, State officer or person the authority to make provisions having the force of law in
Kenya shall expressly specify the purpose and objectives for which that authority is conferred, the limits of the
authority, the nature and scope of the law that may be made, and the principles and standards applicable to the law
made under the authority.
180. He averred that the impugned amendments in this case are mired in generalities and ambiguities; that they
essentially grant the relevant Cabinet and Principal Secretaries extensive powers to gather personal information and
to make regulations with regard thereto without substantive framework limitations as to what information gathered
may be used for or the principles and standards that should be applied in the exercise of the said powers.
181. Further, that the amendments introduce a weaker yet similar system as was established under the Kenya
Citizens and Foreign National’s Management Service Act No. 12 of 2012. He averred that as both laws are in
operation on the same issue, without transitional provisions or interoperability modalities, there is currently
confusion and ambiguity that may be exploited at the expense of the people. The net effect of this confusion is that
the personal information of citizens is exposed to serious risk of abuse without accountability.
182. Mr. Kegoro averred that the danger to personal data that he expounds upon above is compounded by the lack
of a policy and legal framework for privacy and data protection in Kenya, which implies that the State will have a
carte blanche as to what and how to utilize personal information for. According to Mr. Kegoro, the impugned
amendments are susceptible to abuse and fall far short of the UN Principles on Personal Data Protection and
Privacy, the African Union Convention on Cyber Security and Personal Data Protection as well as comparable laws
from other jurisdictions on limitations to the right to privacy.
183. He averred that if indeed the only purpose of the impugned amendments is to harmonise registration and
identification of persons for efficient service delivery by the State, the flaws in the legislation render them
unreasonable relative to their intended purpose.
184. It was Mr. Kegoro’s contention that given the nature and scope of the rights in question, operationalising the
impugned amendments will effectively amount to a repeal of substantive fundamental rights protected under the
Bill of Rights, thereby exposing citizens to whimsical and unreasonable intrusions into their privacy by the State
without their consent.
185. The 2nd Petitioner takes the position that the impugned law is unconstitutional for failure to involve the Senate
in its enactment. Mr. Kegoro deposed to this effect in his Further and Supplementary Affidavit sworn on 12th April
2019. He placed reliance on Article 96 as read with Article 110 of the Constitution which he stated provides that
any law that affects the functions and powers of county governments set out in the Fourth Schedule ought to be
approved and passed by the Senate. He averred that in light of the admission by the Respondents that NIIMS will
be used for statistics and planning, which is clearly a shared role between the national and county governments, the
impugned law was accordingly unconstitutional as it was not approved by the Senate.
186. Mr. Kegoro further averred that the impugned amendments seek to register children as well as adults. This
was clearly contrary to the Act which, at section 2, limited the application of the Act to citizens of Kenya who have
attained the age of eighteen years or are of the apparent age of eighteen years or over. He contended that as the
restriction in this section had not been amended by the impugned Act, its application to children, refugees and all
other non-citizens or persons whose citizenship is undetermined, including stateless persons and persons at risk of
statelessness, is illegal or ultra vires. He observed that the Director of the National Registration Bureau had, in his
replying affidavit sworn on 21st February 2019 clearly stated that the national registration authority has a mandate
to collect and keep a register of Kenyan citizens above the age of 18 only.

187. In any event, according to Mr. Kegoro, the form currently being used by the Respondents to collect data has
no basis in law as it has clearly been developed without the legislative oversight required under the Interpretations
and General Provisions Act Cap 2 of Laws of Kenya.
188. Responding to the claim by Ms. Janet Mucheru in her affidavit sworn on 26th February 2019 on behalf of the
2nd and 3rd Respondents that NIIMs seeks to protect children from trafficking, Mr. Kegoro suggested that this was
not likely to be the outcome. He averred that in the course of its work with stateless communities like the Shona
who are predominantly children of descendants from Zimbabwe, the 2nd Petitioner had established that Shona
children, despite being registered within six months from birth as required by the Registration of Births and Deaths
Act, are not issued with birth certificates.
189. Mr. Kegoro noted that according to organisations like United Nations Children Emergency Fund (UNICEF)
and the International Labor Organization (ILO), undocumented children, children of migrants and stateless children
are generally marginalised and at a very high risk of statelessness. It was his view that as structured under the Act,
NIIMS applies strictly to adults and cannot offer protection from trafficking to undocumented and stateless children
as averred by Ms. Mucheru.
190. In his view, the impugned amendments have not addressed the underlying structural issues facing stateless and
other undocumented persons. It would therefore merely entrench and exacerbate the problems that these groups
face in the digital sphere. He contended that the fact that the NIIMS system is entrenched in a law that does not
apply to stateless persons, refugees and aliens is a clear indication that the impugned amendments had the intent to
continue marginalising stateless persons rather than recognizing and granting them valid legal identity.
191. Mr. Kegoro averred that any legal regime for identification of persons in the digital age should, according to
the World Bank, comply with the Principles on Identification For Sustainable Development: Toward the
Digital Age. Such principles include ensuring universal coverage for individuals from birth to death, free from
discrimination; removing barriers to access and usage and disparities in the availability of information and
technology; and establishing a robust, unique, secure, and accurate identity.
192. It was his averment that the impugned amendments have placed emphasis on data collection and retrieval with
limited or no regulation of critical facets of data protection relating to data minimization, collection, purpose
limitation, and retention limitation that are the backbone of an effective data and privacy protection legislation. A
worse failing of the amendments, in his view, was that not a single standard had been prescribed by the impugned
amendments and none acknowledged for the purpose. It was his averment that this lacuna falls far short of the
guaranteed standard of the right to privacy and comparative standards in data privacy and registration laws in
jurisdictions that have proposed similar laws for collection of personal information.
193. Mr. Kegoro averred that the impugned amendments, held against the standards set out in UNESCO’s
International Declaration on Human Genetic Data, the AU Convention on Cyber Security and Personal Data
Protection (Chapter II thereof), the European Union’s General Data Protection Regulations (GDPR) and
comparable national legislation from other jurisdictions, had been purposefully designed to collect personal
information without safeguards for protections and mitigation of attendant risks. He reiterated the general motif of
the 2nd Petitioner’s grievance against the impugned legislation that it makes wide and ambiguous provisions for
collection of personal data but does not provide substantive law for the protection of data retrieval, processing,
storage, use and disclosure.
194. Mr. Kegoro gave several illustrations with respect to the lacuna in the law. He noted, first, that by their
generality, the amendments compel data collection from everyone without regard to the unique differences inherent
in a modern society; and that the impugned law does not anticipate the special circumstances that may call for
special regulations in the collection of data from, adults, children, persons with disability or convicted criminals,

among others. It was his averment that no effort had been made, with regard to children, to defer to their special
interests and vulnerabilities as minors. He contrasted this with the European Union’s GPDR which recognizes
children’s vulnerability and the additional support measures necessary to keep them safe in the digital age and
accordingly makes specific provisions intended to offer them additional protection in the evolving data age.
195. The second failing identified in the impugned law by the 2nd Petitioner was what was perceived as the
opaqueness that surrounds the actual software that has been deployed for NIIMS. Mr. Kegoro averred that the
nature, capabilities, ownership details and other critical features of the system were known only to the State, with
no information with regard thereto known by the public. He discounted the 5th Respondent’s assertions that it
designed and developed NIIMS with the combined effort of an inter-ministerial taskforce specifically formed for
this purpose as a bare statement. In his view, there is no way of verifying that NIIMS meets minimum integrity,
transparency and accountability standards as would guarantee privacy of personal information stored therein from
unintended third parties or from abuse from within.
196. According to Mr. Kegoro, measured against the ideal legislative framework for a secure, transparent and
verifiable system, the NIIMS system fell short, as it was impossible for example, to answer questions such as where
the personal data gathered is being stored, for how long the data will be held, whether there are automatic
notification mechanisms whenever data stored and processed in the system is accessed, and to whom the State can
disclose the data. In contrast with the opacity in NIIMS, Mr. Kegoro cited the GDPR which he averred dedicates
considerable provisions to guidelines for the implementation of appropriate technical and organizational measures
to ensure a level of security appropriate to the risk. In his view, judging from the State’s admissions, the system
appeared to have been developed well before the enactment of the impugned laws, which gave credence to the fear
that the system was arbitrarily developed and its security and integrity safeguards, if any, fall far short of
international standards for similar systems.
197. The third weakness identified by the 2nd Petitioner related to the collection of DNA under the NIIMS system.
Mr. Kegoro averred that in light of the capabilities of DNA highlighted in the affidavit of Mr. Davies Malombe, its
collection without specific, restrictive and mandatory safeguards on how it may be used threatens every aspect of
the citizen’s privacy. He reiterated the apprehension expressed on behalf of the 2nd Petitioner by Ms. Munyua and
Mr. Malombe that through the unhindered access to people’s DNA, the State will be able to profile and share
individuals’ religious, political, cultural, health, criminal and other pre-dispositions without their consent.
198. In his response to the grounds of opposition filed by the 6th Respondent, Mr. Kegoro denied that there had
been inordinate delay in filing the Petitions. He noted that the impugned Act was assented to on 31st December
2018, and commenced operations on 18th January 2019, while the Petition was filed barely 30 days from the said
date. In any event, according to Mr. Kegoro, jurisprudence in this country since the advent of the 2010 Constitution
had established that the doctrine of laches did not apply in cases for the enforcement of the Bill for Rights.
199. With respect to the 6th Respondent’s claim that there had been public participation in the enactment of the
impugned amendments, Mr. Kegoro averred that such claims consisted of bare allegations and fell far short of the
standard of proof of public participation, the burden in respect of which fell on the Respondent. The said burden
has not been discharged, and there was no evidence that Parliament took any measures to facilitate meaningful
participation or to involve the public in the law-making process beyond the newspaper publication that merely
listed the names of the Acts to be amended in the omnibus Bill.
200. Mr. Kegoro made similar averments with respect to the grounds of opposition filed by the 1st Respondent. He
observed that aside from consisting of bare denials, there was no attempt by the 1st Respondent to respond to the
substantive issues raised in the Petition. He asserted that in any event, as established by judicial precedent,
Parliament and the State bear the burden of proving, to the requisite standard, that public participation in legislative
processes had been facilitated.

201. In his response to the replying affidavit sworn by Dr. Karanja Kibicho on 26th February 2019, Mr. Kegoro
averred that, as pleaded in the Petition, the 2nd Petitioner was not opposed to the establishment of NIIMS. Its
opposition was only to the extent that NIIMS had failed to provide sufficient safeguards for fundamental rights and
to prevent abuse. Mr. Kegoro averred that the justification for a modern registration system is not disputed. What
the 2nd Petitioner was concerned with was that such a system should be alive to the equally advanced and
sophisticated threats and capabilities for abuse that, unless checked by force of law, expose the people to serious
threats of violation of inalienable fundamental rights and freedoms.
202. In his view, the NIIMS did not have clear, verifiable, accountable and secure checks and counterchecks to
safeguard individual rights of privacy and security of the person as the Data Protection Bill 2018 that prescribe
these safeguards had not yet been passed into law. He contended that whereas digitisation of certain public service
systems may improve service delivery, extra precautionary measures must be taken to guard against increased
threats of ‘single point of entry type’ breaches by internal and external parties to the detriment of the public, and
without data protection laws, these threats intensify.
203. Mr. Kegoro reiterated that whereas the purpose of NIIMS may have been well envisioned, its implementation
under the prevailing circumstances is a serious threat to the right to privacy, a fact which the affidavits of Alice
Munyua from the Mozilla Group and Dr. Fisher from Privacy International had attested to.
204. Mr. Kegoro noted that the Strengths, Weaknesses, Opportunities and Threats (SWOT) Analysis on
Existing Identification and Registration Systems in Kenya analysis report filed in court by the Respondents
recommended the adoption of an effective law that would, among other things, ensure the security of any data
collection system in light of the increasing threats of breaches and theft of vital citizen records in the digital age.
205. Mr. Kegoro averred that the fact that, as deposed by Dr. Kibicho, personal information collected under the
impugned Act will be in the exclusive custody of the government presents opportunities for abuse. It was his
deposition that comparative best practices and standards for data protection recommend, among other things, the
creation of an independent data protection authority to oversee the State as the processor and controller of protected
information and thereby enhance accountability and protection from abuse. It was his view that NIIMS as
established is essentially a self-policing data controller, processor and protection authority.
206. Mr. Kegoro reiterated the argument by the 2nd Petitioner that the amendments had not met the constitutional
threshold for public participation. He based this contention on three grounds. First, that the call for submission of
memoranda in respect of the Statute Law Miscellaneous Amendment Bill No. 12/2018 merely lists the Registration
of Persons Act as one of the laws to be affected by the amendments. No further information was published as
regards the content or impact of the proposed amendments in order to meaningfully facilitate informed public
involvement in the law-making process. His second reason is that in the departmental committee reports, there is no
record of any discussions of the substance of the amendments to the Registration of Persons Act, and in his view, in
light of the inadequacies of public participation, this was not a coincidence. Finally, he contended that there is no
record that the departmental committees received or considered any memorandum from the public in respect of the
contentious amendments.
207. It was his averment therefore that there was no evidence that the Respondents complied with Articles 10 and
118(1)(b) of the Constitution. In his view, the purported public awareness efforts undertaken by the Respondents
through newspaper articles and interviews were subjective one-sided efforts merely aimed at promoting the
adoption of the system rather than facilitating meaningful or informed public involvement in the process.
208. With respect to the information required under NIIMS, Mr. Kegoro averred that the collection of individuals’
DNA by force of law and for no specific purpose is intrusive and excessive relative to the purpose for which the
NIIMS has been established. His contentions in this regard were in consonance with the averments of Mr. Davis

Malombe, the Deputy Executive Director of the 2nd Petitioner, with regard to the collection of DNA, and the risks
that such collection, storage and use of DNA posed to data subjects.
209. Mr. Davis Malombe in turn made detailed averments with respect to the ethics and legality of collection of
DNA in his affidavit sworn on 12th April 2019. Mr. Malombe noted that as DNA pertains to entire populations,
Kenya would be required to be compliant with international conventions and standards with respect to collection of
DNA.
210. He expressed the opinion that the inclusion of DNA in the expanded scope of personal information that may
be biometrically collected for purposes of registration of persons under the impugned law is excessive and
unjustifiable. He averred that collecting DNA under the prevailing circumstances poses serious threats to protection
of human dignity and privacy of the people of Kenya and sets out various reasons for taking this position.
211. Mr. Malombe relied on the International Declaration on Human Genetic Data, unanimously adopted by
UNESCO in 2003, according to which DNA is essentially information about heritable characteristics of individuals
obtained by analysis of nucleic acids or by other scientific analysis. DNA is extracted from a sample of a person’s
cells contained in, among other things, blood, hair roots and saliva which is analyzed in a laboratory to obtain the
required genetic information, which can be stored as a string of numbers on a computer database.
212. He averred that the impugned law sanctions collection of DNA without the consent of the subject, and
collection of DNA without consent is regarded as a violation of a person’s bodily integrity. He contended that
while a number of countries do sometimes collect DNA without consent from a limited number of citizens, this
occurs only in circumstances prescribed by law, where such violations are regarded as necessary and proportionate
to the need to investigate criminal or terrorist offences. However, in order to do this, extensive legal safeguards and
tight restrictions on whose DNA may be collected in this way must be adopted.
213. Mr. Malombe further averred that DNA contains various parts which can be used for different purposes. He
noted, by way of illustration, that the International Declaration on Human Genetic Data recognizes various DNA
capabilities as including that they can be predictive of genetic predispositions concerning individuals; they may
have a significant impact on the family, including offspring, extending over generations, and in some instances on
the whole group to which the person concerned belongs; they may contain information the significance of which is
not necessarily known at the time of the collection of the biological samples;they may have cultural significance for
persons or groups, they may be used to track and identify individuals and their family members; and if further
analyzed, DNA can reveal even more detailed information such as a person’s health or other human capabilities
that should otherwise remain private.
214. He contended that genetic information is therefore regarded as sensitive personal information and the
declaration obligates member States to regulate the collection, processing, use and storage of DNA for specific
limited and strictly regulated purposes such as diagnosis and health care, medical and scientific research.
215. Mr. Malombe took the position that the impugned amendments fly in the face of the above precautions by
sanctioning unrestricted and mandatory collection and storage of DNA in digital form. He contended that the
impugned Act makes no restrictions on what genetic information may be collected, what it may be used for, who it
may be shared with and the basic standards that must be observed in the collection, processing, use, storage or
disclosure of such information.
216. While conceding that DNA may be collected for forensic or criminal investigations, it was his view that even
in these circumstances which have been established in a number of countries, whole genomes are not normally used
and a legal restriction is normally put in place to restrict genetic information to specific parts of the genome
referred to as ‘non-coding’ DNA. He contended that a forensic DNA profile is obtained and stored, based on only

parts of the DNA, which do not reveal personal characteristics.
217. According to Mr. Malombe, this limits the interference with an individual’s right to privacy by preventing
personal information regarding health and other physical characteristics from being stored. Such forensic DNA
profiles act as a ‘genetic fingerprint’ or biometric, enabling individuals to be identified through matching their
stored DNA profile with a DNA profile from a crime scene, for example. However, unlike other biometrics, a
forensic DNA profile can also be used to identify relatives (including paternity and non-paternity) and make
inferences regarding the ethnicity or ancestry of the individual. He averred that forensic DNA profiles are therefore
also regarded as sensitive personal information.
218. According to the 2nd Petitioner, indiscriminate collection of genetic information under the prevailing legal
circumstances in Kenya make such information susceptible to extraneous use, including negative profiling of
individuals for ulterior motives. Mr. Malombe observed that a person’s DNA is left wherever they go, for example
on a coffee cup, and this means a DNA database allows the government, police, or anyone who gains access to it to
track individuals and their families, even if they have not committed crimes. This can be done by matching a DNA
profile, found for example on a coffee cup at a political meeting, with a stored DNA profile in the computer
database, which then provides details about the individual’s name and address, among other things.
219. Mr. Malombe averred that if the whole population is on a DNA database, such database is open to abuse by
governments or anyone who can infiltrate the system: for example by criminals wanting to track down victims,
including high profile figures such as politicians or members of the security services, whose safety may be
dependent on not revealing their identities.
220. A further reason advanced by the 2nd Petitioner against the collection and storage of DNA is that unlike
fingerprints, DNA profiles can be used to identify an individual’s relatives. This was so because an individual
inherits half their DNA from their father and half from their mother, and a DNA database of a whole population
can be used to find a person’s parents, children, siblings and more distant relatives by comparing their DNA
through a process of searching a DNA database known as “familial searching”. According to Mr. Malombe, if a
person’s father or child is not really biologically related to them, “non-paternity” can be discovered easily by
comparing the DNA profiles of the father and their supposed children.
221. Mr. Malombe contended that the discovery of non-paternity can have very serious impacts on families, and it
was his averment that in most countries, relatedness and non-paternity is regarded as a private matter that may be
investigated within the family but should not be exposed by others, including by the police or government. He
argued therefore that building a universal DNA database risks the break-up of families by making it easy to
discover non-paternity. He alleged, by way of illustration, that databases could be misused by a corrupt official or
anyone who can infiltrate the system and gain access to the data, and if criminals gain access to information about
non-paternity, they might blackmail an individual or their family by threatening to reveal this information.
222. Mr. Malombe averred further that an individuals’ genetic information may also be analysed to identify more
distant relatives or infer genetic ancestry or lineages. This, in his view, raises additional concerns that a DNA
database may be used to facilitate identification of, and potential discrimination against, persons of different
ancestries.
223. According to Mr. Malombe, there are currently no comprehensive international safeguards for DNA
databases, which are also susceptible to errors and false matches. This risk increases when the database is expanded
because more samples are being analyzed and more computer searches are being conducted. Mr. Malombe cited the
most frequent source of errors in these circumstances as being the mix-ups or contamination of samples, either at
the laboratory or before the samples get there. He further observed that errors are also more likely to occur where
DNA from a crime scene contains a mixture of cells from more than one person, which he noted is often the case in

rape cases. He further noted that a person’s DNA can also be transferred to a murder victim or a weapon, even if
they never touched it, falsely implicating them in a crime. He illustrated the challenges of mix-up in DNA by citing
several examples from media reports in England and the United States about persons who had been charged and in
some cases convicted following mix-ups in DNA analysis.
224. Mr. Malombe averred that no other country in the world has legislation which allows the mandatory collection
of DNA from whole populations, or inclusion of DNA as part of a national identification system. He averred that
mandatory collection of DNA from whole populations violates international principles on human rights.
225. Mr. Malombe averred that to meet international privacy standards enshrined in the International Covenant on
Civil and Political Rights and the Constitution, a DNA collection and retention mechanism must be extensively
regulated, narrow in scope, and proportionate to meeting a legitimate security goal. Further, that international best
practice would require Kenya to incorporate further safeguards into its DNA gathering system, including legal
provisions to restrict the circumstances in which DNA may be collected and retained, and restrictions on the
purposes for which stored data may be used. In his view, the impugned amendments fail this test.
226. Mr. Malombe cited a report titled ‘Establishing Best Practice for Forensic DNA Databases’ with respect to
the key best practices for the protection of privacy in the collection of DNA. These include regulations on fully
informed consent, quality assurance of laboratories, restriction of purposes, rules for expungement of data and
destruction of samples. He averred that these safeguards should be enshrined in law before establishing a DNA
database. Like the other deponents for the 2nd Petitioner, Mr. Malombe’s prayer was that the court should protect
the rights of citizens and allow its Petition.
227. The third deponent who swore an affidavit in support of the 2nd Petitioner’s case was Ms. Alice Munyua, who
described herself as the Policy Advisor, Africa, of the Mozilla Corporation, the maker of the Firefox browser used
by hundreds of millions of people around the world. She averred that from her work with Mozilla, she had gained
substantial expertise and competence on issues of privacy, security, data protection and digital ID, and had engaged
with governments around the world on the said issues.
228. Ms. Munyua conceded that there is no doubt that legal identification is generally valuable for society, and that
such legal identification schemes are enablers for the effective delivery of services and engagement between
government and its citizens. She cited in this regard the UN Sustainable Development Goals (SDGs) which call for
"providing legal identity for all, including birth registration" by 2030. She averred that without these commonly
recognized forms of official identification, individuals are at risk of exclusion.
229. Ms. Munyua contended that at Mozilla, it had been recognised that Kenya appeared to have various challenges
with the current legal identification system. She also observed that the Office of the Ombudsman in the
Commission on Administrative Justice (CAJ) in Kenya had, in 2015, declared a crisis in the issuance of legal
documentation in Kenya. That it had also provided evidence of widespread discrimination in access to
documentation of identity, including access to proof of citizenship. In her view, transitioning to a digital
identification system without first addressing the existing problem of widespread discrimination will not solve
these problems. It will, rather, introduce several additional grave concerns including violations of privacy, security
risks, increased discrimination and exclusion. Ms. Munyua relied in support on the CAJ investigation report on the
crisis of acquiring identification documents in Kenya.
230. According to Ms. Munyua, transitioning to a digital biometric identification model is not required in order to
realize the benefits of legal identification. She averred that to assume that "leapfrogging" to digital identification is
inherently superior ignores the risks that digital, particularly biometric identifications, bring when deployed on a
national scale.

231. Ms. Munyua averred that the digital features and infrastructure of digital identification projects have very
different implications from their analogue legal identification initiatives. She contended that, contrary to the
assertions by the Respondents, the addition of biometrics like iris scans, ear lobe geometry and DNA data is a
dramatic expansion of the existing legal identification system which goes beyond mere digitization. It was her
averment that biometric and DNA linked digital identification creates profound threats of invasive privacy
violations, and the potential for misuse is very high. In her view, the linking of databases has the potential to turn
the NIIMS system into a pervasive means of identification, tracking, and control, as well as increase the risk of
large-scale data breaches, concerns that were serious enough to require that the government allows sufficient
discussion, examination and scrutiny through public consultations.
232. Ms. Munyua contended that NIIMS, like other similar national biometric identification systems, was a
centralised database of the most intimate details of a country’s residents. That through the legislation authorising
NIIMS, the government was contemplating collecting a wide range of extremely sensitive information, including
DNA, iris scans, earlobe geometry, and fingerprints. It was not clear, according to Ms. Munyua, what purpose
collecting all of this highly sensitive information serves and whether the means proposed in the law are the
minimum necessary to accomplish this purpose.
233. She averred that it was increasingly universally recognized that data collected is data at risk; that the more
sensitive information is stored in a centralized database, the more significant becomes the risk of harm to all people
if that system gets breached. It was her deposition that while it is tempting to use biometrics as an easy way of
ensuring the uniqueness of enrollees to a system, such use increases the risk associated with an identification
system. In her view, if and when a biometric database is breached, DNA and fingerprints cannot simply be reset
like a password, and it was also far from clear that biometrics are the only way to ensure uniqueness and avoid
duplicative enrolment.
234. Ms. Munyua averred that a breach of an identification database is not just a theoretical harm. To illustrate, she
cited the situation in India where, despite the government’s claims that the Aadhaar database was ‘100% secure’,
there have been repeated reports of the demographic data being compromised, which has made it difficult to trust
the resilience of the system against malicious practices. Citing an online article, she observed that a private citizen
in India had been able to buy access to all of the demographic data in the Aadhaar database for just 500 rupees
(Kshs 727). She further observed that other online reports indicated that it was possible to purchase editing rights to
the Aadhaar demographic database for a mere 2,000 rupees (Kshs 2909).
235. In further illustration of the risks of digital identifications, Ms. Munyua gave the example of Estonia whose
system, which had allowed cryptographic keys to be generated on a smartcard rather than a general-purpose
computer, had been praised for its security and sophistication.. She averred that the system had, however, become
vulnerable when the cryptographic library was compromised, necessitating significant measures to mitigate the
risk. It was her contention that despite the fact that Estonia has a small population and boasts a highly developed
infrastructure and a very technologically savvy population, it was necessary to take significant measures to mitigate
the risk of breaches. In her view, it was unclear whether Kenya has the resources or infrastructure to mitigate a
similar breach of NIIMS.
236. In supporting the position taken by the Petitioners that Kenya should have used ‘open source’ in the design of
NIIMS, Ms. Munyua deposed that her company embraces ‘open source’. She stated that the term referred to
“something people can modify and share because its design is publicly accessible.” She further averred that "the
open source way" and “open source projects, products, or initiatives embrace and celebrate principles of open
exchange, collaborative participation, rapid prototyping, transparency, meritocracy, and community-oriented
development.” She argued that as a company embracing open source, Mozilla has found significant benefits in
open sourcing all of its codes, including for products like Firefox, as this allows many individuals, including
security researchers around the world, to find and report vulnerabilities in its codes. Ms. Munyua argued therefore

that with respect to the NIIMS system, the code used to generate identifiers for Kenyans should be available for
public inspection, along with the code used to verify enrolment and send or share information.
237. Ms. Munyua made further averments in her affidavit regarding the dangers of a centralized database like
NIIMS with extensive sensitive biometric data. It was her testimony that as an integrated and centralized database
of sensitive biometrics, NIIMS creates a significant security risk and is susceptible to breaches by malicious actors
or abuse by public authorities. In her view, breach of systems like NIIMS were not a remote risk, and it was a safe
operating assumption that the database will be compromised, and she cited by way of illustration the breach of
India’s Aadhaar system.
238. While conceding that seamless transfer of information between government departments may be desirable for
governance, Ms. Munyua contended that there are better alternatives to achieve this without breaching privacy
rights. She supported this contention by referring to the Estonian system in which the databases of each department
and service provider are held separately and are connected through the X-Road data exchange layer that manages
the exchange of information as needed by each programme.
239. Ms. Munyua expressed the view that an identification database that is primarily meant for welfare delivery
should not be misused for law enforcement or intelligence surveillance. She averred that NIIMS may create a
transaction log of all authentication requests linked to specific identification numbers. According to Ms. Munyua,
access to these logs of metadata about where an individual was authenticated and by which agency could reveal
highly specific information about an individual’s movements and affiliations.
240. Ms. Munyua contended that in order to mitigate the risk of misuse for law enforcement or intelligence
surveillance, the Kenyan government should look to decentralized models like the United Kingdom’s where the
identity provider does not know the purposes for which identification is requested, and the entity requesting is
given minimal information restricted to confirming or denying the request. She cited in this regard a paper by
Edgar Whitley titled ‘Trusted Digital Identity Provision: GOV.UK Verify’s Federated Approach’.
241. Ms. Munyua further made various averments regarding the shortcomings in the process of establishing
NIIMS. She cited in particular the lack of public participation in the process, noting that under the 2010
Constitution, public participation is now a constitutional right and an obligation on the part of the government. It
was her averment that NIIMS was authorised through changes made to the Registration of Persons Act through the
Statute Law (Miscellaneous Amendments) Act and was not subjected to public participation. She further argued
that the amendments to the Act came into force on January 18, 2019, only 19 days after the President gave his
assent, without public consultation or parliamentary debate.
242. Ms. Munyua averred that there was insufficient protection for data provided for NIIMS. She contended that
while the government asserts that there is a data protection policy and bill that informed the development of
NIIMS, the Bill is still pending debate in Parliament. It was her view that no digital identification system should be
implemented without strong privacy and data protection legislation; that data protection laws seek to protect
people's data by providing individuals with rights over their data, imposing rules on the way in which companies
and governments use data and establishing regulators to enforce the laws.
243. Ms. Munyua contended that individuals should always be in control of their digital identities and biometrics,
and it was particularly egregious that NIIMS was passed even as a strong data protection law is under consideration
by the Kenyan Parliament. In her view, the proposed Data Protection Bill of 2018 is a strong and thorough
framework which contains provisions relating to data minimization, collection, purpose and retention and if it was
in effect, NIIMS would likely be in conflict with its provisions.
244. According to Ms. Munyua, the data protection law should establish an empowered, independent regulator to

ensure that rigorous regulations and standards are set on how to handle personal data processing. It was also her
view that an independent data protection authority is critical to ensure the data protection law is enforced.
245. It was also Ms. Munyua’s averment that the main features and processes of the identification system,
especially those affecting the rights of users, must be enshrined in the primary law. She contended that leaving
implementation details of the NIIMS entirely to government discretion without this framework creates
unacceptable risks for citizens of profiling, social exclusion, privacy violation, and security compromise. In her
view, an independent regulator can help to protect the rights of Kenya’s residents, but those rights must first be
established in law.
246. With respect to the security of the system, Ms. Munyua took the view that the position taken by the
respondents that the system was secure because section 20 of the Computer Misuse and Cyber Crimes Act, 2018
provides enhanced penalties for offences involving protected computer systems does not make the NIIMS system
secure. It was her averment that making an attack of a system a crime does not actually make it secure. Her opinion
was that legal penalties alone have never served as a sufficient deterrent against malicious actors. She cited in this
regard the situation in India where, despite the legal prohibitions against publishing Aadhaar numbers and
breaching the system, there have been multiple public leaks and breaches, including by state governments, citing
the case of the State of Andhra Pradesh which had allegedly build India’s first police state using data from
Aadhaar.
247. Ms. Munyua further contended that relying aggressively on laws that criminalize accessing a computer system
without authorization had another downside in that it can disincentivize and threaten security researchers. She
averred that security researchers play a critical role in finding and reporting vulnerabilities in a system so that they
can be patched in an expeditious manner. She argued that some of the most effective security research involves
probing computer systems without the explicit permission of the owner of that system. Her position, as we
understand it, is that governments should not criminalise accessing computer systems as this would deter security
researchers, thus leaving the systems vulnerable and making the identity system and the deeply private information
stored in it less secure.
248. Ms. Munyua argued further that the NIIMS process should not be used for exclusion. She observed that
possessing identity is increasingly a precondition to accessing basic services and entitlements from both state and
private services. Given that access to vital government services will require a Huduma Namba, the potential
consequences of being excluded from enrolment in the system were immense. It was, consequently, important that
no one is excluded from the identification system because of their physical, social, demographic, or economic
characteristics. She noted in particular the potential exclusion of marginalized communities through the process of
enrolment into the system as officials will be using existing documents to prove and verify who is a citizen, thus
locking out people who do not have these documents. She averred that the gap of conclusive proof of citizenship
already affects many Kenyan communities, including the Makonde, the Shona as well as pastoral communities and
tribes.
249. It was her averment further that those who are already enrolled in the system might also be at risk of exclusion
due to the features of NIIMS that might end up enabling discrimination. She observed that collection of DNA data
can be used to identify an individual’s ethnic identity, and given Kenya’s history of politicization of ethnic
identity, collecting this data in a centralized database like NIIMS, which can be linked to other databases, could
reproduce and exacerbate patterns of discrimination. Reliance for this averment was placed on a report from the 2nd
Petitioner titled ‘Politicization of Ethnic Identity in Kenya: Historical Evolution, Major Manifestations and
the Enduring Implications’.
250. She further noted that in India, the requirement of the Aadhaar ID number for access to HIV medication was
feared to increase the risk of stigmatization and further discrimination, citing a report in which it was noted that

HIV positive people had dropped out of treatment programmes as treatment centres insisted on Aadhaar
registration. It was her averment that for such vulnerable communities, the possibility of a record being maintained
and potentially shared in unauthorized ways was an unacceptable risk.
251. With regard to the question of best practices on digital identification systems, Ms. Munyua criticised the
examples of best practices cited by the 5th Respondent, notably United Kingdom, Estonia, India, and Malaysia. She
contended that the projects in these countries have been highly criticized or are not relevant comparisons. With
regard to the Estonian model, it was her averment that it is a federated system and is in stark contrast to the
integrated model put forth by the government of Kenya. As for the Malaysian and Indian models, her averment was
that serious concerns have been raised with regard to privacy, data protection, governance, and cyber security as
well as concerns related to system design and the inclusion or exclusion of people from government and some
private services. In relation to the United Kingdom DNA database, it was her averment that it was not an
identification system at all. It was, rather, a forensic DNA database maintained by the United Kingdom police for
those implicated in crimes and was governed by strict data retention norms which require that the records of
individuals found innocent be deleted. Her averment was that this system was in stark contrast to NIIMS which
would take the DNA data of the entire population, rather than merely those suspected or convicted of crimes.
252. Ms. Munyua asserted that the United Kingdom’s government’s identification system, Verify, does not include
biometrics and has a completely federated identification architecture which has been commended for its
decentralized approach that gives users control. It was also her averment that the United Kingdom was not an
appropriate comparison since, like most of the other countries mentioned by the Respondents, it has had strong data
protection law and enforcement in place since 1984.
253. She noted that while the Respondents had taken the position that India’s Aadhaar identification project has
been heralded as a success story, they had ignored much of the criticism that has plagued the project. She averred
that with the demographic data in Aadhaar reportedly compromised, it was hard to see how the system can be
trusted for authentication. According to Ms. Munyua, a more worrying aspect of Aadhaar was that hundreds of
thousands of people have been denied access to basic services, including access to food, because they either do not
have an Aadhaar (digital identity) card, or their digital identity is “incomplete” because their fingerprints have not
been uploaded to the national database due to poor internet connectivity.
254. Expert evidence was presented for the 2nd Petitioner by Ms. Grace Bomu Mutung’u through her witness
affidavit sworn on 12th April 2019. She was also cross-examined at the instance of the 2nd and 3rd Respondents.
255. Ms. Mutung’u described herself as an Advocate of the High Court of Kenya and a researcher and specialist in
digital rights and internet governance. She stated that she had over 10 years’ experience in internet governance
digital rights work and held advanced certifications on information controls from Harvard University. Her witness
affidavit was sworn in support of the 2nd Petitioner’s petition, and particularly in addition to paragraph 10(a),
(corrected at the hearing to paragraph 14(a)) of the further and supplementary affidavit of Mr. George Kegoro
sworn on 12th April 2019.
256. Ms. Mutung’u averred that Kenya is a signatory to international conventions that call for the protection of the
privacy of children. She cited Article 10 of the African Charter on the Rights and Welfare of the Child which
guarantees to all children the right to privacy; the Convention on the Rights of the Child which also protects a
child’s right to privacy at Article 16; as well as Article 40 with respect to legal proceedings.
257. Ms. Mutung’u averred that universal principles on digital privacy laws acknowledge that processing of
children’s data requires additional protection. She cited the European Union’s General Data Protection
Regulations (GDPR), recital 38, which provides that children merit specific protection with respect to their
personal data as they may be less aware of the risks, consequences and safeguards and their rights with respect to

their personal data.
258. She averred that the principles require special consideration of children when processing their data. She noted
that when considering fairness and lawfulness, attention should be given to the fact that children are still in their
formation and are therefore likely to change as they mature to adulthood. Consequently, digitalization of their lives
should be done in a manner that does not prejudice their future opportunities.
259. She noted, by way of illustration, that while digital systems may be used to capture children’s educational
journeys, caution should be applied when capturing subjective aspects. Thus, the system should be designed to take
in factual aspects such as the name, parentage and schools the child attended. It should, however, avoid opinions
such as reasons for a child’s good or bad performance in school. Should it be necessary to record such opinions,
they should be removed from decision making technology, and automated decisions should never be made on the
basis of subjective opinions.
260. Ms. Mutung’u cited the United Kingdom Data protection regulator, the Information Commissioner’s Office
(ICO)’s recommendations to data controllers processing children’s data. It recommends that they consider the
basis for processing of children’s data and design systems and processes that respond to children’s specific needs.
Among the principles she cited include consent to the processing of the data, though she avers that this may not be
adequate protection of privacy, particularly with respect to children because of the power asymmetry between the
data processor and the subject. She noted that in many instances, users of online services need the service and
consent is presented as a step one has to accept by clicking on in order to proceed to the service, a challenge that is
more profound for children who may not have the full capacity to understand information presented to them.
261. The second principle she cited relates to the purpose for which the data is required. Ms. Mutung’u averred that
since children’s data can be used to profile them in prejudicial ways, the purpose for which the data is collected
must be very clearly stated.
262. Ms. Mutung’u further noted the need to observe the principle of adequacy in the collection of data relating to
children. Her averment was that the nature of big data systems requires collection of as much data as possible for
big data analytics, which abrogates the right to informational privacy where one’s data should not be unnecessarily
required. It was her averment that children are in an especially vulnerable position in relation to big data as they are
ever growing, their biological features are maturing with significant changes, and big data systems would require
their data to be constantly updated, leading to constant surveillance. It would therefore be necessary, in her view, in
order to ensure safeguards on adequacy, to determine why children’s data is being collected in the first place, a
function that would best be covered in laws or regulations.
263. A fourth necessary principle with regard to children’s data, according to Ms. Mutung’u, is accuracy, the need
for data processors and controllers to ensure that children’s data is accurate. To achieve this, parents or guardians
should be given an opportunity to view the children’s data and to correct and update it as may be necessary.
264. According to Ms. Mutung’u, a data system should also take into consideration the principle of retention in
relation to children’s data, given the transitory nature of childhood and the increased capacity that comes with it.
She averred that children’s data, which is collected and processed without their full awareness, should therefore not
be stored eternally. Upon reaching adulthood or the age of consent, children should be able to make decisions on
their data, including moving with it to other systems or having it completely destroyed.
265. Concomitant with this right is the right of children as data subjects. While they may have no capacity to make
decisions involving their data, like other data subjects, they can exercise these rights with the assistance of an adult
such as a parent or guardian. Ms. Mutung’u averred that regulations should define how children may achieve their
data subject rights and the role of parents and guardians in this regard.

266. Ms. Mutung’u further averred that there should be clear provision with respect to data security. She observed
that in a country like Kenya where children form a significant part of the population, their data is of great interest to
the government but also to data analytics who would want to study the collective traits of Kenyans. She averred
that children’s data is therefore highly valuable and requires high protection at all times.
267. Finally, Ms. Mutung’u averred that there was a need to ensure that there was no cross-border transfer of
children’s data, and that there should be assurance that children’s data shall not be transferred to jurisdictions
without adequate data protection.
268. It was her averment that no attempt had been made in the impugned law to provide for the above safeguards.
In her view, the inescapable conclusion was that the said law gives the State unfettered power to gather children’s
data without concomitant responsibility to protect children against possible threats of abuse or derogation of their
privacy.
269. In cross-examination by Mr. Regeru Ms. Mutung’u confirmed that she had not presented any documents to
the court regarding her expertise on children’s digital rights. She had sworn her affidavit in support of paragraph
14(a) of George Kegoro’s affidavit, which she conceded had been responded to by the affidavit of Karanja Kibicho
(for the 2nd and 3rd Respondents) sworn on 14th May 2019. She maintained that no system exists in respect to
children’s digital data or with respect to the digital data of stateless persons and refugees.
270. Ms. Mutung’u maintained that while Kenya was a signatory to the Convention on the Rights of the Child and
the African Charter on the Rights of the Child and had made commitments with respect to the rights of children,
looking at the amendments to the Registration of Persons Act, Kenya had made no attempt to protect children’s
digital data. She conceded, however, that there is no published information on NIMS and her averments were based
on the amendments to the Registration of Persons Act.
271. Ms. Mutung’u also conceded that from the affidavits sworn on behalf of the 5th Respondent by Loyford
Muriithi, she had noted mention of encryption, which gives protection to children and adults. She had also noted
his averment that as regards children’s identity data, additional or special technical safeguards were incorporated in
the architectural design of NIIMS database with a view to providing the requisite safety. She did not know how
NIIMS affects the rights of children as she was not familiar with the architecture and functioning of NIIMS.
272. Ms. Mutung’u stated that none of the legislation in force, including the Children Act and the Counter-
trafficking Act, offer protection to children, and neither did the amendments to the Act align it to the Constitution.
In her view, children’s data is not being used to trace children, though it may lead to their tracing.
273. Taken through the averments by the Respondents on the benefits of NIIMS, in particular that digital national
master population registers are crucial in enforcing rights nominally enshrined in law by providing greater legal
protection, and that NIIMS could help in the elimination of trafficking in children, child labour, as well as help
enforce laws against child marriage, she asserted that in her view, there was no benefit to NIIMS given the manner
in which it was designed; that digitisation of children’s data was a harmful cultural practice and harmful choices
were being made for children; and that once they were digitised, they could not ‘undigitalize’ themselves. As she
saw it, the problem with NIIMs was the centralisation of data.
274. With regard to the data capture form for the Huduma Namba, her view was that it did not have provision for
consent of parents, just confirmation that one has given their data to government.
275. In cross-examination by Dr. Nyaundi, Ms. Mutung’u maintained that there should be more safeguards and the
system should have been discussed before data collection for children started. In her view, if there are safeguards in
place, it would be in order to collect children’s data. She asserted that there should be purpose limitation and

clarity on why children’s data was being collected, as well as limitation on who can access that data once it has
been collected, as well as being very clear on what happens to the children as regards their data when they attain
the age of majority. She disputed the suggestion that biometric registration will reduce cases of child labour and
child trafficking.
276. In response to questions from Mr. Bitta, Ms. Mutung’u maintained that the law relating to data collection
contained in the Act is deficient in certain respects, and to the extent of the deficiency, the law is unconstitutional.
She confirmed that under Article 1 of the Constitution, the people of Kenya have given power to the legislature to
legislate, but the court had power to question a law or policy on the basis that it is not efficacious, and can ask the
legislature to correct the legislation. She conceded that the technical aspects of a legislation would be found in
subsidiary legislation, not the main Act, and that the information being sought under NIIMS is necessary to the
government for, among other thing, knowing where children are born, their residence and parentage.
277. In re-examination, Ms. Mutung’u stated that while it was necessary to know where children are born, among
other things, it was not necessary to have such information in digital form. She expressed the view that the
amendments to the Act had abrogated human rights and, in respect to children, there was no legal provision for
collection of children's data or issuing identity cards to children. Ms. Mutung’u referred to section 2 of the Act to
confirm her contention that the Act applies only to Kenyans who are above 18 years.
278. While agreeing with the views expressed in the affidavit of George Kegoro in support of the Petition and the
need for special protections for children who are a vulnerable group, she took a critical view of NIIMS on the basis,
first, that children's data was collected without a legal basis and secondly, there was no consideration of the
question whether it was necessity to collect children's data and then digitise it or in other words change children
into data. In her view, it was necessary, in the circumstances, to ask the questions set out in Article 24 of the
Constitution, whether it was necessary to collect children's data, and whether there were less abrogating ways of
collecting this data and safeguarding it and protecting the privacy and dignity of children.
279. With respect to the architecture and design of NIIMS, Ms. Mutung’u stated that the 2nd Petitioner had
requested for information about the technical capability of NIIMS and how it was being developed from the
Ministry of Interior in December 2018 but they had not received a response.
280. Ms. Mutung’u made reference to the averments by George Kegoro with respect to the collection of DNA, the
immutability of DNA, and that once it is collected, it is permanently stored. She testified that should the database
containing DNA be breached, it would threaten the privacy of every person. It was her contention further that the
State will have unhindered access to people's DNA and be able to profile and share the individual’s religious,
political, cultural, health, criminal and other predispositions without their consent. With regard to children, the
concern was that malevolent actors may want to profile children and manipulate their lives and behaviour.
281. To the question whether the digitisation of data would stop child trafficking, Ms. Mutung’u reiterated her
response in cross-examination that it would not, noting that there were cases, such as in India, where children were
registered by people other than their parents, and in her view, registration under NIIMS would not stop trafficking.
282. On the provisions of Article 24 of the Constitution, Ms. Mutung’u’s evidence was that there was no
legitimate basis for collecting children’s identity data as section 2 of Act does not envisage collection of children's
data or issuance of identity to children. In any event, in her view, there are less restrictive measures, or measures
that would promote their rights more. There was nothing in the law in her view that would safeguard children, a
vulnerable part of the population, as the law was silent on and does not address the issue of children in any way.
283. Ms. Mutung’u expressed the apprehension that everyone was being reduced to data and that only a person
with a digital personality can receive services. Further, that the idea that one can only receive services if one has a

digital personality was suggestive of the creation of a new legal regime or a new law of personality, a digital
personality, on the basis of which one would receive services. This, in her view, goes to the core of the Constitution
and the sovereignty of the people of Kenya, raising the question whether one was no longer a person in the eyes of
government if one does not have digital personality. She further expressed the apprehension that NIIMS, which was
touted as a single source of truth, could be taking the country back to centralization of power as the person who can
view the data has a lot of power.
284. Ms. Mutung’u reiterated the views that she had expressed in her witness statement regarding the absence in
the law of the principles that are a requisite for data protection in relation to the special nature of children and
therefore provide special protection for children when processing their data. She maintained that the law does not
provide for the principle of fairness and lawfulness, and no consent was sought or any explanation given to children
or their guardians with regard to the purpose for the collection of their data.
285. Ms. Mutung’u asserted that no explanation was given on whether there were no less invasive means of
achieving the same purposes sought to be achieved with the impugned law, without putting the lives of children at
risk. She testified that the principle of adequacy, which requires that only what is sufficient for the intended
purposes is collected, was not adhered to. It was her contention that we are now living in an age where data is the
new oil, and there is a push to collect as much data as possible on people. In her view, however, the principles of
data protection, especially the principle of adequacy, requires that only such data as is sufficient for the intended
purpose, which purpose should be stated beforehand, should be required. Considering that children are still in their
formation, if the government starts collecting data on them now and keeps collecting more and more data and
profiling them, a lot of decisions on the lives of children will be made based on this data. It was therefore necessary
to collect only what is sufficient for the stated purposes.
286. As regards the principle of accuracy, it was Ms. Mutungu’s testimony that from the design of NIIMS, there is
absolutely no opportunity for children or their caregivers to view what data the government has on them and to
correct what is incorrect. Yet, such data is used to make decisions, including legal decisions, that affect their lives.
With respect to the principle of retention which Ms. Mutung’u testified is related to the principle of adequacy, her
view was that data should not be kept in perpetuity but only for the period when it was required. These issues, in
her view, were not addressed in the impugned amendments, and it was not known how long the data was going to
be stored, the possibility being that it would be kept eternally.
287. As for the rights of data subjects, it was her testimony that these should have been captured in regulations; that
the Act should have been made in a way that would have allowed for regulations that would define how children
may achieve their right to access, correct, and update the data, and the manner of transiting with the data upon
reaching adulthood, to decide what should be done with the data collected prior to adulthood.
288. With regard to security of children’s data, Ms. Mutung’u testified that it was not known how secure the data
was. Further, that there is no publication that states what measures have been put in place to secure the data, and in
the event of a breach, that there are good systems to mitigate any harm that may arise from the breach. On the issue
of cross-border transfer of data, Ms. Mutung’u testified that the Petitioners just needed an assurance that children's
data will not be exported to be used to train artificial intelligence systems; and that if it is exported, it will be used
in jurisdictions that have adequate data protection laws.
289. In countering suggestions from the Respondents that she did not have the expertise that she claimed in
children’s digital rights, Ms. Mutung’u explained in re-examination that she had studied information technology at
Strathmore College specialising in management of information systems. She had studied law at the University of
Nairobi and had interned under Professor Ben Sihanya, a Professor of IT and intellectual property. She had studied
Internet Governance at the University of Malta, and thereafter was awarded a fellowship in 2016-2017, renewed in
2017-2018, at the Berkman Klein Center for Internet and Security housed at Harvard Law School. She had

participated in and given input on all the Bills that have to do with information, communication and technology,
including the Access to Information Bill (now the Access to Information Act) and the Data Protection Bill then
pending before Parliament.
The 3rd Petitioner’s Case
290. Kenya National Commission on Human Rights (KNCHR) is an independent human rights institution created
by Article 59 of the Constitution, and established by the Kenya National Commission on Human Rights Act of
2011. Its mandate is to protect and promote human rights in Kenya, and to uphold and defend the provisions of the
Bill of Rights. It filed a petition dated 18th February 2019, which is supported by the affidavit and further affidavit
of Dr. Bernard Mogesa sworn on 18th February 2019 and 21st May 2019 respectively.
291. The 3rd Petitioner echoed the concerns raised by the 1st and 2nd Petitioners with respect to the process of
enactment and substance of the impugned amendments. It specifically cited the lack of public participation, the use
of the omnibus Bill and violation of the right to privacy. The 3rd Petitioner raised an additional ground that the
impugned amendments violate the constitutional right to dignity by making the collection of DNA mandatory,
contending that DNA collection is invasive and should only be taken for specified and well recognized reasons.
292. The 3rd Petitioner prays for:
a) A declaration that the amendments introduced to the Registration of Persons Act through the Statute Law
Miscellaneous (Amendment) Act No. 18 of 2018 are unconstitutional null and void .
b) A declaration that the amendments introduced to the Registration of Persons Act through the Statue Law
Miscellaneous (Amendment) Act No. 18 of 2018 are unconstitutional, null and void for being in violation of
Article 10 and 118 as read with Article 259 of the Constitution.
c) A declaration that the amendments introduced to the Registration of Persons Act through the Statue Law
(Miscellaneous Amendment) Act No. 18 of 2018 are unconstitutional, null and void for infringing on the right
to privacy and the right to public participation.
d) An order prohibiting the Respondents, by themselves, their employees, agents and/or servants from installing
the National Integrated Information Management System in any manner howsoever until effective policy, legal
and institutional frameworks are put in place.
e) An order prohibiting the Respondents, by themselves, their employees, agents and/or servants from
implementing the National Integrated Information Management System in any manner howsoever, until
effective policy, legal and institutional frameworks are put in place.
f) A declaration that the entire legislative process introducing substantive amendments through a Miscellaneous
Act was flawed and defective and is thus null and void.
g) Being a public interest suit, no orders as to costs do issue.
The 3rd Petitioner’s Evidence
293. In his affidavit in support of the Petition and his further affidavit, Dr. Brian Mogesa averred that the impugned
amendments violate, among others, Article 31 of the Constitution on the right to privacy, and Articles 10 and 118
on the national values of governance and public participation. He averred that the amendments were enacted
unprocedurally by way of an omnibus Bill which is not appropriate for such major and extensive amendments. It

was also his contention that the Bill should have been referred to the Senate for approval before enactment.
294. Dr. Mogesa further deponed that the impugned amendments have introduced a broad definition of biometrics
that differs significantly from that provided in the Data Protection Bill. Additionally, he contended that the
amendments will enable the government to obtain from individuals Global Positioning Systems (GPS) co-
ordinates. It was his contention that these amendments will lead to inordinate and arbitrary storage of needless and
intrusive confidential information in violation of Article 31 of the Constitution.
295. According to Dr. Mogesa, there are no policy guidelines regulating the management and security of the data. It
was his deposition therefore that the implementation of the impugned amendments would subject individuals to
grave risk of unauthorized disclosure of confidential personal information, including their location.
296. In his further affidavit, Dr. Mogesa responded to the averments by the 6th Respondent on the issue of public
participation by averring that the constitutional principle of public participation presupposes that the public ought
to have been engaged in a meaningful and qualitative manner. It was his contention that the said standard was not
met. In his view, the advertisement of the amendment Bill in the newspapers by the Respondents was a cosmetic
attempt to give the illusion that the public had been accorded an opportunity to participate in its enactment.
297. According to Dr. Mogesa, the Respondents had resorted to threats to counter the opposition to the impugned
amendments, and he annexed copies of newspaper excerpts of statements made by government officials to the
effect that certain services would not be availed to those without a Huduma Namba, and that there would be no
extension of the registration period for the said number.
298. The 3rd Petitioner conceded that it sent a memorandum to the National Assembly on the impugned
amendments. It was Dr. Mogesa’s averment, however, that the original Bill that the 3rd Petitioner sent a
memorandum on was later substantially changed. He asserted that in any event, the mere fact that the 3rd Petitioner
gave its views to Parliament does not mean that these views constituted sufficient or meaningful participation by
the public. He annexed a copy of the 3rd Petitioner’s Memorandum on the Statute Law Miscellaneous
(Amendments) Bill of 2018 dated 25th May 2018.
299. It was Dr. Mogesa’s averment, however, that the 3rd Petitioner is not against the introduction of NIIMS. Its
only concern was that the introduction of NIIMS was not in compliance with the Constitution, and there was no
clear legislative framework for protection of the data collected.
THE CASES OF THE INTERESTED PARTIES SUPPORTING THE CONSOLIDATED PETITIONS
300. The Interested Parties who supported the Petitions were Muslims for Human Rights, Haki Centre, Law
Society of Kenya, and Inform Action, which filed affidavits in support of the Consolidated Petitions. The 3rd
Interested Party, Muslim for Human Rights (Muhuri) is a non-profit organization that works on promoting and
advancing human and people’s rights for communities in all regions of Kenya. It filed a Replying Affidavit sworn
on 24th April, 2019 by Khelef Khalifa, the Chairman of its Board of Directors.
301. On its part, the 4th Interested Party, Haki Centre, is a non-governmental organization that promotes the
progressive realization of human rights and active participation in addressing the issues of citizenship and
statelessness. It also filed a Replying Affidavit sworn on 8th April 2019 by Phelix Lore, its Executive Director.
302. The 5th Interested Party, Law Society of Kenya, is a statutory corporate body established by section 3 of the
Law Society Act, Cap 18 of the Laws of Kenya, and one of its objectives is to assist the government and courts on
legislative matters and the administration and practice of law in Kenya. It filed a Replying Affidavit sworn on 14th
March, 2019 by its Chief Executive Officer, Mercy Wambua.

303. The last Interested Party who supported the Petition was the 6th Interested Party, Inform Action Limited,
which is a human rights organization that empowers communities. It filed a statement dated 8th April, 2019.
304. The Interested Parties’ averments are substantially to the same effect as the averments made by the Petitioners
on both the procedural and substantive infirmities of the impugned amendments, as well as the shortcomings of
NIIMS.
305. The particular areas underscored by the Interested Parties were the lack of information and public participation
in NIIMS; its threat to the right to privacy and insufficient data protection provisions; the use of an omnibus Bill to
enact the impugned amendments and lack of Senate’s participation; the perpetuation of marginalization and
exclusion of vulnerable groups who face challenges in getting registration as Kenyans; and the lack of limitations
on the powers to be exercised by the public officers in charge of NIIMS.
306. The 3rd and 6th Interested Parties in addition contended that the impugned amendments seek to limit the
enjoyment of fundamental rights and freedoms, but do not meet the threshold for such limitation set out in Article
24 of the Constitution, to the extent that they do not specify and address the parameters set out in that Article. They
contended, in particular, that the new data sought to be collected under NIIMS has no rational connection with the
stated objectives of the Act, nor are they reasonable and justifiable in an open and democratic society.
307. On its part, the 4th Interested Party in addition put forward a case for stateless persons. It contended that just
like Nubians, stateless persons are unable to access documentation of citizenship in Kenya, which has resulted in
restrictions in enjoyment of rights and freedoms guaranteed under the Bill of Rights and under international and
regional human rights instruments. Further, that stateless persons are limited in access to birth registrations, identity
documents, education, healthcare, employment, property ownership, political participation and freedom of
movement which are enshrined in the Constitution. It was its case that stateless persons will be further
discriminated against by NIIMS if adequate safeguards are not put in place by the government.
308. The 5th Interested Party, elaborated on the discriminatory practices and profiling that are likely to be caused by
NIIMS. It contended that vulnerable groups such as children and the elderly who, for lack of identity documents or
poor quality of fingerprints, may be locked out of the system, will not be able to get services. Further, that persons
may also be targeted from the data collected by NIIMS for personal, commercial and political gain.
309. The 5th Interested Party further contended that under NIIMS, it is possible for the government to control the
economic, social and cultural existence of individuals, and to control access to subsidized food supply, healthcare,
and social welfare among other important social services, which undermines the sovereignty of the people of
Kenya.
THE RESPONDENTS’ CASES
The 1st Respondent’s Case
310. The 1st Respondent is the Honourable Attorney General who is the principal legal adviser to the government
of the Republic of Kenya and represents the national government in court. His office, powers and responsibilities
are as established under Article 156 of the Constitution of Kenya and the Office of the Attorney General Act No.
49 of 2012. The 1st Respondent filed grounds of opposition dated 20th February 2019 and 26th February 2019 in
response to the Consolidated Petitions. It was his contention that the Petitions do not disclose any threat of
violation of the Constitution; that the Petitions are premised on conjecture and misconceptions that negate the
substance and object of NIIMS; and that the formulation and enactment of the impugned amendments were made
within the confines of a proper and justified legislative process. He contended further that the registration of
persons is a process regulated by the Births and Deaths Registration Act and the Registration of Persons Act and

the NIIMS process is primarily anchored on the said legislation.
311. As regards the allegation by the 1st Petitioner that the Nubians have faced discrimination in the registration
process, his response was that the allegation lacked a factual and legal basis. In his view, to have the State accord
the Nubians preferential treatment over and above other Kenyan citizens is contrary to the provisions of Article 27
of the Constitution.
312. The 1st Respondent further took the position that NIIMS seeks to capture and store data in a centralized digital
database for effective and efficient administration which will facilitate accountability in various forms and curb
wastage of resources in line with Article 201 of the Constitution. It would also ease registration and identification
of persons thereby improving the security of the country by authenticating and verifying persons. Moreover, by
attempting to direct the manner in which the impugned legislation ought to have been enacted, the Petitioners were
asking the court to question the legislative wisdom of the National Assembly contrary to Chapter Eight of the
Constitution yet they had failed to demonstrate that the parliamentary procedure was flouted in the process leading
to the enactment of the impugned amendments. It was the 1st Respondent’s contention therefore that the Petitioners
had failed to discharge the evidentiary burden required of them to prove non-compliance with Article 118(1)(b) of
the Constitution as read with National Assembly Standing Order No. 123 as regards public participation in the
process leading to the enactment of the impugned laws.
313. According to the 1st Respondent, public participation can in any event be effected directly by the people or
indirectly through their democratically elected representatives in the National Assembly which courts have taken
judicial notice of. Furthermore, the Petitioners had failed to explore the option provided under Article 119(1) of the
Constitution as read with the provisions of the Petition to Parliament (Procedure) Act No. 22 of 2012 before
seeking redress from this Court. It was his contention further that the Petitioners have failed to rebut the
presumption of constitutionality that is enjoyed by the impugned amendments.
314. The 1st Respondent conceded that data protection is crucial. He argued that contrary to the Petitioners’ claim
that there are no data protection laws, data in Kenya had been secured under various statutes including section 83 of
the Kenya Information and Communication Act and section 20 of the Computer Misuse and Cyber Crimes Act.
315. It was also his contention that the right to privacy is not an absolute right. Further, that the Petitioners have not
demonstrated how the limitation to the right to privacy fails to meet the dictates of Article 24 of the Constitution, if
at all, and they had also failed to outline the vagueness in the impugned law or the opaqueness in the manner in
which it is being implemented.
316. To the contention that the impugned amendments were unconstitutional for not receiving Senate approval, the
Attorney General asserted that under the Fourth Schedule to the Constitution, national security, immigration and
citizenship, national statistics and data on population are functions of the national government. Consequently, there
was no requirement to involve the Senate during the enactment of the impugned law.
317. Regarding the use of an omnibus Bill to enact the amendments, the 1st Respondent stated that the impugned
amendments are not substantive and therefore their enactment through a Statute Law (Miscellaneous Amendment)
Act was justified.
The 2nd and 3rd Respondents’ Case
318. The 2nd Respondent is the Cabinet Secretary in the Ministry of Interior and Co-ordination of National
Government, while the 3rd Respondent is the Principal Secretary in the said Ministry. The two Respondents are
public offices established by the Constitution as part of the Executive branch of Government and are responsible
for inter-alia the registration of persons services under the Registration of Persons Act.

319. In response to the Petitions, the 2nd and 3rd Respondents filed three Replying Affidavits all sworn by Dr.
(Eng). Karanja Kibicho, CBS, on 26th February 2019. They also filed a Further Affidavit sworn by the same
deponent on 14th of May 2019. The 2nd and 3rd Respondents also filed a further affidavit sworn by Janet Mucheru
on 26th February, 2019.
320. Dr. Kibicho deposed that he is one of the three Principal Secretaries in the Ministry of Interior & Co-
ordination of National Government. He is also, pursuant to section 9A(3) of the Registration of Persons Act (as
amended by Statute Law (Miscellaneous Amendments) Act No. 18 of 2018), the administrator of NIIMS. It was his
averment that the government of Kenya has a responsibility to provide services to the people of Kenya and in order
to fulfil its legal and constitutional responsibility, it requires adequate planning which in turn requires reliable data
regarding its citizens and other persons within the country.
321. He deposed that collection of data and making it easily accessible for utilization by the government and other
relevant stakeholders is therefore of paramount importance. It was his deposition that the government has been
collecting relevant data from its citizens through multiple registration systems at different phases of an individual’s
life from birth to death by disparate agencies, thereby leading to duplication of efforts and wastage of resources. He
averred that some of the government agencies would collect information from individuals but without any unique
identifiers such as fingerprints thereby risking the accuracy and reliability of such information.
322. Dr. Kibicho stated that the existence of multiple population registration systems undertaken by disparate
agencies under independent legislations resulted in a number of challenges. He identified these challenges as
including duplication of efforts; wastage of public resources; incomplete population data; inefficient coordination
and linkage of registration agencies; cases of identity fraud; and limited capacity to share information due to the
manual storage of information.
323. He deposed that in light of the above challenges, the government, in 1989, conceptualised the development of
one national population register as a single source of truth on the identity of individual citizens and foreign
nationals residing in Kenya. It was his averment that although there has been some progress, this objective has not
been met, and currently, approximately ten institutions which were collecting information from Kenyans in 1989
still do so and maintain mostly segmented and parallel databases. Dr. Kibicho stated that the NIIMS system was the
culmination of the vision for a single national population register.
324. Dr. Kibicho narrated the events and steps that preceded the introduction of NIIMS since the initial concept in
1989. One of the key components of the initial idea was the creation of a National Population Register (NPR). In
the year 2000, a concept paper was developed by the Office of the President for what would then become the
Integrated Population Registration System (IPRS). In 2001, the concept paper was approved by the Cabinet which
gave the go-ahead to the Office of the President and the Ministry of Finance to start the project. In 2002, the Office
of the President initiated the development of its Information Communication Technology (ICT) Policy Framework
and Strategic Implementation Plan for the years 2002-2005 which plan initially prioritized the creation of an ICT
infrastructure linking all departments within it. In September, 2005, an Inter-Ministerial Taskforce on Integration of
Population Register Systems (IPRS) was appointed to fast track the integration of the registration systems. In its
February 2006 concept paper, the Taskforce recommended, among other things, the introduction of a unique
national number – Personal Identity Number (PIN) for all individuals resident in the country, assigned at birth, to
serve as the control number for all registration systems.
325. It further recommended the establishment of a National Population Register, containing information of all
residents, to serve as a central reference for all population registration systems. Further, that a central database be
established to facilitate operations of the National Population Register. Finally, that a nationwide ICT infrastructure
backbone be developed to link government agencies for purpose of information sharing and verification. These
recommendations formed the basis for the subsequent operationalization of IPRS. It was his averment that the IPRS

was conceived to provide a Common Reference Model (CRM) geared towards facilitating efficient coordination,
linkages of registration systems, and information. Its purpose was also to enable convenient, equitable and
innovative access by users to integrated government registration services under the larger scheme of e-government
projects including the Integrated Financial Management System (IFMIS) among others.
326. According to Dr. Kibicho, some of the objectives of the IPRS were to develop a centralized national
population register that would contain information of all Kenyans and foreigners resident in Kenya; to improve data
storage and access in all population registration agencies; to facilitate efficient coordination and linkages of
registration agencies; and to improve overall registration capacity within the registration agencies.
327. Nevertheless, IPRS had its own challenges which included the fact that an individual’s data was still being
collected by multiple government agencies, which resulted in continued wastage and inefficiency; that in some
cases, the data being integrated into IPRS contained inaccuracies, pointing to the need to collect personal
information from the source again; that information relating to children was not being captured comprehensively at
birth; that IPRS did not constitute a master register which could be regarded as “a single source of truth” as it relied
on information from multiple, sometimes conflicting, sources; and that the multiple registrations systems resulted
in issuance of several identity documents such as identity cards, passports, driving licences and National Hospital
Insurance Fund (NHIF) cards.
328. Dr. Kibicho averred that the above challenges were pointed out in a report prepared by the Ministry of
Information, Communication and Technology and the United Nations International Children’s Emergency Fund
(UNICEF) after a Strengths, Weaknesses, Opportunities and Threats (SWOT) Analysis on Existing Identification
and Registration Systems in Kenya. To build on the progress made by IPRS and address the challenges identified
by the SWOT Report, the government initiated the NIIMS programme which was operationalised by Executive
Order No. 1 of 2018.
329. The purpose of the NIIMS programme, according to Dr. Kibicho, was to create and manage a central master
population database which will be the “single source of truth” on a person’s identity and will serve as the only
reference point for personal information for Ministries, Departments and Agencies (MDAs) and other stakeholders.
His averment was that the main objectives of NIIMS are to collate, store, integrate, harmonize and facilitate sharing
of population data from nearly all databases; provide a single source of truth (one-stop-shop) on persons’ identity
data for citizens and foreign nationals residing in Kenya; and to undertake national biometric registration of all
citizens and foreign nationals residing in Kenya.
330. It was his averment further that NIIMS is crucial for development planning and decision making. That it is
also a key component of the government’s service delivery commitments, currently prioritized under the “the Big
4 Agenda” which include food security, affordable housing, manufacturing and affordable healthcare.
331. Dr. Kibicho further highlighted some of the key benefits of NIIMS as including optimal utilization of scarce
public resources; an accurate, reliable and comprehensive population registration database; verification, validation
and authentication of primary data source; accurate population data for planning and service delivery; digital and
inter-linked access to information for decision-making; and standardization and streamlining of relevant
government processes.
332. Other benefits of NIIMS identified by Dr. Kibicho were access to registration services by all Kenyans;
improvement of provision of security by government to citizens particularly in light of threat of terrorist attacks;
improvement in enforcement of law and order including facilitation of early detection of fraudulent activities,
minimisation of cases of identity theft and reduction of fraud in land transactions; to foster confidence and
assurance in financial transactions due to the overall verifiability of personal information; and enhancement of tax
collection.

333. Dr. Kibicho contended that by implementing NIIMS, the government is joining the global trend of adopting
technology in service delivery. Further, that the implementation is in actualization of Kenya’s commitment to the
African Union regarding digitization, harmonization and integration of systems to promote efficiency in service
delivery. The 2nd and 3rd Respondents contended that the government has spent a lot of money, time and other
resources in actualizing NIIMS. It was their case that the government had successfully completed the pilot phase
and intended to roll out the mass registration in the month of March 2019.
334. Dr. Kibicho denied that the government intended to collect DNA and GPS coordinates from citizens as alleged
by the Petitioners. He averred that the data collection form had no provision for collection of DNA and GPS
information, and that in any event, Kenya does not currently have the capacity to collect DNA information from all
Kenyans. As regards GPS, it was his averment that the government’s intention is to know the place of residence of
each Kenyan. However, it does not intend to keep surveillance on their movements as alleged by the Petitioners. In
his view, NIIMS is intended to protect individuals’ rights to privacy by ensuring that all their personal
identification information is secured in the custody of one government entity.
335. It was also his averment that Kenya has a robust series of statutes and policy on data protection, information
security, modalities of access to information and protection of privacy of the integrity of government records and
information. In his view, NIIMS has not introduced major changes to the information to be obtained from Kenyans.
Instead, it has sought to update the government’s method of collection and storage of information to take
advantage of current technology for efficiency purposes.
336. Dr. Kibicho stated that the impugned amendments were subjected to meaningful and qualitative public
participation in line with Article 118(1)(b) of the Constitution and had met the threshold thereunder. He detailed the
enactment process of the impugned amendments to buttress his averment and contended that members of the public
and requisite stakeholders were given sufficient notice and adequate opportunity to participate in the consideration
of the issues in the Bill. It was also his contention that members of the National Assembly, being the duly elected
representatives of the people of Kenya, effectively represented the citizenry in the consideration and passage of the
amendments. He had also personally sensitized members of the public on NIIMS through various public fora and
media in his official capacity.
337. Dr. Kibicho averred that the impugned amendments were not substantive in nature as the personal information
required for registration under NIIMS is essentially similar to the personal information required for registration
under the registration systems which were already in existence before the amendments.
338. Regarding the failure to submit the Bill to the Senate, Dr. Kibicho deposed that the matters covered by the
impugned amendments relate to national population registration, which is not a devolved function and is squarely
within the mandate of the National Government. To the Petitioners averments that there were other Bills pending in
Parliament on the same issue as the impugned amendments, Dr. Kibicho responded that the intended purposes of
the National Registration and Identification Bill, 2012 and the Registration and Identification of Persons Bill, 2014
which have in any event since stalled in Parliament, are effectively achieved by the impugned amendments.
339. In response to the concerns raised by the Petitioners with respect to the procurement of NIIMS, Dr. Kibicho
stated that the procurement of the hardware components of the NIIMS registration kits was conducted in strict
compliance with the Constitution and procurement laws. Further, that owing to the sensitivity of NIIMS, its
software component was developed internally by several government agencies under the stewardship of the
Ministry of Information Communication and Technology and no foreign entity was involved, or will have access to
the information collected by NIIMS.
340. The Petitioners contention that NIIMS will entrench discriminatory practices was denied. Dr. Kibicho averred
that on the contrary, NIIMS will ensure universal coverage for individuals from birth to death, thereby eliminating

any perceived discrimination against any individual or class of persons under the current disparate registration
systems. He averred further, that in any event, the need for vetting of applicants for the issuance of legal
identification documents upon attaining the majority age, as is currently the practice, would be unnecessary as the
requisite personal information would already be in the NIIMS system. According to Dr. Kibicho, the complaint
about the alleged discrimination under the current registration system being carried over to NIIMS has no basis. He
noted that the Petitioners had not demonstrated what feature of NIIMS would make registration of alleged
marginalized communities more difficult. He also dismissed the allegation of discrimination, noting that the 1st
Petitioner had, in a letter dated 8th April 2017, paid glowing tributes to the 2nd, 3rd and 4th Respondents for a
commendable job done in the registration of persons especially in areas where members of the 1st Petitioner reside.
341. Dr. Kibicho also observed that unlike the national identity card which is only issued at the age of majority, the
registration for NIIMS will start as early as immediately after birth, thus easing access to services and exercise of
constitutional rights. Vetting, if any, is in respect of issuance of national identity cards and registration for NIIMS
does not require any vetting.
342. On the concerns raised by the Petitioners with regard to the registration of children, Dr. Kibicho averred that
NIIMS will not hinder any child from enjoyment of the rights of a child, but will instead facilitate the enjoyment of
such rights including the right to education, health, identity, nationality, and protection from child trafficking and
protection from child labour.
343. In his affidavit sworn on 14th May 2019, Dr. Kibicho, averred, first, that no material evidence had been
provided by Ms. Fatuma Abdulrahman to support the averments made under the heading “Historical Review of
Nubian Experience” in her affidavit of 12th April 2019. It was his averment that the alleged discrimination against
the Nubian community relates to shortcomings in the current registration system as opposed to NIIMS, which he
contended will address any shortcomings.
344. According to Dr. Kibicho, NIIMS is not designed to, and will not discriminate against Nubians or any other
ethnic community. He conceded that members of all border communities, which he defined as communities whose
members are found within and outside Kenya, are subjected to vetting in order to ensure that only genuine citizens
are issued with identification documents. It was also his position that vetting is further necessitated by national
security concerns arising from security risks posed by porous borders. Vetting was therefore not discriminatory, but
in any event, the vetting committees complained of were not introduced by the impugned amendments.
345. In response to a complaint by the 1st Petitioner that vetting for purposes of issuance of identity documents was
done only twice a week, he averred that there is no regulation or policy stipulating that vetting is to be conducted
only on Tuesdays and Thursdays of every week. It was his averment that vetting can be done on a daily basis
depending on the number of persons desiring to acquire identity cards. He further stated that contrary to Ms.
Abdurahman’s averments, the law requires a person to be issued with an ID card within 30 days of the application
for those turning 18 and 15 days for replacement of a lost or unserviceable identity card. It was his contention that
whenever an applicant appears before the vetting committee and is positively identified as a Kenyan, he or she is
registered immediately thereafter. Dr. Kibicho clarified that that NIIMS registration process is meant to be a
continuous exercise and all Kenyans will have an opportunity to register in the system.
346. As regards the decisions of the African Commission on Human and Peoples’ Rights and the African
Committee of Experts on the Rights and Welfare of the Child, Dr. Kibicho observed that the decisions do not relate
to NIIMS and are largely irrelevant to the gravamen of the present dispute. Further, that the said decisions were
determined ex parte, and are in any event not binding on the Kenyan State. Dr. Kibicho noted that the 1st Petitioner
had alleged that there were no local remedies available for determining the dispute relating to alleged
discrimination, and in his view, it was an abuse of process for it to now seek to introduce it before this court.

347. Dr. Kibicho also addressed himself to the contentions by George Kegoro in his Further and Supplementary
Affidavit sworn on 12th April 2019 that the National Registration Bureau has no authority to collect or store
biometric data from children, stateless persons, refugees and foreigners; that NIIMs does not protect children from
trafficking; that the form used to collect data has no basis in law; and that the personal information collected under
the impugned amendments will be in the exclusive custody of the government rather than an independent data
protection authority which opens opportunities for abuse. His response was that the rights of children, stateless
persons, refugees and aliens are substantially protected under the Constitution and existing legislation, including
the Kenya Citizenship and Immigration Act, 2012, the Children’s Act, 2001, and the Refugee Act, 2006, and that
the impugned amendments do not in any way repeal these pre-existing legislation. Moreover, that the impugned
amendments categorically provide for the registration of children on NIIMS. In addition, that registration onto
NIIMS is not based on any form of discrimination on any ground including nationality, because it fully
incorporates the registration of citizens and non-citizens currently residing in Kenya.
348. According to Dr. Kibicho, NIIMS registration is fully under the administrative supervision of the relevant
Principal Secretary, and this effectively creates an extra level of supervision and accountability to ensure the
overall effectiveness and integrity of the system. Further, that the form encompassing the data capture tool
implements the text and spirit of the impugned amendments and is therefore formulated within the law.
349. Dr. Kibicho denied the contention by Mr. Kegoro that the impugned amendments do not comply with the legal
principles that apply to digital identification of persons set out by the World Bank in the publication “Principles on
Identification for Sustainable Development: Toward the Digital Age.” He averred that contrary to the
averments by Mr. Kegoro that there is a lacuna in the impugned amendments as regards the retrieval, processing,
storage, use and disclosure of the collected data and that there is a need for the establishment of clear legal
safeguards to ensure accountability, NIIMS clearly encompasses the said Principles. It was his position that the 2nd
Petitioner has not demonstrated how NIIMS has failed to meet any of the Principles, but that in any event, the said
Principles are not binding on Kenya. In Dr. Kibicho’s view, there already exists a healthy and robust legislative
framework on data retrieval, processing, storage, use and disclosure of information such as is contained under
NIIMS.
350. Response was also made to the averments by Mr. Kegoro that the collection of DNA without safeguards
threatens the right to privacy and is intrusive; that despite the benefits of NIIMS and digitization in service
delivery, precautionary measures must be taken to guard against breaches by internal and external parties; and that
the constitutional objective of public participation was not met in NIIMS. Dr. Kibicho reiterated that NIIMS
registration did not involve collection of DNA. He clarified however, that DNA collection is crucial in certain
circumstances, such as prevention of crime including terrorism, and in the identification of bodies in case of
accidents where all other biometrics are destroyed or unavailable.
351. It was his averment, however, that NIIMS will not be freely accessible by third parties, either private or
foreign, and is predicated on the law, namely the Registration of Persons Act, which is operating within the larger
legal framework on data protection. Furthermore, the government was in the process of enacting the Data
Protection Bill, 2019 to bolster this framework. According to Dr. Kibicho, NIIMS as a single source of truth offers
a more secure option of data protection by reducing the points for breaches, and as admitted by the 2nd Petitioner,
this is the global trend in personal identification databases. He noted that despite the Petitioners concerns, over
thirty-one (31) million individuals, representing approximately sixty-five percent (65%) of Kenya’s population,
were enrolled during the NIIMS registration exercise.
352. Pursuant to a notice to cross-examine issued by the Petitioners, Dr. Kibicho testified as DW3 and was cross-
examined on his affidavit evidence set out above. He confirmed that the data capture form for the Huduma Namba
registration had sections that required personal and biometric bio-data. He further confirmed that although the form
was primarily meant for personal identification, it also requested for other information on agricultural activities and

employment status, a result of requests made by other Ministries who needed the said data and for whom data was
collected in the same form for purposes of cost effectiveness.
353. Dr. Kibicho further confirmed that the statement in the form that indicated the registration was mandatory was
later removed, and the only mandatory documents required for the registration were either an identity card, birth
certificate, passport or alien card.
354. Dr. Kibicho acknowledged that some of the information sought in the data capture form was already held by
various government institutions but averred that the information had become adulterated. The main purpose of
NIIMS therefore is to confirm the correct information about a person accurately in digitized form to address this
shortcoming. On the disclaimer in the data capture form, Dr. Kibicho explained that this was a form of consent that
the information collected could be given to authorized government agencies.
355. Dr. Kibicho further explained that the government had tried to collate personal data through setting up the
Integrated Population System. This, however, did not solve the problem of adulteration of the data. It was his
testimony that the Huduma Namba process will provide an opportunity for verification of documents and cleaning
up of the personal data held by matching and verifying it with documents held in other databases.
356. On the requirement for DNA in the impugned amendments, Dr. Kibicho testified that the purpose of including
DNA was to provide for as many unique identifiers in the law as possible. There was, however, no intention to
collect DNA even though it is permitted by law. He asserted that for the Huduma Namba registration, the only
biometrics collected were digital fingerprints and digital photographs.
357. When questioned on the public participation on NIIMS, Dr. Kibicho testified that he and various government
officials and the national government administration infrastructure had sensitized the members of the public and
carried out civic education on the benefits of NIIMS. He denied that they stated or threatened that the registration
for Huduma Namba was compulsory.
358. Dr. Kibicho was also cross-examined on the Data Protection Policy of 2019 and data protection principles of
fairness, transparency, accountability and data minimization. He stated in response that the government was open to
engagement on any issues that the Petitioners may have with NIIMS. His testimony was that the Registration of
Persons Act was the legal framework for NIIMS, and for the purposes of the Data Protection Policy and Bill, the
offices of Data Commissioner and Data Controller are yet to be established as the Bill is yet to be enacted.
359. It was his averment further that in relation to NIIMS, it is the Principal Registrar created in the Registration of
Persons Act that is performing the functions of the Data Controller, and that the said Act also provides for offences
if there is unlawful disclosure of data. He denied that the data collected on Huduma Namba will be exposed,
maintaining that there are existing laws on data protection, and the Data Protection Bill is meant to consolidate
these laws.
360. With regard to the application of the Registration of Persons Act to children, Dr. Kibicho disagreed that the
Act does not apply to children under section 2 thereof. It was his position that it applies to all Kenyans including
children, pursuant to the amendments made to the Act. He clarified that only birth certificates and not the
fingerprints of children under the age of six (6) years were required during the Huduma Namba registration
exercise. He also referred to the Executive Order that established the Huduma Namba Inter-ministerial Committee
as providing the guiding laws on children.
361. With regard to the decisions of the African Committee of Experts on the Rights and Welfare of the Child on
the discrimination against Nubian Children, Dr. Kibicho testified that it had been implemented by way of budgetary
allocations for registration exercises. The government had also implemented Rapid Results Initiatives and

affirmative action for Nubians and those who pass the vetting have been issued with identity cards. It was his
testimony that the assertion by the Petitioners that Nubians are not given identity cards is a false one.
362. It was also his testimony that incremental registration of births of children was adopted under NIIMS, which is
to be achieved by cleaning up of data on the births already registered and registering new births in the system.
Further, that this approach arose from recommendations in the SWOT analysis undertaken by UNICEF and the
benchmarking and study tours of the Estonian registration system.
363. Dr. Kibicho denied that the vetting of Nubians before issue of identity cards was done on ethnic grounds. He
explained that the vetting is only done where a Registrar is in doubt about the citizenship of a person from the
communities living in Counties bordering other countries, which he termed as border communities. With regard to
the composition of the vetting committees, Dr. Kibicho clarified that the committees are identification committees
set up under the Act and are government led, with local elders being included at the discretion of the Chair of the
committee
364. He confirmed that those without identity cards were not registered with NIIMS but stated that the Respondents
were making efforts to ensure that the Nubians are issued with identity cards, though he stated that it was not all
Nubians who did not have identity cards. It was Mr. Kibicho’s position that registration with NIIMS is a
continuous process and one can be registered upon obtaining an identity card. Dr. Kibicho denied that NIIMS
registration is necessary for service provision by the government but that it will be more convenient to get services
with the Huduma Namba. In his view, it is for a person to choose if they wish to be inconvenienced or not.
365. With regard to whether a cost-benefit analysis of NIIMS had been done, Dr. Kibicho stated that taxpayers
money of Kshs 7 billion had been spent so far on the system, and that at completion, Kshs 9 billion would have
been spent. While the government was not asked to provide the costing on the benefits of NIIMS, such figures are
available, and he had enumerated the benefits in his response to the Petitions.
366. According to Dr. Kibicho, the amendments to the Act were therefore minor as the new data collected was
minimal, and it is the digitization of the data which is novel. He, however, conceded that there would be risks if the
data is not protected. While protecting national security is one of the uses of NIIMS, the entire NIIMS data cannot
be exempted from protection on grounds of national security, and that there are security laws which prescribe the
circumstances when this can be done. He also confirmed that no rules were developed after the amendments of the
Act to guide the Huduma Namba registration.
367. In re-examination by Mr. Regeru, Dr. Kibicho explained that digitization is one of the reform platforms of the
government. While there had been other initiatives undertaken, digitization of the population register was lacking
and was needed to complement efficient service delivery. He reiterated his evidence on the public participation
held, the mandatory documents that were needed for the Huduma Namba registration, that the said registration was
not mandatory and that DNA was not collected nor is its collection planned during the exercise.
368. Dr. Kibicho explained that the physical attendance of a registrant is important in NIIMS for purposes of
recording biometrics arising from the adulteration of existing databases, and the physical presence of a person is
required to match him or her to the existing data. He also explained that people gave their consent by annexing a
digital signature or thumbprint, and the incremental registration will result in a situation where everyone has only
one unique identifier.
369. Dr. Kibicho stated that 31,500 Huduma Namba registration kits were acquired, and that they would be left
with the Chiefs, Assistant Chiefs and civil registration clerks for continued registration. With respect to the
question of vetting for identity cards, Dr. Kibicho reiterated that it is not unique to Nubians, it is done by Assistant
Chiefs for all Kenyans, including among border communities, and the vetting committee is a second level of

authentication where an Assistant Chief is not sure of a person’s identity, He denied that border communities
equate to tribe and clarified that everyone living at the border is part of a border community regardless of their
tribe. He also denied that there has been discrimination against Nubians nor was there such government policy.
370. Dr. Kibicho pointed out that there is a website with information on NIIMS and that the administration and his
ministry had given information on NIIMS, how it was to be rolled out, and its benefits. He enumerated the direct
benefits of NIIMS including the savings made in collection of data and rolling out of services, the conduct of the
population census and registration of voters. Further, that in the cost–benefit analysis, there are benefits of NIIMS
that directly translate to money benefits while others are in the form of convenience in eternity as enumerated in his
affidavit. Further, that the main costs of NIIMS was in the acquisition of the registration kits and payment of
registration clerks.
371. According to Dr. Kibicho, the Data Protection Policy applies not only to NIIMS but to all data that is
collected, and that the office of the Data Controller can only be appointed once the Data Protection Bill is enacted
into law, and not on the strength of the policy. Dr. Kibicho testified that every institution that collects data from the
public has a data administrator and laws that regulate the collection and management of the data, and the Bill is
being enacted for efficiency reasons to tidy up existing laws.
372. Dr. Kibicho denied that there was a need for a Huduma Namba law before rolling out of Huduma Namba
Registration. He maintained that the amendment to the Act was adequate as there were other existing laws as
identified in the Executive Order on NIIMS implementation. He also clarified that under section 9A as read with
section 2 of the Act, NIIMS applies to all Kenyans, including children, and that NIIMS had benefits for children in
terms of planning for their health, education and other services. He further asserted that the government had
submitted its report upon compliance with the recommendations made by the African Committee on the Welfare of
the Child, and that the welfare of children is also a core principle in the Constitution.
373. Dr. Kibicho informed the Court that if allowed to process the data collected in NIIMS, all existing identity
cards would be collapsed to one digital identity card- the third generation identity card- which will have an
encrypted chip. Further, that each service provider would have a reader that only reads the information in the card
that is relevant to it.
374. The second deponent on behalf of the 2nd and 3rd Respondent, Janet Mucheru deponed that she is the Director,
Civil Registration Services, a department under the Ministry of Interior and Coordination of National Government.
This department, is responsible for the registration of births and deaths that occur in Kenya and draws its mandate
from the Births and Deaths Registration Act, Cap 149.
375. She detailed the functions of the Civil Registration Services and averred that it is mandated to register certain
particulars which include the name, sex, date and place of birth, and the names, residence, occupations and
nationality of the parents for any birth. As regards deaths, Ms. Mucheru listed the particulars registered as the
name, age, sex, residence, occupation and nationality of the deceased, and the date, place and cause of death. She
stated that the Cabinet Secretary in the Ministry has the discretionary power to prescribe any other particulars other
than those set out in the Act, including biometric data.
376. It was therefore Ms. Mucheru’s deposition that in registering births, the Civil Registration Services requests
for substantially the same personal information as was being captured by the data capture form for NIIMS, and
which information has always been in its custody and is therefore not new.
377. While making reference to the finding in the report by the Ministry of Information and Communication
Technology in partnership with UNICEF titled Strengths, Weaknesses, Opportunities and Threat Analysis of
Existing Identification and Registration Systems in Kenya, December, 2017 that a birth certificate number is

not unique, Ms. Mucheru set out the risks attendant with the manual collection and registration of birth particulars.
She pointed out that there is a risk of duplication of records, loss of physical records, delays in processing birth
records, ineffective service delivery when the need arises to share or verify the data on births with other agencies,
and the lack of linkage between the birth and death of an individual.
378. Ms. Mucheru contended that the data processing, analysis and utilization by the Civil Registration Services
can only be improved by the use of technology and deposed that the use of NIIMS will prevent cases of identity
theft where certain individuals may use the identity of a dead person for criminal purposes. It was also her
deposition that the said Report recommends that all citizens be electronically registered at birth to ensure accurate
collection and storage of data that will become the “single source of truth.” She further deposed that digitization of
this data by NIIMS will ease service delivery by the Civil Registration Services by facilitating efficiency in the
production and maintenance of the register of births and deaths. It was also her contention that the integration of
personal information with biometrics through NIIMS will enhance the integrity of the records of births and deaths
that are maintained by the Civil Registration Services.
379. With regard to children, Ms. Mucheru averred that NIIMS would facilitate enjoyment of the rights of children
because the current registration systems do not uniquely identify children and have aided in the prevalence of child
trafficking in Kenya as noted in the Trafficking in Persons Report, 2017. Further, that due to the fragmented nature
of the registration systems, there have been cases of falsification of documents resulting in illicit adoptions where
children have permanently been separated from their families. Due to the unreliable records on children and the
resultant irregular adoptions, the government had issued an indefinite moratorium in inter-country and resident
adoption and revoked licences to conduct inter-country adoptions to protect children in Kenya.
380. Ms. Mucheru enumerated the benefit of NIIMS to children. She averred that with NIIMS, the traceability of a
child’s parents prior to adoption is ensured. Further, that a reliable biometric identification will effectively ease the
process of re-uniting children with their families when compared with the present process of reunification which is
lengthy, tedious and costly as it requires publication in the newspapers or DNA testing of parents. In her view, with
a DNA database, identifying the parent will be simplified by comparing a child’s DNA to available DNA profiles.
381. It was her deposition further that the introduction of biometrics to the registration of births will enable the
Civil Registration Services to ascertain the identity of a child and curb child identity theft by linking that child’s
biometric to a specific Huduma Namba as issued through NIIMS and eventually, to their parent (s). Further, that it
will ensure children are not subject to various bureaucratic registration processes in different stages of their
development. Ms. Mucheru asserted that reliable data on children will also ensure proper planning during
emergency situations such as drought, famine or war and ensure provision of essential services to children during
the period of separation.
382. Ms. Mucheru highlighted other benefits that will accrue to children as a result of registration in NIIMS,
including, eliminating the need for verification of citizenship, enhancing public health as a result of more efficient
immunization using a child’s Huduma Namba, accessing education, enabling government to plan for the welfare of
children, identifying children in conflict with the law, and detecting and remedying child labour and sexual
exploitation. By digitizing the process therefore, the registration coverage of births and deaths will be raised by
100% by 2020 in line with the Civil Registration Service’s strategic objectives.
The 4th and 7th Respondents’ Case
383. The 4th Respondent is the Director of the National Registration Bureau, which is an office in the Ministry of
Interior & Co-ordination of National Government. It is responsible for the implementation and enforcement of the
Registration of Persons Act and, specifically, the identification, registration and issuance of identity cards to all
persons who are citizens of Kenya and who have attained the age of eighteen years. The 7th Respondent is the

Kenya Law Reform Commission, established by the Kenya Law Reform Commission Act No. 19 of 2013 with the
mandate of reviewing and preparing legislation to give effect to the Constitution. The cases of the two Respondents
are captured together in this judgment as they were represented and their cases presented by the same Counsel.
384. The 4th Respondent, Mr. Reuben Kimotho, relied on a Replying Affidavit he swore on 26th February 2019.
The 7th Respondent on its part filed Grounds of Opposition dated 26th March, 2019.
385. Mr. Kimotho deponed that NIIMS is not replacing the current registration systems. On the contrary, in order to
be enrolled on NIIMS, an individual is required to produce proof of registration with either an identification card
issued by the 4th Respondent, a birth certificate issued by the Civil Registration Service; a Foreign National
Identification Card issued by the Immigration Services or a Refugee Identification Card issued by the Refugee
Affairs Secretariat.
386. Further, that the 4th Respondent is mandated by the Act to keep, in a register of all persons in Kenya to whom
the Act applies, particulars of their registration number, name, sex, declared tribe or race, date of birth or apparent
age, place of birth, occupation, profession, trade or employment, place of residence and postal address, finger and
thumb impressions or palm and toe impressions, date of registration, and such other particulars as may be
prescribed. It was his deposition that the impugned amendments made various minor amendments to the particulars
to be kept in the register including the introduction of biometric data as part of the said particulars, and also
established NIIMS. Mr. Kimotho averred that the Act grants the Director of the 4th Respondent the power and
discretion to prescribe the manner in which the particulars are to be recorded, which cannot be taken away as
proposed by the Petitioners.
387. It was his deposition further that it is apparent from the data capture tool that the information collected for
purposes of NIIMS is information that is already in the custody of the 4th Respondent and other government
agencies. Mr. Kimotho stated that in addition to the data capture tool, the government has also captured digital
biometric data, namely fingerprints and facial features, for the purposes of NIIMS. He described NIIMS as a central
database of digital photographs and digital fingerprints of Kenyan citizens and residents for purpose of integrating
the personal information captured in the data capture tool to the biometric data. It was also his averment that
NIIMS is aimed at integrating and consolidating information of the type already held by the 4th Respondent, with
an individual’s biometric data, for the purposes of creating, managing and operating a digitized national population
register as a single source of personal information for all Kenyan citizens and residents. Mr. Kimotho averred that
thereafter, each person will be assigned a unique national identification number known as the Huduma Namba.
388. He noted that this is an important departure from the current manual registration system identified in the
Report by the Ministry of Information and Communication Technology in partnership with UNICEF, titled: “
Strengths, Weaknesses, Opportunities and Threats Analysis of Existing Identification and Registration
Systems in Kenya, December, 2017” and reiterated the gaps acknowledged by the Report as stated by the 2nd and
3rd Respondents. He further pointed out that birth registration and identity card systems are not synchronized, and
the deployment of NIIMS would address this challenge.
389. Mr. Kimotho responded to various concerns about NIIMS raised by the Petitioners. In response to the
contention that NIIMS is duplicating the functions of the Integrated Population Registration Service (IPRS) and
lack of transitional provisions, Mr. Kimotho asserted that these two systems perform separate and distinct
functions, and there is therefore no need for transitional mechanisms in the impugned amendments.
390. Mr. Kimotho explained that IPRS is a repository of information received from various registration agencies as
a secondary source of personal information, and merely collates the said information with no point of contact with
the subject of the information. That on the other hand, NIIMS provides the avenue for the collection of
foundational information for all Kenyan citizens and residents directly from the owner of the said information.

Further, that NIIMS integrates this foundational information with functional information held by other government
institutions which IPRS does not do. It was therefore his averment that IPRS performs a passive function of merely
receiving personal information from particular databases and storing them, while NIIMS performs the active
function of collecting information first hand from the subject, and regularly integrates and updates the said
information. Accordingly, that IPRS relies on data from other agencies while NIIMS relies on data received
directly from the information subject.
391. Mr. Kimotho termed the allegation by the Petitioners that NIIMS would lead to infringement of the right to
privacy as bare allegations. He stated that none of the Petitioners have set out with any degree of precision or
specificity the manner in which this right has been violated, or is threatened with violation. It was his position that
the petitions are based on abstract and hypothetical situations devoid of any real dispute. Accordingly, the
allegation that the amendments in the Act that introduce Global Positioning System (GPS) as one of the particulars
required in registration of citizens and residents is an infringement of the right to privacy is false and misleading.
He further averred that GPS is merely a precise geographical location, expressed in longitude and latitude and only
describes the precise location of a person’s place of residence. He asserted that in any event, GPS is not currently
being collected by the NIIMS data capture form in use.
392. Mr. Kimotho averred further that DNA as a unique identifier is not part of the personal information collected
by the data capture tool. He, however, observed that the collection of DNA is an important tool in the prevention
and investigation of crime and in curbing terrorism.
393. Regarding the contention that the impugned amendments seek to unnecessarily obtain personal information of
Kenyan citizens and residents, and that the said information is not secure, Mr. Kimotho stated that information of a
similar nature has been in the custody of the 4th Respondent in the exercise of its statutory functions. Furthermore,
that this information is currently held in a “protected system” within the meaning of the Kenya Information and
Communications Act and Computer Misuse and Cybercrimes Act and that the said Acts provide for penalties for
offences involving protected computer systems.
394. It was his deposition further that NIIMS is operationalized under the Act and the information captured and
stored therein therefore enjoys the protection of the provisions of sections 14 (1) (k), (l) & (m) of the Act which
provided for penalties for unauthorized disclosure of the information. Moreover, that pursuant to sections 83G, 83H
and 83I of the Kenya Information and Communications Act, personal information collected and held in the custody
of the 4th Respondent is stored in electronic form. Mr. Kimotho cited various provisions of the Kenya Information
and Communications Act and other instruments that safeguard the security and integrity of electronic records. He
also deposed that adequate and effective administrative procedures, guidelines, custom and practices exist in the
public service with respect to management of information held by government that guarantee security and integrity
of that information. According to Mr. Kimotho, there has been no report of any compromise in the security of the
digital records held by the 4th Respondent.
395. Mr. Kimotho denied the averments by the Petitioners that the data collection in NIIMS would be undertaken
by a foreign corporation. It was his averment that on the contrary, it is only the biometric registration gadgets that
were procured from a foreign firm as no Kenyan firm has the capacity to manufacture such gadgets. He averred that
NIIMS was developed by the government of Kenya through the mandated Ministries, Departments and Agencies,
and is therefore the intellectual property of the government. He asserted that the Petitioners had failed to
demonstrate the inadequacy of the existing safeguards that protect personal information, and the manner in which
the amendments to the Act violate the right to privacy.
396. On the concern raised by the Petitioners regarding vetting committees in the issuance of identity documents,
Mr. Kimotho deposed that vetting is not a discriminatory process. Rather, it is an objective and verifiable process
aimed at establishing the authenticity of a person’s claim to Kenyan citizenship. Further, that vetting committees

are established pursuant to the provisions of section 8 of the Act that give the 4th Respondent and its Director the
power to demand proof of information and to establish identification committees or appoint persons as
identification agents to assist in the authentication of information furnished by applicants and their parents or
guardians. He explained that vetting committees are set up in respect of members of communities situate and
present in Kenya, and also situate and present in other neighboring countries, because such border communities
share physical features, culture and language with other communities outside the territory of Kenya.
397. While confirming that the vetting committees comprise various government officials, security agents and
elders representing all communities in that locality, it was his averment that the vetting committees ensure
inclusion of all communities, including Nubians. Mr. Kimotho averred that the guidelines on vetting set out the
procedures and parameters to be considered to ensure that there is no discrimination. He was of the view that the
principle of equality and non-discrimination permits the different treatment of people similarly placed if such
treatment is meant to achieve a rational and legitimate purpose. Further, that the purpose of vetting is to ensure that
only those with a legitimate claim to Kenyan citizenship are registered by the 4th Respondent, and the justification
for the vetting of border communities is to address the influx into the country of the communities’ counterparts
from the neighbouring countries.
398. The 7th Respondent on its part stated in its Grounds of Opposition that the consolidated petitions were filed
inordinately late since the impugned amendments were enacted in November, 2018. Its view was that if the orders
sought are granted, they would occasion irredeemable and irreparable loss and damage to the State and to the
citizens of Kenya who are in the process of implementing various provisions of the laws amended pursuant to the
Statute Laws (Miscellaneous Amendment) Act No. 18 of 2018. Further, that the orders sought in the Petitions are
contrary to public interest and the constitutional values of the doctrine of separation of powers as the legislative
function is vested exclusively in Parliament and the Petitions request the court to substitute its views for those of
Parliament. Lastly, that there is a general presumption of law that statutes enacted by Parliament are constitutional
and the burden falls on the person who alleges otherwise to rebut this presumption, which burden has not been
discharged.
The 5th Respondent’s Case
399. The 5th Respondent is the Cabinet Secretary in the Ministry of Information, Communications and Technology
(ICT), a public office established under the Constitution in the Executive arm of government. He is responsible for
formulating, administering, managing and developing the government’s information, broadcasting and
communication policy, and is also the custodian of digital data collected and stored on behalf of the government.
400. The 5th Respondent filed a Replying Affidavit sworn on 26th February, 2019 by Jerome Ochieng, one of the
two Principal Secretaries in the Ministry of ICT, who heads the State Department of ICT, Mr. Ochieng also swore
several further affidavits on 26th April 2019 in response to affidavits and witness statements filed by the Petitioners
and the 4th and 6th Interested Parties. The 5th Respondent also relied on the opinions of various experts, namely
Brian Gichana Omwenga, Muchemi Wambugu Edward and Mr. Loyford Muriithi, who all filed affidavits sworn on
14th May, 2019.
401. Mr. Jerome Ochieng gave a detailed background on the developments of the ICT sector in Kenya, including
the initiatives at harmonisation of the population register, digitisation of data, and the development of policies and
legislative frameworks. Some of the milestones he identified were the enactment of the Kenya Information and
Communications Act in 1998 which has been variously amended thereafter, and the formation of an Inter-
Ministerial Task Force on the creation of the Integration of Population Register System in September 2005.
402. Specifically with respect to NIIMS, Mr. Ochieng stated that in December, 2017, his Ministry, in partnership
with the United Nations International Children’s Emergency Fund (UNICEF) conducted a study on the Strengths,

Weaknesses, Opportunities and Threats Analysis of the Existing Identification and Registration Systems in
Kenya, which recommended the need for a ‘single source of truth’ for citizen data. He averred that in furtherance
of the mandate of the Ministry as described in Executive Order No. 1 of June 2018, a Cabinet Memorandum on the
establishment of NIIMS was subsequently issued on 10th April, 2018. Under the said Cabinet Memorandum, the
Ministry was charged with spearheading implementation of the NIIIMS in collaboration with the Ministry of
Interior and Coordination of National Government, and with operating the NIIMS infrastructure including the
development of the necessary system design, integration structures, product identification and deployment.
403. To aid and facilitate this exercise, the Registration of Persons Act was amended by the Statute Law
(Miscellaneous Amendments) Act No. 18 of 2018 to establish NIIMS. According to Mr. Ochieng, NIIMS is
intended to be the primary database and “single source of truth” for personal data and will link and harmonise all
the existing databases of personal information collected by different government agencies under different laws.
404. Mr. Ochieng asserted that his Ministry spearheaded the development of the software aspects of NIIMS with
the input of other government agencies. He denied the contention by the Petitioners that private entities,
particularly IDEMIA Saffron, was involved in the development of the software for NIIMS. Mr. Ochieng confirmed
that the NIIMS kits were inspected for any data mining software to completely eliminate the possibility of external
access, data mining or even data manipulation by IDEMIA Saffron or any other unauthorized entity.
405. It was Mr. Ochieng’s deposition that NIIMS ensures the security of the nation from external and internal
attacks since all persons in the country will be issued with relevant identifiers, including a unique number identifier
from birth. He gave instances of the shortcomings of the current systems of registration, including those of access
to documents and access to the registration systems themselves. He stated that NIIMS will reduce the duplication of
processes common in accessing government services since it serves as a one-stop shop for identification
information.
406. On the use of biometric data in NIIMS, Mr. Ochieng deponed that DNA as a unique identifier was not part of
the personal information collected by the data capture form in use. He noted, however, that it plays a central role in
the identification of individuals and is the only known means of posthumous identification in some instances. That
notwithstanding, it was his averment that DNA, GPS coordinates, retina and iris patterns and earlobe geometry
were not introduced by the impugned amendments. He averred that they were already provided for under section
5(1)(j) of the Act where it is provided that the Principal Registrar shall be required to keep “such other particulars
as may be prescribed”.
407. Mr. Ochieng denied the allegations by the Petitioners that GPS targets an individual’s communication and
exact whereabouts. He reiterated, like the other Respondents, that GPS is merely a precise geographical location,
whose utility is to facilitate ease of digital identification of an individual’s place of residence and physical delivery
of services to citizens by the government. He also echoed the other Respondents in asserting that GPS co-ordinates
were not being collected by the NIIMS data capture tool. Accordingly, he averred that the alleged fears regarding
the misuse of DNA and GPS coordinates is speculative, presumptuous, unjustified and misleading. It was his
averment, however, that there will not be surveillance beyond the geographical location of residence.
408. Mr. Ochieng further deponed that there is an extensive existing legislative framework on the protection of
privacy, personal information and integrity of ICT systems. He cited various provisions of the Access to
Information Act 2016, the Kenya Information and Communications Act, and the Computer Misuse and Cyber
Crimes Act, 2018 in support of this averment. Further, that there exists sufficient safeguards in respect of the
security and integrity of information held by NIIMS in the said Acts, and in the Kenya Information and
Communications (Consumer Protection) Regulations 2010. Mr. Ochieng explained that the country has a data
protection policy which informed the development of the NIIMS software, and which has been reduced into a Data
Protection Bill. Accordingly, that it is misleading for the Petitioners to allege that the exchange of data between

agencies will expose them to intrusion.
409. Mr. Ochieng further contended that NIIMS is unlikely to face the shortcomings of the Ghana Card and India’s
Aadhaar system given that the government has drawn vital lessons from some of the few errors made by the two
systems. Furthermore, reports indicate that India and Ghana faced challenges in the implementation of their
integrated information systems due to the fact that the registration exercises were carried out by private entities
which created multiple data entries for financial gain. Further, NIIMS differs from Ghana’s Card and India’s
Aadhaar system since the data capture software has been developed by the government, taking into consideration
the country’s unique needs and aspirations. As such, it was of paramount importance that the government migrates
to a single integrated database despite fears of technological failure which are in any case speculative and remote.
410. He further averred that in dealing with some of the challenges associated with developing new systems, the
government organised several benchmarking trips to countries with similar systems, including Netherlands,
Estonia, Malaysia, and the Philippines. Moreover, substantial public finances have been expended towards the
deployment of NIIMS, and the orders sought by the Petitioners would run afoul of the principles of public finance
enshrined in the Constitution. Mr. Ochieng averred that it would be unreasonable to establish and implement a
system without learning from systems around the world and the NIIMS system has been hinged on extensive
research on systems around the world.
411. It was his averment that globally, data is under constant and continuous threats of breach from criminal
elements who seek to access and misuse it but, to mitigate this risk, there’s always a permanent surveillance,
protection, update and upgrade of systems. He further averred that in establishing the NIIMS system, the State
seeks to secure protection of national security, prevention and investigation of crime, especially in view of
increasing terrorist attacks in Kenya and heightened public safety concerns and provision and delivery of national
services. Moreover, with present global trends in development, it is impossible to avoid digitization of information,
even personal information, but the crux of the matter is in securing the data.
412. Mr. Ochieng averred that in any event, the registration was voluntary and all religious rights and beliefs were
waived by those who profess them for the purposes of registration upon them weighing and finding that the system
was satisfactory. He asserted that the Kenyan State will ensure that biometrics are only deployed when necessary
and appropriate, and it is alive to its international obligations to respect human rights when collecting, processing,
storing and sharing biometric information.
413. It was his position further that there are various security levels applied to protect data collected by the
government to ward off any invader since the data is encrypted and access is restricted using highly sophisticated
mechanisms that are almost impenetrable. According to Mr. Ochieng, the system’s securities are designed to be in
line with the international best practices guaranteeing confidentiality and integrity of data stored, and the system
has undergone sufficient tests and trials and has shown itself to be resilient to attacks.
414. Mr. Ochieng averred that the Indian system was contaminated during the process of data collection. He
disagreed with the 1st Petitioner’s expert witness, Mr. Anand, asserting that it was not scientifically or
academically sound or appropriate for the witness to quote his works and newspaper articles as authority on the
propriety of the system he sought to criticize. The witness was also not, in his view, adequately grounded to swear
on the facts of the system resources and infrastructure manned by the 5th Respondent for the protection of data. He
noted that the company that Mr. Anand works for was one among many companies that could make suggestions on
appropriate best practices and the 5th Respondent was not bound to take its suggestion.
415. Mr. Ochieng maintained, from his knowledge as an IT specialist, that the system is secure, not susceptible to
breaches by malicious actors or abuse by public authorities, and undergoes constant surveillance, upgrades and
updates by a competent team of men and women. Accordingly, the recent Marriott or Quora breach and India’s

Aadhaar’s system cited by the Petitioners’’ witnesses are distinguishable from the system employed under NIIMS
because their breaches are attributable to the operational mistakes where the persons collecting data were paid
according to the volumes of people they registered, thereby placing data collection in the hands of commercial
businessmen.
416. He therefore took the position that the allegations in the Petitions were unfounded, the Petitions lack merit and
ought to be dismissed with costs.
417. Mr. Jerome Ochieng was cross examined on his affidavits by Mr. Waikwa and Mr. Awele, the respective
Counsel for the 1st and 2nd Petitioners. He was questioned about his qualifications by Mr. Waikwa, which he
highlighted as a Master’s Degree in Information Engineering, a Bachelor’s Degree in Maths and Computers, a
Diploma in Management Information Systems and various professional courses on ICT. He also detailed his
employment in government in various ministries and departments, including the ICT department. He confirmed
that his understanding of NIIMS arises from his work and expertise, and also as a member of the Inter-ministerial
Committee on NIIMS.
418. On the preparations and development of NIIMS, Mr. Ochieng stated that the discussions on NIIMS started in
January 2018, and he referred to a copy of his letter dated 10th May 2018 inviting the technical committee on
NIIMS to a meeting. He, however, clarified that the technical development of NIIMS commenced in February 2019
even though the preparations had started much earlier. He testified that the software for NIIMS was developed by
Kenyans, and stated that tests had been dome on algorithms to ensure they work, and on the system to verify its
security and integrity, and ensure that there is no deduplication of data. He also explained that the data collected
from NIIMS was currently not being utilized, in compliance with the orders of this Court, but that they had
developed and tested the algorithms needed to utilize the data.
419. Mr. Ochieng confirmed that he knew of a company known as IDEMIA. He testified that the Ministry of
Interior procured 31,000 registration kits in late 2018 from OT Morpho, which is now known as IDEMIA. He
stated that the government cleaned the said kits in April 2019 before the start of the Huduma Namba registration
exercise. However, that apart from procuring the kits from OT Morpho, the government did not engage the
company in any other way in NIIMS.
420. Mr. Ochieng explained his understanding of the Huduma Namba and stated that it is a single source of truth, a
place where one can find credible identification information about a person who seeks government services.
According to Mr. Ochieng, the more data you have, the more credible the information on identity, hence his
analogy of data to the new oil. On the SWOT report he annexed, Mr. Ochieng testified that if Kenya was to achieve
a universal birth registration system that allocates a unique identifier to each child when it is born, then it would
assist in personal identification. He denied that NIIMS overlaps this objective and stated that part of the motivation
for NIIMS was from the SWOT report. He also testified that there was public participation in the development of
NIIMS, and denied that it was only government and UNICEF officials who were involved in preparing the SWOT
report.
421. Mr. Ochieng confirmed that the Data Protection Policy was approved by Parliament in 2019 and denied that it
was prepared to frustrate the instant Petitions. He stated that there is no NIIMS policy in existence. He agreed with
the objectives and benefits of NIIMS stated in Eng. Kibicho’s affidavit and testified that NIIMS seeks to achieve
inter-linkages and harmonization of different databases to address the challenges faced in identification. He
disagreed that a longer time ought to have been taken to develop NIIMS, and stated that there is no time to consider
alternatives due to the urgency for credible identification data.
422. When questioned by Mr. Waikwa on the law that regulates NIIMS, Mr. Ochieng responded that it is the
Registration of Persons Act and that other than an executive Order on NIIMS, there are no rules on NIIMS. He also

testified that delivery of services is not one of the purposes of NIIMS, and that there is no law that establishes the
Huduma Namba. He explained that the term Huduma Namba is a communication concept for Kenyans to
understand the nature of NIIMS as an integrated identity system, and denied that it was used to engage in a
deception campaign and coerce Kenyans to register in NIIMS. He further testified that he was not aware of any law
that regulates Article 31(c) of the Constitution, or creates the office of a Data Protection Commissioner or data
controllers and processors.
423. Mr. Ochieng accepted that an identity card is required for registration for a Huduma Namba but denied that a
Kenyan without an identity card would be filtered by the NIIMS system as a non-citizen. On the verification
processes by NIIMS and the logs to the system by other government agencies, he stated that it would be possible to
tell where the interactions with the system occurred, and that the Access to Information Act regulates access to
such metadata.
424. Mr. Waikwa concluded his cross-examination with questions on the NIIMS system design. The response from
Mr. Ochieng was that NIIMS is a hybrid system that has interaction between a master database and functional
databases. Further, that there will be no inter-linkages between the functional databases. He disagreed that the way
of dealing with data breaches is to have a decentralised system or by minimization of data, but rather to have
enough data and secure it. He however admitted that the design of NIIMS can still be technically changed.
425. On cross-examination by Mr. Awele, Mr. Ochieng testified that the existing registration databases are in the
National Registration Bureau, the Immigration Department for passports and the Civil Registration Department. He
stated that NIIMS introduces biometrical digital data because of the uniqueness of biometrics. He reiterated that the
development of the NIIMS software was not an event but a process that started in 2018, before the enabling law
was enacted.
426. Mr. Ochieng was cross-examined on the design and security of NIIMS, and stated that architecturally and
technically, NIIMS has several layers. These are the data layer, the application system and the users layer, which all
use encryption and are therefore adequately secured. Mr. Ochieng also stated that the report by Mr. Omwenga on
Government Wide Enterprise Architecture was used as a guideline in the development of NIIMS and has not
been formally adopted by the government. He admitted that the security policies of NIIMS have not been
published, as this would compromise the system, and also that the public was not informed on the risks but only the
benefits of NIIMS. Mr. Ochieng further stated that the Data Protection Policy guidelines as well as internal
ministerial guidelines regulate the interoperability mechanisms and misuse of the data. He confirmed that the
government had undertaken a Data Protection Impact Assessment of NIIMS whose report was not made public,
and that an audit of the system is possible under the Access to Information Act.
427. During re-examination, Mr. Ochieng reiterated his evidence as to the nature of NIIMS and its benefits, its
design, and the protection and security safeguards that are in place to protect the data collected by the system.
428. Mr. Brian Gichana Omwenga, the 5th Respondent’s expert witness, deponed that he is a software and systems
engineer and an Information Technology Consultant, holding a Master’s Degree in Engineering Systems,
Technology and Policy from the Massachusetts Institute of Technology (MIT), and is a Ph.D. Candidate in
Computer Science. He also stated that he is a lecturer in Computer Science at the University of Nairobi and is the
founding chairman of the Tech Innovators SACCO Ltd, an initiative that seeks to consolidate the Kenyan
technology community through an empowered cooperative movement for the support of digital entrepreneurship.
Further, that he is also the Chairman of the Industry Technical Committee that sets software and systems
engineering standards at the Kenya Bureau of Standards (KEBS), and has previously worked in various capacities
for Microsoft PLC, Nokia Research Africa, PricewaterhouseCoopers Kenya and Nokia Research Cambridge in
Massachusetts, USA. Mr. Omwenga also averred that he has carried out various consulting assignments that have
received several awards and global recognition and his research work has resulted in various published papers and

over ten (10) patents filed at the United States Patent and Trademark Office.
429. Mr. Omwenga averred that in 2017, he undertook research and authored a report titled ‘Government Wide
Enterprise Architecture’, which seeks synergies and efficiencies through combining common shared technical
business services across government agencies and guides the journey of government’s digital transformation.
Further, that this reduces costs by eliminating duplication of roles and efforts and promotes greater depth and
expertise through the creation of centers of excellence for such shared business services. That subsequently, he was
part of a team that carried out a feasibility study of the Government Enterprise Architecture and recommended
various flagship projects including the unified unique digital identity project which was contained in a report titled
‘Digital Government Transformation Project.’
430. Mr. Omwenga averred that identity, in relation to access and security, utilizes three common modes of
authentication being something you know (such as a password), something you have (such as an access card) and
something you are (such as biometrics) and any or all of the said three authentication modes may be incorporated in
identity systems. However, the most robust factor of authentication and identification is based on something you
are, that is, biometrics. It was also his averment that identity systems entail the maintenance of population registers
which contain selected personal information (including biometrics) pertaining to each member of the resident
population of a country in such a way as to provide the possibility of determining the identity of individual
members comprising the population, the size of the population and the characteristics of such population.
431. Mr. Omwenga contended that the said population registers may either be centralized, decentralized or a
combination of both, and could also be manual or electronic. He noted that the United Nations Principles and
Recommendations for a Vital Statistics System provides that a population register need not take a specific form
and states have unfettered discretion regarding the choice of the form, and the content of their respective population
registers. It was his deposition that the rationale for this unfettered discretion is logically informed by the need to
allow states to customize their respective population registers to suit their unique circumstances, which discretion
enjoys adequate expression in international law. He cited Article 86 of the European Union General Data
Protection Regulation 2016/679 (GDPR) which gives Member States the discretion to determine the specific
conditions for the processing of a national identification number or any other identifier of general application.
432. In his view, capturing the value of good digital identity is by no means certain or automatic. Careful system
design and well-considered government policies are required to promote uptake, mitigate risks like those associated
with large-scale capture of personal data or systematic exclusion, and guard against the challenges of digital
identity as a potential dual use technology. He stated that preconditions for digital identity include a minimal level
of digital infrastructure, sufficient trust in the identity provider, and a policy landscape that provides safeguards to
individuals. That in determining the content and the form of a population register, States take various factors into
account including universality, accuracy and reliability, ease of operationalization, cost and security. Consequently,
the form of an identity system that a State may opt to adopt may be a centralized identity system or a decentralized
identity system or a combination of both.
433. It was his averment that a centralized identity system entails the maintenance of personal identity information
of a country’s population in one database (national master population register), whereas decentralized identity
system entails the distribution of respective personal identity information in identity cards which are then issued to
individuals. That a comparative analysis of the pros and cons of a centralized and decentralized identity system
would weigh in favour of a centralized identity system for several reasons. First, that from a data security
perspective, decentralized biometric identity systems are more susceptible to personal identity theft than centralized
ones. He observed that a fake set of biometric features may easily be cast on a lost or stolen electronic identity card
which is then used to facilitate identity theft.
434. Secondly, that from a cost perspective, it would be illogical and ineffective use of limited resources to

facilitate the security of personal information stored in each electronic identity card issued to each individual
citizen and registered foreign individuals resident in a country in question. He averred that centralization of identity
data facilitates optimum allocation of resources by ensuring that a fraction of the limited resources are devoted to
the sole security of a single database as opposed to millions of databases. Thirdly, that in any case, a decentralized
biometric identity system would not dispense with biometric parameters such as fingerprints.
435. Mr. Omwenga further averred that NIIMS is neither entirely centralized nor entirely decentralized. This was
because, first, the operationalization component of NIIMS is centralized in the sense that respective identities of
individuals would have to be authenticated from one system as opposed to the current system where fragmented
personal identities are respectively held in separate functional databases variously maintained by governmental
ministries, departments and agencies (MDAs). Secondly, that NIIMS is decentralized to the extent that registrants
will be issued with a card containing limited personal identity information such as unique identification number as
opposed to biometric identity information hence the risk of identity theft attributable to decentralized systems is
obviated. It was his averment therefore that a more accurate description of NIIMS would be an integrated identity
system in which what is integrated is the identity data as opposed to functional databases variously maintained by
MDAs. Accordingly, it is possible to maintain one population register in a number of digital copies at virtually
minimal marginal costs and in the unlikely event of a breach on a copy of a digital population register, the other
copies will remain unaffected.
436. Regarding the contents of population registers, Mr. Omwenga observed that it is impossible for individuals to
prove their identities without providing sufficient personal information which include selected biometric and
biographical information. That in deciding on the content of a population register, States are enjoined to balance
two competing interests- the States’ legitimate interest in maintaining a vital identity mechanism (based on
biometrics) against the equally important interest in respecting the individuals’ right to privacy. In his view, based
on his knowledge and expertise, the processing of biometric data for purposes of establishment and
operationalization of identity systems is not only justifiable under contemporary international law but is also a trite
practice, world over.
437. It was his deposition that fingerprint matching has been used to identify individuals for thousands of years and
across cultures. He further averred that an identity system that solely relies on the matching (deduplication) of one
biometric feature is probabilistic as opposed to deterministic. However, combined with the matching of other
biometric features and biographical data points (such as date of birth, facial image, parentage information, birth
certificate, amongst others), it results in a multimodal identity system that is deterministic.
438. According to Mr. Omwenga, the probabilistic nature of individual biometric features justify the need for the
requirement of multiple biometrics such as retina and iris patterns, hand geometry, earlobe geometry, voice waves
and DNA in identity legislations, policies and systems. That the probabilistic nature of fingerprint matching
(deduplication) is attributable to the fact that perfect matching of all data points in a fingerprint is not necessarily
possible owing to extraneous factors. To increase the probability of a perfect fingerprint match, deduplication
software is architecturally and functionally designed to keep templates of fingerprints of all available fingers of an
individual. In his view, the NIIMS deduplication software is also designed as such. Accordingly, where a
fingerprint is distorted, NIIMS would ideally have nine more sets of fingerprints with which to extract templates
and run a match. In the unlikely event that all the fingerprints are distorted, or where an individual has none, the
individual in question would not be disenfranchised in any way whatsoever because during the design of NIIMS,
the probabilistic nature of fingerprint matching and the associated misgivings were anticipated and have been
addressed by NIIMS in three ways.
439. He enumerated these as, first, for purposes of enrolment, in its current implementation design, NIIMS requires
certain minimum data points from a potential registrant. These include the date of birth, parentage information,
residence information, current national identification number for adult citizens, birth certificate in respect of

children, and alien card number in respect of registered foreigners resident in Kenya, as well as facial image and
fingerprints of all available fingers. Secondly, since some registrants may have distorted fingerprints, NIIMs has
fingerprint-extraction software programmed to repair distorted fingerprints prior to either templatization or
matching. Thirdly, where repair is impossible or where fingerprints are unavailable, other data points would,
collectively, be used for purposes of uniquely identifying the affected individuals. He therefore deposed that no
individual will be denied a Huduma Namba on account of either lack of, or distorted, fingerprints.
440. Mr. Omwenga expressed the opinion that the enrolment rejection of a genuine individual trying to enrol is a
definite impossibility. In his view, associating NIIMS with India’s Aadhaar is inaccurate based on the fact that the
analysis by Mr. Anand and the conclusions derived therefrom were made on the unfounded assumption that NIIMS
is architecturally and functionally similar to Aadhaar. Further, Aadhaar, as was described by Mr. Anand, is a
singular identity system which relies, solely, on fingerprint matching. He noted that the analysis by Mr. Anand does
not disclose whether there were corrective measures in place to remedy the alleged high rates of false rejections and
false acceptance. Conversely, NIIMS is a multimodal identity system that relies on both biometric and biographical
matching. Therefore, whereas Aadhaar is probabilistic, NIIMS is deterministic. He further averred that the said
analysis disregards the inherent difference in both context and population demographics between India and Kenya,
and neither does it take into account the operationalization difference between the implementation of NIIMS and
the implementation of Aadhaar, that is while Aadhaar was commercialized, NIIMS was not.
441. According to Mr. Omwenga, ideally, multimodal identity systems such as NIIMS comprise several functional
programmes that are variously derived from different source codes. However, the sensitive components of identity
systems such as the various deduplication algorithms, encryption and decryption programmes, security
programmes, amongst others, ought to be derived from closed source software as opposed to open source software
regardless of the cost implication, for several reasons. First, sensitive programmes that run on open source software
are vulnerable to cyber-attacks.
442. Secondly, open source software rides on the presumed goodwill of the coding community which assumption is
flawed since open source software attracts all and sundry, including persons with malicious intent. A third reason is
that closed source software fosters accountability unlike open source software which does not inspire accountability
for the simple reason that the general public is a non-entity. Lastly, whereas the innovation cost of the open source
software is borne by the general coding community, the costs attributable to additional services, assistance or added
functionality are non-transferable and open source software is therefore not entirely free.
443. Mr. Omwenga further averred that NIIMS will only maintain a national master population register in
electronic form, the NIIMS database and the type of personal information that will be kept in the said national
master population register is expressly stipulated in the NIIMS digital data capture form and will be kept as
encrypted templates. Therefore, without the requisite decryption key, a third party will not be able to unmask any
encrypted personal information. That even if one was able to gain unauthorized access to the NIIMS database and
unmask the personal information kept therein, it would be of insignificant commercial value. In his view, however,
even if the purported ‘massive’ costs of data breaches were to be internalized, NIIMS would still pass a cost-
benefit analysis.
444. With regard to the contents of Dr. Thomas Fisher’s affidavit, Mr. Omwenga observed that four (4) of the
exhibits therein are authored by Privacy International which is not a party to these proceedings, and no evidence
has been tendered to show whether the said documents have, at the very least, been peer-reviewed. Further, that the
exhibit on the United Nations Principles and Recommendations for a Vital Statistics System is inapplicable to
the issues of content, procedures, responsibilities and rights of data subjects, and the pros and cons of a national
master population register. He observed that the World Bank Group has expressly disclaimed the findings,
interpretations and conclusions expressed in the exhibit on “Privacy Design: Current Practices in Estonia, India
and Austria” at the first page of the said document. It was therefore his averment that the said documents are

devoid of probative value and any averments founded thereupon do not, as a matter of logic, rise to the status of
independent expert opinion.
445. The Petitioners’ cross-examined Dr. Omwenga on his affidavit. During cross-examination by Counsel for the
1st Petitioner, Dr. Omwenga testified he was giving evidence as an expert for the government, for which he has
done consultancies, but did not have a current contract with. He stated that his last contract with the government
was in 2016 and 2017 when he undertook action research for the Government-wide Enterprise Architecture. It was
his evidence that he had testified before as an expert in a number of cases by way of affidavit evidence for
individuals but not for the government.
446. Mr. Omwenga testified that the 5th Respondent sought his expert advice, but that he had not tendered evidence
of the technical specification of NIIMS. It was his testimony that he is well published but had not submitted any
paper on NIIMS, and was not involved in building the technical aspects of NIIMS. He admitted that he knew of the
existence of the Registration of Persons Act but was not conversant with its legal aspects. He further acknowledged
not knowing who the administrator of NIIMs is.
447. Mr. Omwenga was shown Engineer Kibicho’s affidavit sworn on 26th February 2019, and testified that he was
in agreement with the fact that NIIMS will be a “single source of truth” on a person’s identity. He maintained that
from his experience and knowledge, NIIMS is neither a centralised nor decentralised system, and when asked about
the nature of cards with biometric chips, he stated that they are decentralised as they are given to different
individuals, and are not in a central database. He also stated that a central database would be multi-modal, and that
for deduplication of the data in NIIMS, a set of algorithms will be needed to clean the data. He stated that a
software engineer who has the capability and technology can develop algorithms, and gave his experiences
developing algorithms in Kenya’s 2017 elections. He further stated that there were many actors involved in
developing the electoral system, and that OT Morpho was just one of many.
448. Dr. Omwenga testified that he is familiar with data protection policies, the concept of data minimization, and
the concept of thresholds in both deterministic and probabilistic systems. In his view, data minimization is not only
about counting data points but also about the quality of data being collected. Further, that more data collected about
a person does not risk the subject’s privacy, and collection of more data and the combining of biometric and
demographic data is one of the ways of solving the problem of deterministic identity systems.
449. Dr. Omwenga stated that he had enrolled for the Huduma Namba using his identity card in order to be able to
get government services. He, however, could not tell if he could have registered for it if he did not have his identity
card. He conceded that though he had testified as a government expert, he had not tendered any evidence on the
design and architecture of NIIMS. He maintained, however, that the more information NIIMS had the more
accurate it would be, and DNA could be included as a means of identification.
450. Mr. Omwenga stated that he was not aware of the system being used to collect DNA currently. He however
stated that NIIMS is deterministic and if one does not enrol to the system, one would not get a unique number. He
did not, however, know if the system would require all documents such as the identity card and birth certificate in
order for one to get a unique number.
451. In cross-examination by Mr. Awele, Counsel for the 2nd Petitioner, Mr. Omwenga stated that he had interacted
with data protection several times in relation to data security in storage and in transactions, and he understood why
it was important to protect data. He illustrated the importance of data protection and ownership of data by citing the
work he had done on data protection and privacy for the Ministry of Health in the government enterprise
architecture where it was clear that patients were still the owners of the data.
452. It was Mr. Omwenga’s evidence that the consolidated Petitions raise legitimate concerns on security of the

system, accuracy of NIIMS and misuse of data. He could not, however, confidently explain what NIIMS was since
he was only involved in giving advice at the initial stage. His evidence was that it was the client, the Ministry of
ICT, that was involved with designing NIIMS.
453. With respect to biometric registers, it was his evidence that he was only aware that the existing databases were
only collecting fingerprints. He stated that he did not know the legal framework on NIIMS but he knew that some
law brought it into existence. It was his testimony that the security, privacy and misuse concerns on NIIMS could
be addressed if the recommendations he had already given to the government were used. His recommendation
entailed the use of a unique identifier on government enterprise architecture, security architecture and predefined
security policies.
454. It was also his view that security systems should be predefined in some policy document, noting that some of
the personal information to be collected by NIIMS is sensitive. He observed, however that not all information may
require the same level of security and protection. It was his deposition that the implementation plans need to be
kept secure to make the system secure, and the security process should be predefined so that data is not misused
and someone who is not authorized does not access the data.
455. With regard to the issue of encryption of data, his evidence was that he did not know the encryption standard
the government employed for the data collected in NIIMS. He further stated that if the government were to
predefine its encryption standard for data it collects in NIIMS, it would address the Petitioners’ concerns.
456. On re-examination by Dr. Nyaundi, and Mr. Njoroge Regeru, Mr. Omwenga emphasized that his role was
advisory and that his report was not a NIIMS report, but made recommendations to be taken into consideration in
the design of NIIMS. He reiterated his evidence on centralized and decentralised identity systems, and that
centralized systems offer more protection to data. Further, that NIIMS is both an identity and identification system
as the accuracy of its data on identity is what will aid in identification. Mr. Omwenga stated that NIIMS will have
various identity attributes in a multi-modal way, and will be more deterministic than probabilistic. In conclusion, he
stated that there is competence in our local professionals to design a system such as NIIMS, and denied that it is an
archaic system.
457. The 5th Respondent’s second expert witness, Muchemi Wambugu set out in his affidavit extensive details of
his qualifications and experience. Of importance for present purposes is that he is a Management Consultant and
founder of Sirius Consult which focuses on technology-led organizational transformations. Until 2016,he was a
Partner in Technology Consulting Practice and the Advisory Leader for County Initiatives at Price Waterhouse
Coopers, Kenya. He had also worked at Deloitte Consulting Ltd in Kenya and IBM Global Services in California,
USA. He is therefore an accomplished ICT Management professional with more than 20 years of experience in
advising both public and private organizations on business-centric ICT solutions, has extensive experience in
global technology implementations, ICT transformation, strategy, operations, governance and programme and
change management.
458. Mr. Muchemi averred that he undertook research and authored a report titled the Strengths, Weaknesses,
Opportunities and Threats Analysis of the Existing Identification and Registration Systems in Kenya, 2017
and had discovered several weaknesses regarding Kenya’s identity systems. These were a lack of data
harmonization; use of birth certificates numbers that do not uniquely identify individuals; duplication of data
collection by government agencies; fragmented and uncoordinated registration and vital systems; untrusted
relationship between the birth registration and the ID registration process; gathering of data in disparate and
disjointed silos; systemic data corruption, data integrity and data quality issues. He had recommended in the said
Report, among other things, addressing the gap in the data sharing protocols between government agencies,
executing the government systems enterprise to allow for data access, security and governance in dealing with vital
national data and the use of block chain to enhance data security.

459. It was also his averment that NIIMS was modeled from the Estonian identity system in so far as both systems
respectively keep a centralized national master population register in digital form, and decentralized functional
databases that are linked to the said national master population register. However, whereas the Estonian identity
system utilizes PIN-codes that are embedded in electronic identity cards for purposes of authenticating identities of
individuals, NIIMS utilizes unique identification numbers. Further, that electronic identity cards work for Estonia
because Estonia is a homogenous country with a significantly lower population and an advanced e-government
infrastructure. Kenya, on the other hand, is a heterogeneous society that experiences significant exposures from
migration from troubled neighboring countries which, in some cases, have no control over terrorism and its effects
on their neighbors. Therefore, a more robust identity system that suits the peculiar circumstances of Kenya is
justifiable.
460. Mr. Muchemi further observed that fingerprint matching, in itself, is probabilistic as opposed to deterministic
and no sole biometric identity matching is deterministic. However, an amalgamation of matching of various
biometrics and biographical information results in a multimodal system that is deterministic. In his view, the
operational and architectural design of NIIMS addresses the probabilistic nature of fingerprint deduplication in a
number of ways. The first is that samples of fingerprints are extracted from all available fingers of an individual
during data collection and each finger has an individual unique print character. Therefore, if one or two fingers fail,
the other fingers can positively identify an individual.
461. Secondly, where an individual does not have fingers or in the unlikely event that all the fingerprints of an
individual cannot be captured, other identity modes including facial image, date of birth, residence and parentage
information would, collectively, be used to uniquely identify such individuals. This, in itself, increases the
probability of perfect fingerprint matching. In his view, it is the amalgamation of the various probabilistic identity
elements that make NIIMS deterministic.
462. It was his averment further that distortion of all fingerprints during an individual’s lifetime on account of
ageing, mutation or participation in manual labour is a rare occurrence because it is highly unlikely that one would
come into contact with mutation-inducing radioactive materials in their lifetime. Secondly, manual labour is
unlikely to cause distortion of all fingerprints of an individual’s non-dominant hand. Further, that it is common
scientific knowledge that human skin cells have a lifespan of a couple of months and are constantly replenished. In
his view therefore, ageing does not distort an individual’s fingerprints.
463. Mr. Muchemi deposed that during registration in multimodal identity system, biometric information and
biographical information of an individual are captured, templatized and stored in a national master population
register. Secondly, before one is enrolled and thereafter issued with a unique identifier, his biometrics and
biographical information is matched against the templates of individuals already registered in the aforesaid national
master population register. Consequently, capturing a registrant’s identity information and matching it against
every other registrant’s who has previously enrolled ensures that each person gets a single - one and only one -
unique number and this verification procedure is impossible to attain in a non-digital system. Therefore Huduma
Namba is a composite number that amalgamates the myriad of numbers that an individual citizen has from cradle to
grave and will serve as a unique identifier to every citizen and registered foreign national resident in Kenya.
464. Mr. Muchemi further averred that inclusion of children in a national master population register is justified by
the need for the government to offer service delivery more efficiently without prejudice to any section of its
citizenry. He averred that infant biometric identification is now possible owing to technological advancement such
as non-contact optical scanning technology that can uniquely identify infants at birth by imaging fingers and the
palm of the hand. However, if for whatever reason, infant biometrics are unreliable, infants would still be
sufficiently identified by connecting them to their parents who are themselves uniquely identifiable by their
respective biometrics. It was his averment that for the purposes of resource allocation by government as well as
accounting for all citizens for the purposes of service delivery, it is imperative to connect children to their parents.

In his view, NIIMS could also help in the elimination of trafficking in children and child labour as well as help
enforce laws against child marriage.
465. It was Mr. Muchemi’s opinion that commercial tools may run on open source software primarily because of
the commercial conveniences associated with open source software. However, government tools invariably run on
closed source software owing to the nature of sensitivity of the information maintained and processed by such
tools. Furthermore, systems that run on closed source software have their own security testing mechanisms. That
regardless of the adequacy or lack of legislative and policy frameworks, sensitive systems such as NIIMS are
architecturally designed to incorporate safeguards that guard the access of data even by authorized personnel to
ensure that though they may access the data, they do not do it without accountability and that they can only access
it when it is required. In any event, security of data in any digital system is not necessarily entirely dependent on
the existence of stringent legislative and regulatory frameworks.
466. Mr. Waikwa, Counsel for the 1st Petitioner cross-examined Mr. Muchemi on his appointments to Boards of
various organisations that have a connection with or are under the Ministry of ICT. Mr. Muchemi denied that he is
a public officer, and stated that he has consulted for government, the last consultation having been in the SWOT
analysis where he was seconded to UNICEF as the lead member for government. He clarified that his only
connection with NIIMS was the SWOT report, which was prepared in December 2017 before the establishment of
NIIMS, and that he had not conducted any study on NIIMS thereafter. He also testified that he is not involved in
the implementation of NIIMS, nor in the setting up of the NIIMS architecture.
467. Mr. Muchemi stood by the averments in his affidavit on NIIMS being a centralized system, on the birth
register being a unique identifier, and on probabilistic and deterministic system and deduplication and multi-modal
systems, which he stated were reached from his SWOT analysis and his experience.
468. On re-examination by Dr. Nyaundi, and Mr. Njoroge Regeru, Mr. Muchemi clarified that he has professional
involvement with corporate bodies and private sector bodies that work in the area of ICT, and that this did not
influenced his SWOT analysis. Further, that the focus of the SWOT analysis was to harmonise fragmented
citizens’ identity information and that it did allude to a centralised database as a single source of truth on identity,
which is NIIMS.
469. Mr. Loyford Muriithi also gave expert evidence on behalf of the 5th Respondent. He deposed that he is an
Assistant Director in the Ministry of Information, Communications and Technology and has been involved in all
the processes of development and establishment of the NIIMS project. It was his testimony that in designing the
operational and functional architecture of NIIMS, the government carefully selected various desirable attributes
adopted by various jurisdictions they benchmarked in and customized them to suit the unique circumstances of
Kenya. With particular reference to Estonia, he averred that the government consciously resorted to model its
identity system from the Estonian one as both Kenya and Estonia keep a digital centralized master population
register of all their respective citizens and registered foreign nationals and they have no monopoly over the
individual functional data repositories that belong to the institutions linked to the said national master population
registers.
470. As such, every institution linked to the national master population register can use the identity data kept in the
national master population registers for purposes of authenticating the identity of individuals. However, the
national master population registers can neither access nor use the functional data stored in the individual
repositories belonging to the institutions linked to the national master population registers in question.
471. It was his deposition further that the departure of NIIMS from the Estonian system is marked by the fact that
Estonia utilizes identity cards which are valid for both physical and digital identification and is based on an
electronic chip and two pin codes supplied with the card. By using a smart card reader and a computer connected to

the internet, citizens can use two core functionalities provided by the identity card, both of which are essential to
the development of e-government.
472. The first PIN-code allows citizens to authenticate their identity so that the corresponding e-service knows the
identity of the user. This is a first step that provides basic enabling infrastructure to provide personalized services
and information via online means. The second PIN-code is used to sign documents or approve transactions online.
Based on the foregoing, the authentication of an individual’s identity in a digital environment in Estonia is
dependent on what an individual has, a PIN code, as opposed to what an individual is, biometrics. Mr. Muriithi
therefore averred that the inherent risk of an identity authentication based on what an individual has is not foolproof
as anyone who accesses an individual’s PIN-code can represent himself as being the individual in question, hence
arrogate unto themselves the said individual’s identity.
473. According to Mr. Muriithi, in order to avoid the risks inherent in the Estonian identity model, the government
of Kenya consciously resorted to premise the authentication of an individual’s identity, in a digital environment, on
what an individual is, instead of what they have.
474. It was also his averment that whereas NIIMS uses data capture kits manufactured by IDEMIA/OT Morpho, it
does not use any OT Morpho software. He averred that all the hardware components of NIIMS, including the data
capture kits, were screened for any software including but not limited to data-mining software before their
respective programming in Kenya. Further, all the registration and encryption programmes that run on the said
hardware components of NIIMS were developed and installed locally by the government of Kenya. In the premises,
NIIMS does not use OT Morpho deduplication algorithms.
475. It was also Mr. Muriithi’s deposition that during the design architecture of NIIMS, the government of Kenya
anticipated the possibility of certain individuals missing some biometric features or having biometric features that
may not be captured by the biometric data capture kits. Accordingly, it adopted specific design features to obviate
possible exclusion of such individuals and included the use of additional biometric features such as facial images
and biographical information such as date of birth, parentage information, residency information, birth certificate
serial number, national identity card number and alien card number to corroborate fingerprint matching; the digital
capture of all the fingerprints from available fingers of an individual with a view to maximizing the probability of
perfect fingerprint matching; and the use of dactyloscopic (fingerprint) experts to manually counter-check every
enrolment rejected by the fingerprint deduplication algorithm on the basis of attempted multiple enrolment by the
same individual. In the circumstances, it is highly unlikely that an individual may be denied enrolment in the
national master population register on the basis of either missing fingers or having distorted fingerprints.
476. Mr. Muriithi further averred that being a multimodal identity system, NIIMS has several programmes that
variously perform specialized tasks which collectively result in the creation of a digital biometric national master
population register from which respective identities of individuals may be established with precision. Some of the
said programmes were derived from open source software whereas some were derived from closed source software
depending on the sensitivity of the tasks performed by the said programme(s) and the attendant procurement costs.
477. Specifically, the costly programme that perform non-sensitive tasks were derived from open source software,
which explains why NIIMS data capture kits were programmed to run on android operating system. On the other
hand, programmes that perform critical and highly sensitive tasks such as encryption and deduplication were
derived from closed source software in respect of which the government of Kenya restricts the sharing, viewership
and modification of the underlying source codes to essential personnel only. He expressed the view that it would
therefore amount to veritable irresponsibility on the part of the Kenyan government to disclose, to the general
public, the very codes that found the programme meant to guarantee the safety of personal data of its citizens and
foreign nationals resident in Kenya.

478. As regards the Petitioners’ concern on the security of the data, his averment was that the contents of the
national master population register is limited only to the personal information that is sufficient to uniquely identify
an individual and no more. This, he averred, is aptly manifested by NIIMS data capture forms. Further, that the
purpose limitation and data minimization in the architectural design of NIIMS obviates the justification for the use
of data for purposes extraneous to its originally intended purpose on account of its ready availability. Mr. Murithi
asserted that the personal information kept in the NIIMS database is secure because the moment the requisite
biometric and biographical information is captured by the NIIMS data capture kits at the point of registration, the
information is encrypted whether the data capture device is online or offline and the encrypted biometric and
biographical information is transmitted, in encrypted form, to the requisite servers for deduplication. Further, the
templates of biometric and biographical information stored in the NIIMS database are encrypted as well and in the
premises, a data breach on NIIMS database would only reveal encrypted templates of personal identity information
which cannot be unmasked without the requisite decryption key.
479. It was Mr. Muriithi deposition that the security of identity data is further guaranteed by the fact that the
databases of the institutions linked to NIIMS database will only access NIIMS database for purposes of
establishment of respective identities of individuals. Secondly, the functional data, such as criminal records, will
remain resident in the respective repositories of the institutions that are linked to NIIMS database, in this case, the
Directorate of Criminal Investigations database, and the NIIMS database cannot access the functional data
variously stored in the said respective repositories of the institutions linked to NIIMS database.
480. It was his averment therefore that access to the NIIMS database would not provide the purported 360 degrees
view of an individual’s life alleged by the Petitioners. In his view, in the circumstances outlined above, there are
sufficient technical safeguards that regulate the collection, processing, access and sharing of identity data by
NIIMS. As regards children identity data, Mr. Muriithi averred that additional/special technical safeguards were
incorporated in the architectural design of NIIMS database with a view to providing the requisite safety.
481. Mr. Muriithi was cross-examined by Hon. Martha Karua, the lead Counsel for the 2nd Petitioner, and Mr.
Bashir, the Counsel for the 1st Petitioner. On examination by Hon. Karua, Mr. Muriithi confirmed that he was not
part of the benchmarking team that went to other countries to study similar identity systems, but stated that he was
involved in the design of NIIMS by adopting best practices from the bench marking reports. He stated that the role
of the ICT Ministry was to handle the technical issues and safeguards of the NIIMS, while the legal issues were
handled by the business owner, which was the Ministry of Interior. He however stated that the ICT Ministry is the
one that developed the Data Protection Policy and Bill.
482. He further testified that the technical safeguards are only known to the developers of the system, and that the
safeguards they put in place for children was that their biometric data would only be captured from the age of six
years. According to Mr. Muriithi, there are two levels of architecture of NIIMS. The first, which he termed the high
level architecture, can be disclosed. However, that the second, which is the low level detailed architecture of the
system, cannot be provided for security reasons.
483. Mr. Muriithi was cross-examined by Mr. Bashir on the sharing of data between NIIMS and other government
agencies and functional databases. His view was that this would not be a good idea, and that there will be no back
and forth sharing of data between the master database and the functional databases. Further, that there will be
information flows to and from the master database to the functional databases in terms of queries, and on a needs
basis determined by the institutional mandate. Mr. Muriithi stated that there will be mechanisms of recording who
has accessed the system, but there is no system for citizens to know who has accessed their data. He reiterated that
the intention of NIIMS is to authenticate the identity of all Kenyan citizens and foreigners by way of biometric
data, and that no Kenyan citizen should be left out.
484. On re-examination by Mr. Nyaundi, Mr. Muriithi clarified that the high level architecture diagrams of the

NIIMS system are pictorial representations with no source codes and which have little meaning to a technical
person, while the low level diagrams are detailed with specifications and functionalities of every section of the
system.
The 6th Respondent’s Case
485. The 6th Respondent is the Speaker of the National Assembly, an ex-officio member of the National Assembly
by dint of Article 97(1) (d) of the Constitution, and by dint of Article 107 of the Constitution, presides over sittings
of the National Assembly. The 6th Respondent filed Grounds of Opposition all dated 20th February, 2019, a
Replying Affidavit dated 28th February, 2019 and a Supplementary Affidavit dated 2nd May, 2019 all sworn by Mr.
Michael Sialai.
486. Mr. Sialai averred that he is the Clerk of the National Assembly, an office in the Parliamentary Service
Commission constitutionally mandated to run the operations and affairs of the National Assembly under Article
127 and 128 of the Constitution. It is further charged with providing technical and procedural advice to the Speaker
and Members of the National Assembly on parliamentary practices and procedures.
487. In the Grounds of Opposition, the 6th Respondent contended that the Petitioners’ actions were in bad faith as
the impugned amendments were assented to by the President on 31st December 2018 and the Petitioners were
therefore guilty of inordinate delay in instituting these proceedings which were time barred under the provisions of
the Fair Administrative Action Act. Further, it was contended that the National Assembly’s mandate to enact,
amend and repeal laws is derived from the Constitution and the Petitions threaten the legislative role of Parliament
and specifically the National Assembly’s mandate under Articles 1(1), 94 and 95 of the Constitution. The 6th
Respondent took the position that the Petitioners seek to restrict the National Assembly from carrying out its
constitutional mandate derived from Article 95 (3) of the Constitution of enacting the impugned amendments.
488. It was also contended that the present Petitions contravene Article 109 of the Constitution which mandates
Parliament to enact, amend or repeal any law through Bills passed and assented to by the President. The 6th
Respondent asserted that there was adequate public participation in the process of enactment of the impugned
amendments, but be that as it may, the process of enactment of legislation is not an administrative action falling
within the purview of Article 47 of the Constitution or the Fair Administrative Action Act, 2015.
489. His contention was that in the context of legislation, what is required is that the legislature facilitates public
participation on the Bill under consideration by the House. Further, that Article 94 (5) of the Constitution provides
that only Parliament has the power to make provisions having the force of law in Kenya, and all the legislation
passed by Parliament are presumed constitutional unless such presumption is rebutted. Accordingly, sections 3, 5
and 9A introduced to the Act through the impugned amendments are constitutional and properly enacted by the
legislative arm of government and the burden falls on the person who alleges otherwise to rebut this presumption.
490. Mr. Sialai contended further that the process of national registration of persons is a policy decision solely
within the mandate of the Executive and enacted by Parliament. He asserted that this Court is therefore ill-equipped
to determine matters of policy, the economy and the proper mode of national registration process as the Petitioners
ask the Court to do. In any event, according to the 6th Respondent, in determining the constitutionality of an Act of
Parliament, the Court should look at the purpose and effect of the impugned statute and if the purpose and/or the
effect of the statute do not infringe on a right guaranteed by the Constitution, the statute is not unconstitutional. In
his view, the consolidated Petitions have not disclosed how the Constitution is violated by sections 3, 5 and 9A
introduced to the Act through the impugned amendments.
491. In his affidavits, Mr. Sialai gave the chronology of events leading to the enactment of the impugned
amendments. He averred that on Wednesday, 18th April 2018, the Statute Law (Miscellaneous Amendments) Bill

(National Assembly Bill No. 12 of 2018) was introduced in the National Assembly. Thereafter, a motion of
reduction of publication period from 14 days to 3 days was moved by Honourable Aden Bare Duale (the Member
of Parliament for Garissa Township) in accordance with the National Assembly Standing Order 120, and the
motion was passed by the House. On the same day, the Bill went through the first reading and was immediately
committed to the National Assembly Departmental Committee on Administration and National Security to
scrutinize by way of requesting for memoranda from the public as is mandated by Standing Order No. 127 (3) and
Article 118 of the Constitution.
492. Mr. Sialai avers that on 7th May 2018, the National Assembly facilitated public participation on the Bill
through print media by placing an advertisement in both the Standard and Daily Nation newspapers asking for
memoranda from stakeholders. Thereafter, on 14th, 19th and 20th June 2018, the National Assembly Committee on
Administration and National Security held stakeholders\ meetings to which all stakeholders, including the
Petitioners, were invited, to discuss the Bill, but they did not attend or submit a memorandum. It was his averment
that it is therefore untruthful for the Petitioners to allege that there was no public participation.
493. According to Mr. Sialai, the public was involved in the process of enactment of the impugned amendments
through invitations to make submissions and memoranda from stakeholders and the public meetings held on 14th
and 19th June 2019. Consequently, the amendments introduced to the Act through the impugned amendments did
not violate the principle of public participation under the Constitution. He drew attention to the fact that the Kenya
National Commission on Human Rights, the 3rd Petitioner herein, in its analysis and review of the Bill dated 25th
May, 2018 and published in its website, confirmed its approval of the amendments proposed with respect to the Act
through the impugned amendments.
494. Mr. Sialai deposed that the National Assembly Committee on Administration and National Security compiled
its report having taken into account the nature of the concerns raised by different stakeholders. This report was laid
before the National Assembly on 3rd July, 2018. Thereafter, between Tuesday, 7th August 2018 and Thursday,
15th November 2018, the National Assembly, taking into account the concerns of the different sectors, considered
and passed the impugned amendments and thereafter the Bill was forwarded to the President for assent in
accordance with Article 115 of the Constitution. It was his position therefore that the impugned amendments were
enacted in accordance with the Constitution and the National Assembly’s Standing Orders and the National
Assembly did not infringe any Article of the Constitution as alleged by the Petitioners.
495. According to Mr. Sialai, the amendments introduced to the Act could not be withdrawn to await the ongoing
efforts to anchor them in substantive National Registration Identification Bill 2012 and the Registration and
Identification of Persons Bill, 2014 (Senate Bill. No. 39), because the amendments introduced to the Act fell
exclusively within the mandate of the National Assembly. This was on the grounds of its proper rubric, being a
national legislation under Part 1 of the Fourth Schedule to the Constitution. It was also his contention that the
purpose and intent of the impugned statute is stated in its Memorandum of Objects and Reasons clause which states
that it is “An Act of Parliament to amend the Law relating to Registration of Persons Act, to establish the National
Integrated Identification Management System. The Bill proposes to provide for the capture of biometric data and
geographical data in the registration of persons in Kenya”
496. Mr. Sialai contended that in any event, matters of national registration and identification of persons are policy
decisions solely within the mandate of the Executive and enacted by Parliament. In his view, the concerns raised
against capture of biometric and geographical data in the registration of persons in Kenya as enacted in the
impugned amendments are unjustified as the amendments are reasonable and justifiable in an open and democratic
society.
497. He based this assertion on the argument that other modern and democratic countries such as Estonia, UK,
Canada, Tanzania and Uganda have embraced the same model of national registration and identification of persons

in order to address matters of national security and development. It was also his contention that matters of national
registration and identification of persons are sanctioned by the Constitution and enactment of a law to regulate
them cannot deprive the Petitioners of the right to privacy guaranteed under Article 31 of the Constitution. He
further averred that the right to privacy is not absolute and is subject to reasonable restrictions in the public interest
on grounds of national security, to preserve public order, to protect public health, to maintain moral standards, to
secure due recognition and respect for the rights and freedoms of others or to meet the just requirements of the
general welfare of a democratic society.
498. Mr. Sialai contended that these Petitions contravene the principle of presumption of constitutionality of
legislation enacted by Parliament and are also a threat to the doctrine of separation of powers. He further contended
that they are an encroachment on the legislative mandate of Parliament, and the orders sought by the Petitioners are
tantamount to asking the Court to amend or repeal a piece of legislation. He therefore urged the Court not to
exercise its discretion to grant the orders sought in the said Petitions as the Petitioners have not adduced any or any
cogent evidence to demonstrate that their rights have been infringed by the enactment of the impugned
amendments. His position was that the Petitions are devoid of merit, are frivolous, generally argumentative and an
outright abuse of the court process and merely intended to stifle the 6th Respondent’s mandate to legislate under the
Constitution and ought to be dismissed.
499. In his Supplementary Affidavit, Mr. Sialai averred that during the process of the passage of the impugned
amendments, each National Assembly Departmental Committee was tasked to examine each amendment as if they
were distinct legislations. Further, in the advertisement calling for submissions to the various committees, each
thematic area was distinctively before a relevant Departmental Committee in accordance with the Second Schedule
of the National Assembly Standing Orders. Further, that the newspaper advertisement indicated which committee
would deal with which subject matter in order to aid the public in presenting their views. It was also his averment
that during the debates on the impugned amendments, Chairpersons of the respective committees were given time
to indicate the views of the committees and those of the public. Further, that during committal in the House,
Chairpersons of Committees were also required to move their respective amendments unlike in the past where this
was done by the Justice and Legal Affairs Committee. According to Mr. Sialai, these were deliberate adjustment of
rules of procedure to accommodate examination of the amendments by the House.
500. Mr. Sialai urged the Court to examine the Statute Law (Miscellaneous Amendments) Bill in the same manner
as in the context of a Finance Bill which is passed every year by the National Assembly and whose intention is to
amend several laws to deal with revenue-raising measures or even repeals in entirety certain taxation provisions in
the law. He argued that the effect of a Finance Bill cannot be underrated to constitute an interpretation as minor
amendments. It was his contention that this scenario applies also to a Statute Law (Miscellaneous Amendment) Bill
whose intention is to amend many statutes. It contended that neither the Constitution nor the rules of the House bar
Parliament from undertaking its legislative business using a Statute Law (Miscellaneous Amendment) Bill as long
as the principles of public participation are adhered to.
501. According to Mr. Sialai, as a matter of Parliamentary practice, Parliament consolidates amendments due to
either backlog of unlegislated areas or to save on Parliamentary time. He therefore argued that courts should let
Parliament decide on its own nomenclature of Bills. It was his averment that the intent of the Statute law
(Miscellaneous Amendments) Act No. 18 of 2018 was stated in the Memoranda of Objects and Reasons as being
‘to make various wide-ranging amendments on various statutes’.
502. He observed that the Supreme Court of Kenya in Speaker of the Senate & Another v Attorney-General & 4
Others 2013 [eKLR] had recognized the power of the Houses of Parliament to establish and regulate their internal
procedures without undue interference from courts. Further, the principle of separation of powers requires that
there be mutual respect between the courts and the legislature, and that courts should exercise restraint when called
upon to determine matters relating to the exercise of legislative power by Parliament, citing in this regard various

decisions which we shall consider later in this judgment.
503. With regard to the challenge to the impugned amendments on the basis that they were not considered by the
Senate, Mr. Sialai averred that the Statute Law (Miscellaneous Amendments) Bill (National Assembly Bill No. 12
of 2018), was not a Bill concerning counties. He cited the case of National Assembly of Kenya & Another vs
Institute for Social Accountability & 6 Others (2017) eKLR in which the Court of Appeal held that in order for
a Bill to qualify as a Bill ‘concerning county government’, the Bill must be one that affects the functions and
powers of the county governments set out in the Fourth Schedule of the Constitution. In the circumstances, the
procedure for the enactment of the impugned amendments was in line with the Constitution and the National
Assembly Standing Orders. It was his position that for these reasons, this Court lacks grounds to invoke its
jurisdiction under Article 165 of the Constitution to invalidate the legislation, and he urged the Court to dismiss the
Petitions.
THE CASES OF THE INTERESTED PARTIES OPPOSING THE PETITION
504. In opposition to the Petition, the 1st Interested Party, Child Welfare Society of Kenya (CWSK), filed an
affidavit sworn by its Chief Executive Officer, Irene Mureithi, on 27th March 2019. She described CWSK as a semi-
autonomous government agency for the care, protection, welfare and adoption of children pursuant to Legal Notice
No. 58 of 23rd May 2014.
505. Ms. Mureithi averred that she is aware that NIIMS as anchored in the impugned amendments integrates
personal information with biometric and GPS data that shall, inter alia, enable the government identify precise
geographical location of every citizen and resident of Kenya. She averred that whenever children are rescued by the
government and placed in the custody of CWSK, its first task is to establish the identity of such children
immediately. It is her position that NIIMS shall enable CWSK, which is duly established by the government as a
national emergency response and rescue organization for children, to identify lost and abandoned children as well
as their families and unite them within the shortest time possible.
506. Ms. Mureithi deposed that NIIMS will assist the State in its constitutional mandate to protect children, its most
vulnerable group, as required by the Constitution. In her view, the impugned amendments align the Act with the
Constitution. She stated that CWSK, which is obligated by Legal Notice No. 58 of 2014 to strengthen families and
provide families for separated children, children at risk of separation and children without appropriate care by
facilitating local and international family tracing and reunification, will be aided by NIIMS in tracing thousands of
separated children’s families and confirming parentage in a manner that is faster, easier, cost-effective and friendly
to a child and family.
507. Ms. Mureithi also asserted that pursuant to Article 53 of the Constitution, every child has a right to a name and
nationality from birth; parental care and protection, which includes equal responsibility of the mother and father to
provide for the child; and protection from abuse, neglect, harmful cultural practices, all forms of violence, inhuman
treatment and punishments and hazardous and exploitative labour. She contended that any limitations imposed by
the impugned law meets constitutional muster and are justified in an open and democratic society.
508. Her averment was that NIIMS shall facilitate with ease the tracing of families for separated children with
special needs, which is often a challenge and deal with illicit adoption practices such as circumventing the process
and forgery of documents which lead to child trafficking and permanent separation of children from their biological
families. She further contended that the Huduma Namba will capture children’s identity thereby curbing incidents
where children are labeled as orphaned and abandoned when their biological parents are alive; curb change of
children’s identities and falsification of documents to change a child’s name thereby preventing loss of identity;
and assist in administration of social protection programmes for the most vulnerable group in society.

509. Ms. Mureithi also stated that from her experience, the process of tracing a child’s family is usually tedious,
lengthy and costly. Further, that DNA testing for children is done in circumstances that are psychologically
overwhelming for the child and the parents. NIIMS, in her opinion, stands to assist in effectively tracing a child’s
family and confirm parentage without imposing unnecessary trauma to the involved parties, which includes
children.
510. Ms. Mureithi averred that a special category of separated children are children with special needs and tracing
their families is often a challenge. Further, that ensuring that separated children with special needs are placed in
various forms of alternative family care equally becomes a challenge and almost impossible by reason of which
some end up in institutions up to adulthood, thus denying them their constitutional right to parental care and
protection. It was her position that through NIIMS, CWSK will be able to obtain each child’s Huduma Namba and
biometrics and mitigate against cases of children with special needs being abandoned and remaining in institutions
for lengthy periods which is detrimental to their development.
511. Ms. Mureithi further argued that during political upheavals like the 2007-2008 post-election violence and
natural calamities like drought or famine, children are usually separated from their parents. In her view, the
implementation of the law would make reunification of children and their families take a shorter period.
512. Ms. Mureithi further averred that NIIMS stands to mitigate various crimes against children such as child
labour. Through the available records of NIIMS, the children caught up in child labour and those at risk of entering
child labour will be easily traced by the authorities. Further, that NIIMS will be able to track children attendance in
schools and school dropouts, for instance how many children are accessing education in a given locality. It was her
view that this information would be crucial for the government to ensure that various intervention programmes in
the areas such as withdrawal and preventions of exploitation of children, especially in child labour, as well as
provision of psychosocial support to ensure children are retained in schools are properly implemented.
513. Ms. Mureithi further contended that NIIMS will put an end to the cases of duplicate registration since the
details of children will be captured and recorded from birth. It was her averment that at the moment, a child can
acquire various aliases which end up registered at various levels. She further contended that as the system is very
porous, it makes it easy for networks and conspirators to traffic a child especially in a commercialized legal
process. She argued that DNA biometrics will easily lead to reunification of children with their birth families, while
through NIIMS, children from border communities who are in the country for one reason or the other will be
identified and monitored. Referring to The Trafficking in Persons Report 2017 by the Department of State of the
United States of America (USA), she stated that currently, Kenya is cited as a source, transit and destination
country in human trafficking.
514. Ms. Mureithi further stressed the benefits of NIIMS, contending that the process of advertising children for
tracing is costly and lengthy, and with the advent of NIIMS, these costs will be reduced drastically and the time
taken will be minimal. She noted that Kenya is a signatory to the Hague Convention on Inter-country Adoption
which provides for the subsidiarity principle which implies that in cases of children who have no parents, all local
options should be exhausted before considering inter-country adoptions. It was her contention that NIIMS shall aid
in ensuring due diligence in terms of finding local options for a child such as opportunities for family preservation
as opposed to exiting Kenyan children to foreigners while many Kenyans are ready and willing to support their
own. CWSK therefore urged the court to dismiss the Consolidated Petitions.
515. The 8th Interested Party, International Policy Group, opposed the petition through an affidavit sworn on 26th
April, 2019 by its Director, Dr. Kenneth Orengo. Dr. Orengo’s averment was that as per Sustainable Development
Goals (SDGs) set by 150 nations, including Kenya, at the 4th plenary meeting of the United Nations General
Assembly held on 25th September, 2015, the provision of legal identity for all, including birth registration, was
identified as one of the goals to be attained by 2030. He averred that sustainable development and the objectives of

the SDGs form some of the national values and principles of governance under Article 10 of the Constitution.
516. Dr. Orengo stated that following the adoption and ratification of the SDGs in 2015, various multilateral and
international organizations, including the World Bank, UNDP and UNICEF, have undertaken significant work and
deployed resources to facilitate implementation of the goals. These organizations, of which Kenya is a member,
have all stressed the critical role played by digital identity databases in realizing the SDGs. He cited in support of
this averment the statement by the World Bank in its April 2015 report titled ‘Digital IDs for Development:
Access to Identity and Services for All’ that official identification is more than a convenience; that it is a
fundamental human right and is indispensable for connecting residents to electoral participation, educational
opportunities, financial services, health and social welfare benefits, and economic development. He further deposed
that it gives people a chance to better communicate with and be recognized by their government while giving
governments the opportunity to listen and improve the lives of their citizens.
517. Dr. Orengo also cited a report titled ‘The Role of Identification in the Post-2015 Development
Agenda’ issued by the World Bank on 1st April, 2015 where it was stated that the ability to prove one's identity is a
cornerstone of participation in modern life and is basic to many of the rights set out in the Universal Declaration of
Human Rights and the Convention on the Rights of the Child, which rights include the right to a name, a
nationality and to recognized family relationships on both the paternal and maternal sides. He noted that in its
report titled ‘Principles on Identification For Sustainable Development: Toward The Digital Age’ issued on
2nd February, 2018, the World Bank had once again observed that living without proof of legal identity is a serious
obstacle to social, economic, and political inclusion, and that it also makes it difficult for an individual to open a
bank account, vote, obtain formal employment, access education or healthcare, receive a social transfer, buy a SIM
card, or seek legal redress.
518. Dr. Orengo further noted the observations in the report that a person without identification may be unable to
exercise the full range of human rights set out in international laws and conventions. Further, that weak civil
identification systems also represent challenges for countries such as governance planning, service delivery, public
sector administration, collecting taxes, border control and emergency response. He averred that the World Bank
had also noted that the move towards digital platforms by public and private service providers can increase
efficiency of service delivery, create significant savings for citizens, governments, and businesses by reducing
transaction costs, as well as drive innovation. This can generate many benefits but can also exacerbate the risk of
isolation for poorly-connected populations including rural and remote communities, the forcibly displaced, stateless
persons and other marginalized groups.
519. The final report cited in support of the 8th Interested Party’s statement that digitization of identity is
unstoppable is the research by McKinsey Global Institute in January 2019 titled ‘Digital Identification: A Key to
Inclusive Growth.’ The report indicates that the Institute had found that digital identification has the potential to
unlock economic value equivalent to 3 to 13percent of GDP in 2030, assuming high adoption rates. Further, the
research also established that beyond quantifiable economic benefits, digital identification can offer non-economic
value to individuals through social and political inclusion, rights protection and transparency. It noted that robust
identity programmes can help guard against child marriage, slavery, and human trafficking.
520. It was Dr. Orengo’s position that the right digital identification technology, designed with the right principles
and enforced with the right policies such as those formulated in Kenya, can protect individuals from the risk of
abuse and enable the safe inclusion of billions in the digital economy.
521. The 8th Interested Party stated that by providing greater legal protection, digital identification can help in the
elimination of child labor, currently estimated to affect 160 million children, by providing proof of age; fight child
trafficking; help enforce laws against child marriage and thus contribute to its elimination; and contribute to the
empowerment of women and girls worldwide. Dr. Orengo cited the case of Indonesia in which 95% of girls who

married at 18 years of age or younger lacked a birth certificate.
a) It was the 8th Interested Party’s case that digital identification has three benefits. The first was time and cost
savings. Mr. Orengo stated that institutions using high-assurance identification for registration could see up to 90%
cost reduction in customer on-boarding, with the time taken for these interactions reduced from days or week to
minutes by enabling streamlined authentication to improve the customer experience in digital channels. The second
benefit lay in fraud savings. It was averred that digital identification can help reduce fraud in a wide range of
transactions, from decreased payroll fraud in worker interactions to reduced identity fraud in consumer and
taxpayer and beneficiary interactions. A third benefit lay in increased tax collection. It was its position that greater
revenue facilitated by digital identification could expand the tax base, helping promote formalization of the
economy and more effective tax collection. Its position was that emerging economies, in particular, could
experience substantial benefits.
522. Dr. Orengo also averred that the Huduma Namba generated by NIIMS will greatly deter payroll fraud known
locally as the “ghost workers” problem which has been afflicting management of public funds in Kenya for several
decades. He cited digital listing of police officers as having weeded out nearly 2600 ghost workers in the police
force, saving the country approximately Sh1.7 billion in future annual wages.
523. It was Dr. Orengo’s statement that a digital identification system such as the Huduma Namba can also unlock
non-economic value, potentially furthering progress toward ideals that cannot be captured through quantitative
analysis, including those of inclusion, rights protection and transparency. It was his view that such a system can
promote increased and more inclusive access to education, healthcare and labour markets; can aid safe migration
and can contribute to greater levels of civic participation. Further, that such a system is an indispensable tool in
assisting the State to progressively implement Article 43 of the Constitution which is practically impossible to
implement without accurate and credible data. It was also his averment that a digital identification system such as
Huduma Namba can help enforce rights nominally enshrined in law. He illustrated this contention with the case of
India, stating that the right of residents to claim subsidized food through ration shops is protected because their
identity and claim is authenticated through a remote digital identification system, rather than at the discretion of
local officials.
524. Dr. Orengo also deposed that transparency is another benefit of a digital identification system such as Huduma
Namba. He contended that an accurate, up-to-date death registration system can help to curb social protection
fraud, and that a reliable authentic voter registry is essential to reduce voter fraud and ensure the overall integrity of
the electoral process. He gave an example of Pakistan as having updated its voter rolls with strong biometric
controls that resulted in the inclusion of an additional 36 million new eligible voters as well as the elimination of 13
million entries with invalid identities, 9 million duplicates and 15 million entries without verifiable identities. He
contended that a verifiable unique number that includes biometric markers, such as Huduma Namba, should not
only address the accuracy and credibility of the voters register once and for all but also save the country billions of
shillings that are used every 5 years to clean up the voters register and register new voters.
525. According to Dr. Orengo an integrated digital identification can also be used in the provision of e-government
services and benefits, expanding access and saving time for citizens while reducing costs for governments and
improving social welfare, when compared to existing physical touch points. His view therefore was that the
benefits of an integrated digital identification programme far outweighed violation of individual privacy rights for
which adequate remedies are provided in law. Further, that the risks associated with digital identification systems
can be mitigated.
526. On the requirement of GPS coordinates by the impugned law, Dr. Orengo deposed that this is not anything
new but has in fact been a requirement of the Land Registration Act and the Land Act since 2012 when the two
statutes were enacted as law without any opposition from the Petitioners or any other Kenyans. He cited various

sections of the said land laws in support of his statement.
527. Stating that the risks to data security and the right to privacy can be mitigated, Dr. Orengo argued that the right
to privacy must often be balanced against the State's compelling interests, including the promotion of public safety
and improving the quality of life. He averred that in February 2018, United Nations agencies and human rights
organizations that specialize in privacy rights issues met and formulated a set of common principles fundamental to
maximizing the benefits of identification systems for sustainable development while mitigating many of the risks.
He enumerated some of the principles that were formulated as including, first, ensuring universal coverage for
individuals from birth to death, free from discrimination, while the second principle was removing barriers to
access and usage and disparities in the availability of information and technology. The third principle requires
States to establish a robust, unique, secure, and accurate identity, while the fourth requires creating a platform that
is interoperable and responsive to the needs of various users.
528. A further principle, according to the 8th Interested Party, is using open standards and ensuring vendor and
technology neutrality, protecting user privacy and control through system design, planning for financial and
operational sustainability without compromising accessibility, and safeguarding data privacy, security, and user
rights through a comprehensive legal and regulatory framework. Other principles are establishing clear institutional
mandates and accountability, and finally, enforcing legal and trust frameworks through independent oversight and
adjudication of grievances.
529. Dr. Orengo deposed that he was aware that Kenya already has or is in the process of enacting several
provisions in statutes that protect the right to privacy and conform to the principles on data security and privacy,
which he set out in his affidavit. It was his averment that despite a massive and aggressive negative propaganda
campaign mounted by the Petitioners in the media, close to 20 million Kenyans had nevertheless registered with
Huduma Namba, which showed that Kenyans had confidence in the digital identification system.
530. Edward Kingori, a member of the Terror Victims Support Initiative, the 9th Interested Party swore an affidavit
on 26th April, 2019 in which he joined the Respondents in opposing the Petitions. He averred that the 9th Interested
Party is a group formed to assist victims of terrorist attacks in Kenya and give them a forum to share their
experiences, support each other and engage the government on the eradication of terror attacks in the country.
531. Mr. Kingori averred that a citizen’s right to privacy must be limited as privacy can be an avenue for terrorists
and their sympathizers and financiers to disguise their identity and subsequently afford them an opportunity to
meet, plan, and finance attacks in the guise of right to privacy. He deposed that allowing terrorists unlimited rights
is equal to surrendering the right to life as the terrorists’ rights cannot be more important or so precious that their
rights should not be limited.
532. Mr. Kingori listed in his affidavit several incidents of terror attacks that have occurred in Kenya. He averred
that terrorists and criminals are, by the very nature of their activities, faceless and shadowy figures who go to great
lengths to hide and misrepresent their intentions, plans and activities. It was, he asserted, a utopian fantasy to insist
that law enforcement agencies should rely on the old paper based methods of fighting such criminals or that settled
notions of human rights protection such as habeas corpus, the right to bail and the right to privacy apply to
terrorists. Further, that apart from maiming and loss of lives, terrorist acts have also had a negative effect on many
sectors of the economy especially those involved in the hospitality sector which in turn feeds into a vicious cycle of
collapsing hotel businesses with the attendant job losses and entrenched poverty in places like the former Coast
province. His opinion was that the Huduma Namba will be a useful tool in fighting terrorism.
533. Mr. Kingori deposed at length on the legislative measures taken by Kenya and other jurisdiction in the fight
against terrorism. It was his averment that those laws have limited the right to privacy but such limitation has been
found to be constitutional. The case of Coalition for Reform and Democracy (CORD) & 2 others vs Republic

of Kenya &10 others [2015] eKLR was cited as upholding the limitations imposed on the right to privacy by the
National Intelligence Service Act as reasonable and justifiable on account of the circumstances facing the nation.
534. It is the 9th Interested Party’s case that the use of integrated databases, including DNA databases, is now one
of the most effective tools in fighting crime, especially crimes involving violence, terrorism and sexual offences.
He gave the United States of America and South Africa as examples of countries with DNA databases. Mr.
Kingori, however, conceded that those databases are reserved for those who come into contact with the law and not
the general population.
535. The 9th Interested Party contended that the Consolidated Petitions are predicated on the theory that
governments should be treated with suspicion or are not to be trusted with data or are incapable of responsibly
dealing with data. He noted that, conversely, millions of Kenyans have entrusted their most private data with
private social media entities including Facebook, Twitter, Tinder and Google who retain such data in cloud
repository servers, and Mr. Kingori wondered why the Petitioners have not lifted a finger against such foreign
entities.
536. It was his deposition that as at 24th April, 2019, more than 15.6 million people had voluntarily registered with
the NIIMS system across the country. That the process had also received broad bipartisan support across the
political divide, which confirmed that the people of Kenya had given a vote of confidence to NIIMS. He therefore
urged the court todismiss the Consolidated Petitions.
ANALYSIS AND DETERMINATION
537. We have considered the pleadings of the parties as well as their detailed respective submissions and
authorities, and have identified three substantive issues for determination:
i. Whether the legislative process leading up to the enactment of Statute Law (Miscellaneous Amendment) Act
No. 18 of 2018 was constitutional. In this regard, three sub-issues arise:
b. Whether enactment of the impugned amendments vide a Statute Law (Miscellaneous Amendments) Bill was
procedural and/or appropriate in the circumstances;
c. Whether the Statute Law (Miscellaneous Amendments) Bill 2018 was a Bill concerning counties and should
therefore have been subjected to approval of the Senate.
ii. Whether the amendments to the Registration of Persons Act through the Statute Law (Miscellaneous
Amendment) Act No. 18 of 2018 violate and/or threaten violation of the right to privacy contrary to Article 31 of
the Constitution. In this regard, four sub-issues arise:
a. Whether the personal information collected pursuant to the amendments to the Registration of Persons Act is
intrusive, excessive and disproportionate to the stated objectives of NIIMS;
b. Whether the rights of children to privacy are violated or threatened with violation by the impugned
amendments;
c. Whether there are sufficient legal safeguards and data protection frameworks for the personal information
that is collected in NIIMS;
d. Whether the impugned amendments to the Registration of Persons Act are an unreasonable and unjustifiable
limitation to the right to privacy.

iii. Whether the amendments to the Registration of Persons Act through the Statute Law (Miscellaneous
Amendment) Act No. 18 of 2018 violate and/or threaten violation of the right to equality and freedom from
discrimination contrary to Article 27 of the Constitution in respect of Nubians and other marginalised
communities.
538. These Consolidated Petitions therefore raise procedural issues related to the process of enactment of the
Statute Law (Miscellaneous Amendment) Act 2018 as well as substantive concerns related to the question whether
the impugned law violates or threatens to violate constitutional rights. We shall begin our analysis by considering
the procedural questions related to the enactment of the impugned amendments, then the question whether the
impugned law violates or threatens to violate the constitutional right to privacy guaranteed under Article 31, and
finally, whether the impugned amendments violate or threaten to violate the right to non-discrimination guaranteed
under Article 27 in so far as the rights of the Nubian community and other vulnerable groups are concerned.
539. However, before we enter into an analysis of the issues, we deem it necessary to consider the question as to
whether this Court has jurisdiction, and if so, the applicable constitutional and other principles that guide this Court
in the exercise of its jurisdiction.
The Court’s Jurisdiction
540. The 6th Respondent has attempted to ward off the court’s inquiry into the issues raised by the Petitioners by
flashing the separation of powers card and asserting the principle of parliamentary privilege. It has told the court
that it should not touch the impugned amendments as that would amount to interference with the National
Assembly’s constitutional mandate to legislate. Our response to these arguments is that there is a plethora of
authorities which confirm that Parliament can only successfully raise the defence of separation of powers or
parliamentary privilege by proving compliance with the Constitution and the law. Anything done by Parliament
outside the confines of the Constitution and the law attracts the attention and action of this court. In conducting an
inquiry into the constitutionality of the decisions and actions of the legislature the Court finds constitutional
authority in Article 165(3)(d).
541. In its decision in the case of Council of Governors & 6 others vs Senate [2015] eKLR, the court expressed
the ambit of this mandate as follows:
“We are duly guided and this Court vested with the power to interpret the Constitution and to safeguard, protect
and promote its provisions as provided for under Article 165(3) of the Constitution, has the duty and obligation
to intervene in actions of other arms of Government and State Organs where it is alleged or demonstrated that
the Constitution has either been violated or threatened with violation….To our mind, this Court has the power to
enquire into the constitutionality of the actions of the Senate notwithstanding the privilege of inter alia, debate
accorded to members of the Senate. That finding is fortified under the principle that the Constitution is the
Supreme Law of this country and the Senate must function within the limits prescribed by the Constitution. In
cases where it has stepped beyond what the law and the Constitution permit it to do, it cannot seek refuge in
illegality and hide under the doctrine of parliamentary privilege….In that regard, we have already found that the
Constitution is the supreme law of the land and all state organs have an obligation to uphold it and the Senate
must always act in accordance with the Constitution. Its procedures and resolutions must be made within the
purview of the same constitution and it cannot purport to violate the Constitution and seek refuge in the doctrine
of separation of powers. This Court, under Article 165(3) (d) (ii) of the Constitution is constitutionally mandated
to examine whether anything done under the authority of the Constitution is well within the four corners of the
Constitution. The Senate cannot therefore act in disregard of the Constitution and at the same time claim to
exercise powers under the same Constitution. This Court will continue to exercise its jurisdiction and judicial
authority as conferred by the people of Kenya to assert the authority and supremacy of the Constitution and
when the Senate has violated the Constitution, it must be told so.”

542. In its decision in In the Matter of the Speaker of the Senate & another [2013] eKLR, the Supreme Court
confirmed this principle when it held that:
“It emerges that Kenya’s legislative bodies bear an obligation to discharge their mandate in accordance with the
terms of the Constitution, and they cannot plead any internal rule or indeed, any statutory scheme, as a reprieve
from that obligation. This Court recognizes the fact that the Constitution vests the legislative authority of the
Republic in Parliament. Such authority is derived from the people. This position is embodied in Article 94(1)
thereof. The said Article also imposes upon Parliament the duty to protect the Constitution and to promote the
democratic governance of the Republic. Article 93(2) provides that the national Assembly and the Senate shall
perform their respective functions in accordance with the Constitution. It is therefore clear that while the
legislative authority lies with Parliament, the same is to be exercised subject to the dictates of the Constitution.
While Parliament is within its general legislative mandate to establish procedures of how it conducts its
business, it has always to abide by the prescriptions of the Constitution. It cannot operate besides or outside the
four corners of the Constitution. This Court will not question each and every procedural infraction that may
occur in either of the Houses of Parliament. The Court cannot supervise the workings of Parliament. The
institutional comity between the three arms of government must not be endangered by the unwarranted
intrusions into the workings of one arm by another….Where the Constitution decrees a specific procedure to be
followed in the enactment of legislation, both Houses of Parliament are bound to follow that procedure. If
Parliament violates the procedural requirements of the supreme law of the land, it is for the courts of law, not
least the Supreme Court to assert the authority and supremacy of the Constitution.”
543. The Petitioners contend, among other things, that the process of the enactment of the impugned amendments
violated the Constitution. It is therefore our sacrosanct duty to determine whether that allegation is true, and if so,
provide appropriate remedy. Our fidelity to the Constitution and by extension to the people of Kenya, from whom
our mandate emanates, cannot be shaken by isolated reference to the doctrine of separation of powers. The
Constitution must be read as a whole. Whereas the Constitution recognizes the doctrine of separation of powers, the
same instrument mandates this court to determine whether any action undertaken by Parliament violates the
Constitution or the law. That the Constitution should be read as one document finds support in the case of
Tinyefuza vs Attorney-General, Const. Pet. No. 1 of 1996 (1997 UGCC3), in which the Ugandan Court of
Appeal held that:
“[T]he entire Constitution has to be read as an integrated whole and no one particular provision destroying the
other but each sustaining the other.”
544. We find no reason to expound further on the jurisdiction of this Court in so far as the enforcement and
protection of the Constitution is concerned.
Applicable Constitutional Principles
545. It is also useful, before embarking on an analysis of the issues, to set out and bear in mind the principles
applicable in a matter challenging the constitutionality of legislation. The starting point is Article 259(1) which
obliges this Court to interpret it in a manner that promotes its purposes, values and principles, advances the rule of
law and the human rights and fundamental freedoms in the Bill of Rights, permits the development of the law and
contributes to good governance.
546. In determining whether an impugned legislation or action is unconstitutional, the provisions of the
Constitution must be interpreted purposively in line with Article 259(1) and other principles of constitutional
interpretation. In the case of Institute of Social Accountability & Another v National Assembly & 4 Others
High Court, [2015] eKLR, the court summed up these principles as follows:

[57] “[T]his Court is enjoined under Article 259 of the Constitution to interpret the Constitution in a manner
that promotes its purposes, values and principles, advances the rule of law, human rights and fundamental
freedoms in the Bill of Rights and that contributes to good governance. In exercising its judicial authority, this
Court is obliged under Article 159(2)(e) of the Constitution to protect and promote the purpose and principles of
the Constitution. In determining whether a statute is constitutional, the court must determine the object and
purpose of the impugned statute for it is important to discern the intention expressed in the Act itself (see
Murang’a Bar Operators and Another v Minister of State for Provincial Administration and Internal Security
and Others Nairobi Petition No. 3 of 2011 [2011]eKLR, Samuel G. Momanyi v Attorney General and Another
(supra)). Further, in examining whether a particular statutory provision is unconstitutional, the court must have
regard not only to its purpose but also its effect…
[59] Fourth, the Constitution should be given a purposive, liberal interpretation...Lastly and fundamentally, it is
the principle that the provisions of the Constitution must be read as an integrated whole, without any one
particular provision destroying the other but each sustaining the other (see Tinyefuza v Attorney General of
Uganda Constitutional Petition No. 1 of 1997 (1997 UGCC 3)). We are duly guided by the principles we have
outlined and we accept that while interpreting the impugned legislation alongside the Constitution, we must bear
in mind our peculiar circumstances. Ours must be a liberal approach that promotes the rule of law and has
jurisprudential value that must take into account the spirit of the Constitution.”
547. Similarly, the Canadian Supreme Court stated in R v Big M Drug Mart Ltd., [1985] 1 S.C.R. 295 that:
‘Both purpose and effect are relevant in determining constitutionality; either an unconstitutional purpose or an
unconstitutional effect can invalidate legislation. All legislation is animated by an object the legislature intends
to achieve. This object is realized through impact produced by the operation and application of the legislation.
Purpose and effect respectively, in the sense of the legislation’s object and its ultimate impact, are clearly
linked, if not indivisible. Intended and achieved effects have been looked to for guidance in assessing the
legislation’s object and thus the validity.’
548. The Constitution should also be interpreted in a holistic manner that entails reading one provision alongside
other provisions, and considering the historical perspective, purpose, and intent of the provisions in question. In Re
the Matter of Kenya National Commission on Human Rights [2014] eKLR, the Supreme Court considered the
meaning of “a holistic interpretation of the Constitution,” and stated:
“[26] But what is meant by a ‘holistic interpretation of the Constitution’" It must mean interpreting the
Constitution in context. It is the contextual analysis of a constitutional provision, reading it alongside and
against other provisions, so as to maintain a rational explication of what the Constitution must be taken to mean
in light of its history, of the issues in dispute, and of the prevailing circumstances. Such scheme of interpretation
does not mean an unbridled extrapolation of discrete constitutional provisions into each other, so as to arrive at
a desired result.”
549. Courts have consistently affirmed that a holistic interpretation of the Constitution calls for the investigation of
the historical, economic, social, cultural and political background of the provision in question. This view was
expressed by the Supreme Court in Communications Commission of Kenya & 5 Others v. Royal Media
Services Limited & 5 Others, [2015] eKLR, that:
“the Constitution should be interpreted in a holistic manner, within its context, and in its spirit.” The Supreme
Court in interpreting the Constitution took into consideration the historical, economic, social and political
background of the Articles it had been called upon to consider.”
550. In The Speaker of The Senate & Another vs. Honourable Attorney General & Others, [2013] eKLR,

Mutunga, CJ, cited with approval the holding in Tinyefuza v Attorney General Const Petition No. 1 of 1996
(1997 UGCC3) that:
“[184] The entire Constitution has to be read as an integrated whole, and no one particular provision destroying
the other but each sustaining the other. This is the rule of harmony, rule of completeness and exhaustiveness
and rule of paramountcy of the written Constitution.”
551. Article 24 sets out the principles that a court should consider in an analysis of the question whether legislation,
which is challenged on the basis that it limits fundamental rights in the Bill of Rights, meets the requirements of the
Constitution. It provides as follows:
24. (1) A right or fundamental freedom in the Bill of Rights shall not be limited except by law, and then only to
the extent that the limitation is reasonable and justifiable in an open and democratic society based on human
dignity, equality and freedom, taking into account all relevant factors, including––
(a) the nature of the right or fundamental freedom;
(b) the importance of the purpose of the limitation;
(c) the nature and extent of the limitation;
(d) the need to ensure that the enjoyment of rights and fundamental freedoms by any individual does not
prejudice the rights and fundamental freedoms of others; and
(e) the relation between the limitation and its purpose and whether there are less restrictive means to achieve the
purpose.
(2) Despite clause (1), a provision in legislation limiting a right or fundamental freedom—
(a) in the case of a provision enacted or amended on or after the effective date, is not valid unless the legislation
specifically expresses the intention to limit that right or fundamental freedom, and the nature and extent of the
limitation;
(b) shall not be construed as limiting the right or fundamental freedom unless the provision is clear and specific
about the right or freedom to be limited and the nature and extent of the limitation; and
(c) shall not limit the right or fundamental freedom so far as to derogate from its core or essential content.
(3) The State or a person seeking to justify a particular limitation shall demonstrate to the court, tribunal or
other authority that the requirements of this Article have been satisfied.
552. The Petitioners, particularly the 1st Petitioner, allege violation of constitutional rights, specifically the right to
equality and non-discrimination, and the right to privacy under Article 31 of the Constitution. Accordingly, a
burden is placed on them to demonstrate, with a reasonable degree of precision, the manner in which their rights or
the rights of others under these provisions of the Constitution have been or are threatened with violation. They are
required to set out precisely the Articles of the Constitution alleged to have been infringed and the manner of such
infringement-see Anarita Karimi Njeru vs Republic [1979] 1 KLR 154.
553. In Trusted Society of Human Rights Alliance vs Attorney General and 2 Others [2012] eKLR, the Court
re-affirmed the holding in the Anarita Karimi Njeru Case and stated that:

“We do not purport to overrule Anarita Karimi Njeru as we think it lays down an important rule of
constitutional adjudication; a person claiming constitutional infringement must give sufficient notice of the
violations to allow her adversary to adequately prepare her case and to save the court from embarrassment on
issues that are not appropriately phrased as justiciable controversies. However, we are of the opinion that the
proper test under the new Constitution is whether a Petition as stated raises issues which are too insubstantial
and so attenuated that a court of law properly directing itself to the issue cannot fashion an appropriate remedy
due to the inability to concretely fathom the constitutional violation alleged.
The test does not demand mathematical precision in drawing constitutional Petitions. Neither does it require
talismanic formalism in identifying the specific constitutional provisions which are alleged to have been
violated. The test is a substantive one and inquires whether the complaints against the Respondents in a
constitutional petition are fashioned in a way that gives proper notice to the Respondents about the nature of the
claims being made so that they can adequately prepare their case.”
554. It is the principles that emerge from the cases cited in the preceding sections and the analysis required of the
court from the provisions of Article 24 set out above that shall guide our determination of the constitutional issues
that arise in these Consolidated Petitions.
Use of Expert Evidence
555. A second set of principles that should guide the court relates to the use of expert testimony by the parties given
that all the parties relied on expert witnesses in support of their respective cases. Submissions were made,
particularly by the 5th Respondent, on the nature of the expert evidence and the circumstances under which the
Court should place reliance on such evidence. The 5th Respondent requested the Court to find persuasion in the
evidence of its expert witness, Mr. Brian Omwenga, who undertook research and authored a report titled
‘Strengths, Weaknesses, Opportunities and Threats: Analysis of the Existing Identification and Registration
Systems in Kenya, 2017”.
556. In this report, according to the 5th Respondent, its expert recommended remedial measures to address the gap
in the data sharing protocols between government agencies and the execution of the report on Government Wide
Enterprise Architecture to allow for data access, security and governance in dealing with vital national data.
Further, that the NIIMS system was part of the recommendations by the expert. The 5th Respondent contends that,
on the other hand, the Petitioners’ expert witnesses had not interacted with the NIIMS system, and their knowledge
of the alleged flaws in it was hypothetical and speculative.
557. The 5th Respondent cites the decision in Stephen Kinini Wang'ondu vs The Ark Limited [2016] eKLRand
Kimatu Mbuvi T/A Kimatu Mbuvi & Bros vs. Augustine Munyao Kioko [2007] 1 EA 139 on the consideration
of, and weight to be given to, expert testimony by a court. In particular, it submits that expert evidence should not
trump all other evidence; that it shouldnot be considered in a vacuum and that it should be evaluated in the context
of other evidence. Therefore, that even though experts are called upon to assist the court to evaluate complex
matter, the said evidence is not compelling on its own.
558. This Court received viva voce evidence from expert witnesses, who provided the Court with important
information. Under section 48 of the Evidence Act, opinions of science or art are admissible if made by persons
specially skilled in such science or art. The said section provides as follows:
“(1) When the court has to form an opinion upon a point of foreign law, or of science or art, or as to identity or
genuineness of handwriting or finger or other impressions, opinions upon that point are admissible if made by
persons specially skilled in such foreign law, science or art, or in questions as to identity, or genuineness of
handwriting or fingerprint or other impressions.

(2) Such persons are called experts.”
559. The first requirement therefore, of a party who calls an expert witness, is to establish the credentials of the
person as an expert, or one who is especially skilled in that branch of science or art, to the satisfaction of the Court.
The question whether a person is specially skilled within the meaning of section 48 of the Evidence Act is a
question of fact that has to be decided by the Court, and failure to prove the competency of a person a party calls as
an expert presents a real risk of evidence of such a person being ruled out as irrelevant.
560. The 5th Respondent alleges that the Petitioners’ expert witness was not specially skilled on NIIMS as he had
not interacted with it. We note that from his qualifications, the Petitioner’s expert witness, Mr. Anand
Venkatanarayanan holds a Bachelor’s degree in Technology with Computer Science Major from the University of
Madras and he stated that he was an expert Cyber Security and Computer fraud forensic analysis. He also had work
experience as a software engineer from June 1998 to August 2018, a period of 20 years. In our view his training
and experience makes him specially skilled in computer systems, and to this extent, his evidence was relevant. His
lack of interaction with NIIMS in our view will only be pertinent to the import of any conclusions he makes on the
issues before this Court.
561. The import of an expert’s conclusions in this respect is influenced by the overriding consideration that an
expert’s opinion is based on facts. Because of that, the expert must either prove by admissible means the facts on
which the opinion is based, or state explicitly the assumptions as to fact on which the opinion is based. In addition,
the expert witness ought to explain the reasoning behind his opinion and the basis of the reasoning. Lastly, while
the opinion of the expert is relevant, the decision must nevertheless be the judges’.
562. The weight to be attached to such an opinion by the Court would depend on various factors. These include the
circumstances of each case; the standing of the expert; his skill and experience; the amount and nature of materials
available for comparison; and the care and discrimination with which he approached the question on which he is
expressing his or her opinion, as noted by a five judge bench of this Court in Mohammed Ali Baadi & Others vs
The Attorney General & 11 Others (2018) e KLR. The said five judge bench held as follows on the factors the
court will take into account when deciding what weight to be given to expert evidence:
“Firstly, expert evidence does not “trump all other evidence.” It is axiomatic that judges are entitled to disagree
with an expert witness. Expert evidence should be tested against known facts, as it is the primary factual
evidence which is of the greatest importance. It is therefore necessary to ensure that expert evidence is not
elevated into a fixed framework or formula, against which actions are then to be rigidly judged with a
mathematical precision
Secondly, a judge must not consider expert evidence in a vacuum. It should not therefore be “artificially
separated” from the rest of the evidence. To do so is a structural failing. A Court’s findings will often derive
from an interaction of its views on the factual and the expert evidence taken together. The more persuasive
elements of the factual evidence will assist the Court in forming its views on the expert testimony and vice versa.
For example, expert evidence can provide a framework for the consideration of other evidence.
Thirdly, where there is conflicting expert opinion, a judge should test it against the background of all the other
evidence in the case which they accept in order to decide which expert evidence is cogent and give reasons why
the court prefers the evidence of one expert as opposed to the other. Fourthly, a judge should consider all the
evidence in the case, including that of the experts, before making any findings of fact.”
563. Reliance was placed by the Court on various decisions including Ndolo vs Ndolo, (1996) eKLR, Kimatu
Mbuvi T/A Kimatu Mbuvi & Bros. vs Augustine Munyao Kioko (2006) eKLR and Huntley (also known as
Hopkins) (a protected party by his litigation friend, McClure) vs. Simmons [2010] E.W.C.A. Civ. 54. It was

also noted that where there is a conflict between experts on a fundamental point, it is the Court’s task to justify its
preference for one over the other by an analysis of the underlying material and of their reasoning, and that a Court
may find that an expert’s opinion is based on illogical or even irrational reasoning and reject it, and may give little
weight to an expert’s testimony where it finds the expert’s reasoning speculative or manifestly illogical and as a
result unreliable. The various expert testimony presented before us shall therefore be analysed on the basis of the
above principles.
564. We now turn to consider the substantive issues raised in the Petition.
Whether the Legislative Process was Constitutional
565. The first issue to consider relates to the question whether the legislative process leading up to the enactment of
the Statute Law (Miscellaneous Amendment) Act No. 18 of 2018 was constitutional. In addressing this question,
we consider whether the impugned amendments were subjected to public participation in accordance with the
Constitution, whether the enactment by way of an omnibus Statute Law (Miscellaneous Amendment) Act was
procedural or appropriate in the circumstances, and finally, whether the impugned law was a Bill concerning
counties and should therefore have been subjected to approval of the Senate.
Whether there was Public Participation.
566. The Petitioners contend that the enactment of the impugned amendments did not comply with the
constitutional requirement for public participation. The 1st Petitioner submits that apart from a call to the public to
give views on the Statute Law (Miscellaneous Amendments) Bill 2018, no information was made available to the
public as to what NIIMS was, what it would entail, its potential vulnerabilities, and how it would affect the lives of
Kenyans and foreign nationals resident in Kenya. It submits that the right to public participation is intertwined with
the right to information since, for adequate participation to take place, those participating must have the salient
information necessary to intelligibly form and articulate their opinion on what is proposed. The 1st Petitioner cites
the decision in the case of Katiba Institute vs President’s Delivery Unit & 3 others [2017] eKLR as stating that
successful and effective public participation in governance largely depends on the citizen’s ability to access
information held by public authorities, and the right to access information becomes a foundational human right
upon which other rights must flow.
567. The 1st Petitioner takes the view that in enacting the impugned amendments, the National Assembly was
bound by the national values and principles of public participation, transparency and accountability. Article 118 of
the Constitution is cited as requiring Parliament to conduct its business in an open manner, including opening its
sittings and those of its committees to the public. To buttress this argument, it relies on the case of Law Society of
Kenya vs Attorney General & 2 Others [2013] e KLR (hereafter the 2013 Law Society Case) in support of the
statement that in order to determine whether there has been public participation, the court is required to interrogate
the entire process leading to the enactment of the legislation. According to the 1st Petitioner, the court in Law
Society of Kenya vs Attorney General & Another [2016] eKLR (hereafter the 2016 Law Society Case) also
held that any amendments introduced on the floor of the House subsequent to public participation ought not to be
completely new provisions which were neither incorporated in the Bill as published, nor the outcome of the public
input.
568. The 1st Petitioner further relies on the case of Kenya Human Rights Commission v Attorney General &
Another [2018] eKLR in which the South African case ofMatatiele Municipality & Others vsThe President of
South Africa & Others(2) (CCT 73/05 A [2006] ZACC12; 2007 (1) BCLR 47 (CC) is cited for the proposition
that the Constitution contemplates that the people will have a voice in the legislative organs of the State, not only
through elected representatives but also through participation in the law-making process. The 1st Petitioner also
cites the case of Robert N. Gakuru & others v Kiambu County Government & 3 others[2014] eKLR (the

Robert Gakuru Case) as highlighting the ingredients of the kind of engagement with the people that will pass
constitutional muster. It notes that inKiambu County Government & 3 Others v Robert N. Gakuru &
Others[2017] eKLR, the Court of Appeal held that the people must be accorded an opportunity to participate in
the legislative process, andit was upon the party that was required to comply with this constitutional requirement to
prove that indeed there was compliance.
569. It is the 1st Petitioner’s submission that in the words ofNgcobo, J Doctors for Life International vs. Speaker
of the National Assembly and Others (CCT12/05) [2006] ZACC 11; 2006 (12) BCLR 1399 (CC); 2006 (6) SA
416 CC (the Doctors for Life Case) merely allowing public participation in the law-making process is not enough
but more is required, and measures need to be taken to facilitate public participation. The 1st Petitioner concludes
its arguments on the issue by asserting that, as stated in the 2016 Law Society Case, failure to comply with this
obligation renders the resulting legislation invalid.
570. The 1st Petitioner’s submission on the issue of public participation is linked to the claim that there was
insufficient information on NIIMS. The 1st Petitioner submits that given the significant implication of NIIMS, the
national government had a duty to disclose the information in order to allow the public to understand what was
being proposed, how it would affect their lives and to make an informed decision whether the proposal was
reasonable or not. It is also the 1st Petitioner’s view that the National Assembly had a concomitant duty to provide
the public with all the information relating to the implication of the impugned amendments, including the legal
effects and the changes to be achieved through NIIMS. The case of Nairobi Law Monthly Company Limited vs
The Kenya Electricity Generating Company & 2 others [2013] eKLR is cited in support of the importance of
access to information, as it is at the core of the exercise and enjoyment of all other rights by citizens. Further, that
the right to information does not only imply the entitlement by the citizen to information, but also imposes a duty
on the State to provide information. Also cited in support of this position is the decision in the case of Mohamed
Ali Baadi and others vs Attorney General & 11 Others [2018] eKLR.
571. The importance of the right to access information is further stressed by reference to the South African case
of The President of RSA v M & G Media [2010] ZASCA 177, in which the Supreme Court of Appeal stated that
open and transparent government and free flow of information concerning the affairs of the State is the lifeblood of
democracy. Also cited is the case of RSA v. M & G Media (CCT 03/11) [2011] ZACC 32, where the
Constitutional Court of South Africa noted that the constitutional guarantee of the right of access to information
held by the State gives effect to “accountability, responsiveness and openness”.
572. Another decision that was cited is that of Claude-Reyes et al. vs Chile (September 19, 2006) where the Inter-
American Court of Human Rights explained that the right to access information is critical in auditing whether State
actions are performed in accordance with the law. Further, that the State’s actions should be governed by the
principles of disclosure and transparency in public administration, to enable its subjects to question, investigate and
consider whether public functions are being performed adequately. Relying on the above decisions, the 1st
Petitioner submits that the Respondents have not provided any evidence that information was ever provided to the
public, especially at the stages when public views could have affected or informed the government plans on
NIIMS.
573. Like the 1st Petitioner, the 2nd Petitioner also alleges non-compliance with the Constitution and the law in the
enactment of the impugned amendments. Referring to the provisions of Articles 10(2)(a) and 118(1)(b) of the
Constitution and Standing Order No. 127(3) of the National Assembly Standing Orders which provide for public
participation in the legislative process, the 2nd Petitioner opines that these provisions essentially represent the
expanded scope of our democracy to make it partly representative and partly participatory. It is its submission that
these provisions have been interpreted as conferring a positive and mandatory duty on the National Assembly to
take deliberate, positive and genuine measures to facilitate meaningful, informed and quality participation by
ordinary citizens in its legislative processes.

574. According to the 2nd Petitioner, the legislature is also expected to ensure that views that may influence any
legislation are taken into account before any such law is passed. The 2nd Petitioner asserts that public participation
promotes openness, transparency and accountability, which are the foundational tenets of a constitutional
democracy. In that regard the Robert Gakuru Case is cited as aptly capturing the centrality of public participation
in Kenya’s legislative processes. The decision is also relied upon in support of the statement that public
participation ought to be real and not illusory, and ought not to be treated as a mere formality for the purposes of
fulfillment of the constitutional dictates.
575. The Doctors for Life Case is identified as underlining the standard and quality of public participation.
Relying on the said case, the 2nd Petitioner submits that public involvement in the legislative process requires
access to information and the facilitation of learning and understanding in order to achieve meaningful involvement
by ordinary citizens. Further, that the legislature should create conditions that are conducive to the effective
exercise of the right to participate in the law-making process.
576. According to the 2nd Petitioner, the nature of the legislation and its effect on the citizens plays a role in
determining the degree of facilitation that is reasonable and the mechanisms that are most appropriate to achieve
public involvement. The case ofMatatiele Municipality & Others vsThe President of South Africa & Others
(Supra) is cited in support of this statement. The 2nd Petitioner argues that the alleged public participation prior to
the enactment of the impugned amendments was cosmetic, and well below the constitutional standard laid out in
the Robert Gakuru Case. It is the 2nd Petitioner’s observation that the Constitution and the Standing Orders of the
National Assembly require more than mere advertisement in a newspaper in view of the fact that the impugned
amendments impact on every sphere of the day to day lives of the public thus affecting citizens’ fundamental
rights.
577. In order to demonstrate the absence or inadequacy of public participation, the 2nd Petitioner asserts that the
stakeholders meetings that were purportedly held on 14th, 19th and 20th June 2018 were in actual fact internal
parliamentary proceedings attended by parliamentary staff within Parliament buildings, and were out of reach to
ordinary citizens. Further, that no evidence was adduced of actual invitations to the public or other stakeholders to
those meetings. It is therefore the 2nd Petitioner’s conclusion that the said meetings fell short of the standard of
public participation, and the impugned amendments therefore violated Articles 10(2)(a) and 118(1)(b) of the
Constitution.
578. It is further the submission of the 2nd Petitioner that the advertisements in the newspapers inviting members of
the public to submit representations on the impugned law as a whole were themselves cosmetic. It contends that the
said adverts failed to comply with the mandatory provisions of Article 24(2)(a) of the Constitution that require that
any legislation limiting a constitutional right must specifically express the intention to limit that right or
fundamental freedom, and the nature and extent of the limitation. Its view is that had the requirement been
complied with, there could have been greater participation by the public.
579. The 2nd Petitioner also takes issue with the seven days given to the public to provide their views. Its position is
that the public was given seven days to submit representations on proposed amendments to 68 Acts, but no effort
was made to provide any information. It contends that there was no memorandum or explanation setting out the
scope, effect and objects of the impugned amendments to enable the public make informed representations.
According to the 2nd Petitioner, no input was expected from the public in such circumstances.
580. Further, that considering the nature, importance, intensity and impact of the impugned amendments on the
public, seven days was an unreasonably short period to expect any person to appreciate the full import of the
impugned amendments, and to submit any meaningful representations thereon. It is the 2nd Petitioner’s contention
that there was no attempt to exhort the public to participate in the process of the enactment of the Bill. The 2nd
Petitioner therefore concludes that the impugned amendments failed constitutional muster as they were passed in

violation of Articles 10(2)(a) and 118(1)(b) of the Constitution and are accordingly liable for invalidation.
581. The 3rd Petitioner was in consonance with the other Petitioners in faulting the impugned amendments for non-
compliance with the constitutional and statutory requirements for enactment of laws. The 3rd Petitioner asserts,
firstly, that the impugned amendments were passed without the input of the public. It cites the Doctors for Life
Case for the proposition that public participation in the conduct of public affairs ensures that citizens have the
necessary information and avails them an effective opportunity to exercise the right to political participation. Also
cited is the case of Poverty Alleviation Network & Others vs President of the Republic of South Africa & 19
others,CCT 86/08 [2010] ZACC 5, which was cited with approval inKenya Small Scale Farmers and Others vs
Republic and OthersNairobi [2013] eKLR on the essence of public participation, and for the observation that a
decision that is made without consulting the public can never be an informed decision.
582. According to the 3rd Petitioner, neither the public nor stakeholders were invited to submit their memoranda or
to participate in the public hearings held by the National Assembly. Further, that the public was not sensitized on
the contents of the impugned amendments and their effects. The 3rd Petitioner relies on the case of Minister of
Health and Another vs New Clicks South Africa (Pty) Ltd and Others2006 (2) SA 311 (CC) in support of the
proposition that what matters is that at the end of the day, a reasonable opportunity is offered to members of the
public and all interested parties to know about the issues and to have an adequate say; and that what amounts to a
reasonable opportunity will depend on the circumstances of each case.
583. The 3rd Petitioner submits that the court must look at the entire process to determine whether it meets
constitutional muster and relies in support on the 2013 Law Society Case. The 3rd Petitioner’s conclusion is that
the process of passing the impugned amendments was fundamentally flawed as the public was unable to submit
memoranda due to the short notice, and that there was no invitation to either present the memoranda or for public
hearings.
584. The Interested Parties who support the Petition also hold the view that the manner of the enactment of the
impugned amendments render them unconstitutional. They support the Petitioners’ claim that public participation
was insufficient. The 5th Interested Party cites the case of Kenya Union of Domestic, Hotels, Education and
Allied Workers (Kudheha Workers) vs Salaries and Remuneration Commission (2014) e KLR where the
court held that the Constitution, at Article 94, has vested legislative authority of the people of Kenya in Parliament,
and that Article 118 has provided for public participation and involvement in the legislative business. It opines that
introducing amendments that are controversial and substantive through an omnibus Amendment Act limits the
ability of persons to participate. Its view is that in the instant case, the general public only had 8 days to go through
the entire miscellaneous amendment Bill that was introducing amendments to the impugned Act and 66 other
statutes. In its view, even for the most elite members of society, this was an unconscionable burden.
585. It is also the case of the 5th Interested Party that there was no mention of the mandatory collection of personal
information by the State to aid in the functioning of NIIMS. There was therefore, in the 5th Interested Party’s view,
an entire facet of issues left out when the public was invited to give their views on the Bill. It is the 5th Interested
Party’s position that the public participated without information, and their participation was therefore not as
meaningful as it would have been had the public been made aware of the entirety of what NIIMS was to entail. The
5th Interested Party cites the case of Lucy Wanjiru & another vs Attorney General & another [2016]
eKLR which quotes the case of Secretary, Ministry of Information and Broadcasting Government of India &
Others vs Cricket Association of Bengal & Another [1995] 2 SCC 161 for the holding that the right to
participate in the affairs of the country is meaningless unless the citizens are well informed on all sides of the issues
in respect of which they are called upon to express their views.
586. The 6th Interested Party joined the Petitioners and the 5th Interested Party in faulting the process of enactment
of the impugned amendments. It submits that the public had a right to be informed before significant changes were

made to the law and given an opportunity to participate publicly in the making of public policies and laws. In
addition to the cases already cited by the Petitioners, the 6th Interested Party relied on the case of Samuel Thinguri
Waruathe and 2 Others v Kiambu County Government & 2 Others (2015) eKLR in support of the principle
that public views ought to be considered in the decision-making process and as far as possible, the product of the
legislative process ought to be a true reflection of the public participation. It is its submission further, that by using
an omnibus Bill to introduce significant changes to the law, the intention was not to enhance and facilitate public
awareness and participation but to dilute and circumvent that requirement.
587. It asserts that the Court of Appeal had, in the case of Law Society of Kenya v The Hon. Attorney General
& 2 others, [2019] eKLR, (hereafter the 2019 Law Society of Kenya Case) put a seal of approval on the stated
law on public participation and the place of omnibus Bills in the passing of laws.
588. The Respondents strenuously oppose the assertion by the Petitioners and the 5th and 6th Interested Parties.
They insist that the impugned amendments were passed in compliance with the Constitution. The 1st Respondent
submits that there was effective public participation and that the provisions of Article 118 of the Constitution were
complied with through publication of the Bill in the local newspapers. Further, that there is no averment that the
Petitioners or any other person was denied the opportunity to oversee the process leading to the enactment of the
legislation in issue. It is also the 1st Respondent’s case that the Petitioners can still invoke the provisions of Article
119 of the Constitution which allows members of the public to petition Parliament to amend, enact or repeal any
legislation, thereby providing another opportunity for public participation.
589. The 1st Respondent submits that public participation was facilitated through the National Assembly’s
Standing Orders. He relies on the 2013 Law Society of Kenya Case as affirming the position that the
Parliamentary Standing Orders by themselves facilitate public participation in legislative business. The 1st
Respondent asserts that the legislature is not bound to enact legislation in accordance with the views of any
particular interest group. Further, that public participation should not be used to overrule or veto the acts of the
legislature as proposed by the Petitioners. The 1st Respondent relies on the decision in Kenya Small Scale
Farmers Forum & 6 others vs Republic of Kenya & 2 others (supra) in support of the proposition that the
National Assembly has a broad measure of discretion on how it achieves the object of public participation and what
matters is that at the end of the day, a reasonable opportunity is offered to members of the public to know about the
issues and to have an adequate say.
590. The 1st Respondent further submits, again on the authority of Kenya Small Scale Farmers Forum & 6
others vs Republic of Kenya & 2 others, that what amounts to a reasonable opportunity for the public to
participate in the enactment of legislation will depend on the circumstances of each case. It is the 1st Respondent’s
case that the doctrine of public participation was complied with in this case in that on 7th May 2018, advertisements
were placed in both the Standard and Daily Nation newspapers asking for memoranda from stakeholders in respect
of the Statute Law (Miscellaneous Amendments) Bill 2018. Further, that the National Assembly Committee on
Administration and National Security held stakeholders meetings on 14th, 19th, and 20th June 2018 where the
stakeholders, who included the 3rd Petitioner were given an opportunity by the 6th Respondent to present their
views on the impugned amendments.
591. In the 1st Respondent’s view, not every person must express their views in order to satisfy the constitutional
requirement of public participation, citing in support of this argument the 2016 Law Society of Kenya Case.
According to the 1st Respondent, the 3rd Petitioner has not denied the fact that it participated in the process leading
to the passing of the impugned amendments, and that of itself is positive proof that public participation was real
and not illusory.
592. The 2nd and 3rd Respondents concur with the Petitioners that jurisprudence on the question of public
participation in the legislative process requires that the members of the public are given reasonable opportunity to

participate in the process. They however contend, relying on decision in Moses Munyendo & 908 Others vs The
Attorney General and Minister for Agriculture [2013] eKLR, that Parliament has a broad measure of discretion
on how it achieves the object of public participation, and that the manner in which public participation is effected
varies from case to case.
593. Although the 2nd and 3rd Respondents agree that it must be clear that a reasonable level of participation has
been afforded to the public, they argue that what constitutes a reasonable opportunity is incapable of precise
definition. They cite the decision of the South African Constitutional Court in the Doctors for Life Case for the
proposition that the nature and degree of public participation that is reasonable in a given case will depend on the
nature and importance of the legislation, and the intensity of its impact on the public. Further, that the legislature
should ensure that the potentially affected section of the population is given a reasonable opportunity to have a say.
594. The 2nd and 3rd Respondents concede that the impugned amendments affect the entire population resident in
Kenya. In their view, however, the effect on individual Kenyans is not as radical as submitted by the Petitioners.
They contend that the information being sought from Kenyans through NIIMS is substantially the same
information as was being sought from them prior to NIIMS. They assert that no substantial amendments were made
to the Act in that the impugned amendments merely sought, in digital form, biographical and biometric information
that was already registrable under the Act. In support of this assertion they submit that prior to the amendment,
section 5(1)(j) of the Act empowered the Registrar to collect such other particulars in addition to the biographical
and biometric information expressly outlined in section 5(1) of the Act. It is the 2nd and 3rd Respondents’ view
therefore, that the Registrar could still have requested for the information now sought under NIIMS based on the
law as it existed before the impugned amendments.
595. The 2nd and 3rd Respondents submit that it would not only have been impossible but would also have
amounted to imprudent use of resources to expect all Kenyan citizens and foreign nationals residing in Kenya to
submit their views on the impugned amendments. It is their position that in any case, reasonable opportunity was
provided for those who wished to submit views to do so. The 7th Interested Party is given as an example of an
organization which utilized the opportunity for public participation to the maximum. Further, that time was of
essence in the enactment of the impugned amendments as it was in the public interest to have a robust, efficient and
organized system of identity of persons especially in the wake of terror attacks in the country.
596. The 2nd and 3rd Respondents cite the South African decision in Land Access Movement of South Africa
Association for Rural Development and Others vs Chairperson of the National Council of Provinces and
Others(CCT 40/15) [2016] ZACC 22 in which the court held that the “standard to be applied in determining
whether Parliament has met its obligation of facilitating public participation is one of reasonableness” and that
“some deference should be paid to what Parliament considered appropriate in the circumstances, as the power to
determine how participation in the legislative process will be facilitated rests upon Parliament”. Further, that
the “Court must have regard to issues like time constraints and potential expense”.
597. The 2nd and 3rd Respondents rely on the averments by Mr. Michael Sialai, the Clerk to the National Assembly,
to stress that not only was public participation conducted, but it was also sufficient. According to the 2nd and 3rd
Respondents, the 3rd Petitioner had submitted memoranda in support of the establishment of NIIMS and it cannot
now turn around to demonise NIIMS. In their view, this amounts to approbating and reprobating and the 3rd
Petitioner should be denied the orders sought on this ground.
598. In their response to the claim by the Petitioners that the enactment of the impugned amendments did not
comply with the principle of public participation, the 4th and 7th Respondents submit that public participation was
indeed conducted in compliance with the law. They point to the 6th Respondent’s response as clearly evidencing
the fact that public participation was carried out. They place reliance on the decision in Josephat Musila Mutua &
9 others v Attorney General & 3 others [2018] eKLR in support of the assertion that the National Assembly has

a broad measure of discretion on how it can achieve the object of public participation and how public participation
is effected will vary from case to case but that it must be clear that a reasonable level of participation was afforded
to the public. They also cite the decision in the South African case of Land Access Movement of South Africa
Association for Rural Development and others vs Chairperson of the National Council of Provinces and
Others (supra) as establishing the law on the parameters to be considered in determining whether the standard of
public participation was met by the legislature.
599. In response to the contention that the time allowed for public participation was insufficient, the 4th and 7th
Respondents justify the sufficiency of the seven days given for members of public to provide their views by
referring to the decision in Simeon Kioko Kitheka & 18 others v County Government of Machakos & 2
others [2018] eKLR where it was observed that “even if the period is short but it is shown that the petitioner did in
fact participate in the enactment of the Bill, the Court would be reluctant to nullify the enactment in the absence of
any evidence that a member of the public was as a result of the short notice locked out from presenting his views.”
They submit that no evidence was adduced by the Petitioners to the effect that a member of the public was locked
out from presenting their views. They place reliance for this contention on the averment of Michael Sialai in the
supplementary affidavit sworn on 2nd May, 2019 on behalf of the 6th Respondent that stakeholders, including the
Petitioners and the Interested Parties supporting the Petitions, were promptly invited for stakeholders’ meetings
which were held between 7th May, 2018 and 20th June, 2018. They therefore conclude that there was sufficient
public participation.
600. On its part, the 5th Respondent submits that contrary to the claim by the Petitioners, the doctrine of public
participation was complied with in the enactment of the impugned amendments. The Robert Gakuru Case and
Doctors for Life Case as well as Minister of Health and Another v New Clicks South Africa (Pty) Ltd and
Others(2006) (2) SA 311 (CC); Land Access Movement of South Africa Association for Rural Development
and others v Chairperson of the National Council of Provincesand others (supra) ; Ngige Tharau & 128
Others v Principal Secretary of Lands, Housing and Urban Development & 2 others[2016] eKLR; Diani
Business Welfare Association and Others v The County Government Of Kwale [2015] eKLR; and Nairobi
Metropolitan PSV Saccos Union Ltd & 25 Others v County Government of Nairobi & 3 Others [2014] eKLR
are cited as espousing the law on public participation.
601. The 5th Respondent agrees with the other Respondents that the invitation for comments on the Statute
(Miscellaneous Amendment) Bill 2018 published in the Standard and Daily Nation newspapers is evidence of
public participation. He further argues that oral and written comments were received from various state agencies
and the affected stakeholders. On that basis, the 5th Respondent urges the Court to hold that reasonable opportunity
was granted to the members of the public to have a say on the impugned amendments.
602. The 6th Respondent, not surprisingly, submits passionately on the issue of the alleged unconstitutionality of the
impugned amendments. He starts by highlighting the principles for constitutional interpretation, noting, inter alia,
that in considering the constitutionality of an Act or a provision thereof, the rebuttable principle of presumption of
constitutionality of statutes should be taken into account. He further submits that the principle which states that
statutes should be presumed to be constitutional until the contrary is proved is founded on the philosophy that
Parliamentarians, as peoples’ representatives, legislate laws to serve the people they represent and therefore, as
legislators, they understand the problems people face and enact laws to solve the problems. It is further the 6th
Respondent’s case that Article 186(4) of the Constitution gives powers to Parliament to legislate on any matter for
the Republic of Kenya.
603. While referring to the facts of the case and the contents of the replying affidavit by Mr. Michael Sialai, the
Clerk of the National Assembly, the 6th Respondent submits that the evidence clearly reveals that the impugned
amendments were enacted in accordance with the Constitution. Accordingly, the impugned sections of the Act are
constitutional. The 6th Respondent points to the contents of the replying affidavit which he submits detail the

procedure used in passing the impugned amendments and which confirms full compliance with the Constitution.
604. The 6th Respondent stresses the legislative autonomy of the National Assembly by citing Articles 94 and 109
of the Constitution. It is his case that the two houses of Parliament can exercise their legislative will by enacting
laws and amending existing laws as well as Bills which are before them. He states that it was in exercise of that
power that the National Assembly debated and passed the Statute Law (Miscellaneous Amendments) Bill (National
Assembly Bill No. 12 of 2018) and the President assented to the Bill to become law.
605. With respect to the assertion by the Petitioners that there was no compliance with the principle of public
participation in the enactment of the impugned amendments, the 6th Respondent submits that the National
Assembly conducted public participation and took the views of the public into account as evidenced by the replying
affidavit of Mr. Michael Sialai. He cites the decision in the Robert Gakuru Case as stating the law on the
principle of public participation and points out that the said decision was upheld by the Court of Appeal. It is his
submission that the decisions in the Robert Gakuru Case and the 2016 Law Society Case confirm the principle
that not all persons must express their views on the proposed legislation in order for the principle of public
participation to be satisfied.
606. The 6th Respondent maintains that the requirement for public participation was met. He points out that during
the process of the enactment of the Statute Law (Miscellaneous Amendment), 2018 each National Assembly
Departmental Committee was tasked to examine each amendment as if they were distinct legislations. He further
argues that in the advertisement calling for submission of comments, each thematic area was distinctively before a
relevant departmental committee as per the Second Schedule of the National Assembly Standing Orders. It is also
his submission that in the newspaper advertisements, the committee to deal with each subject matter was indicated
hence giving guidance to the public on where to make representations.
607. The 6th Respondent, reiterates in his submissions the averments by Mr. Sialai that each proposed amendment
was treated separately since, during debates on the Bill, the Chairpersons of the respective committees were given
time to indicate views of the committees and the public; that unlike in the past where all the amendments were
moved by the Chairman of the Justice and Legal Affairs Committee, in this instance, the Chairpersons of the
relevant committees moved their respective amendments. It is his submission that these were deliberate
adjustments of the rules of procedure to accommodate examination of the amendments by the House.
608. In its submissions, the 1st Interested Party agrees with the Respondents that the legislative process of the
impugned amendments was not attended by any constitutional infirmity. On the issue of public participation, its
submission is that the 6th Respondent’s affidavits particularly demonstrate beyond any shadow of doubt that
advertisements were placed in the print media inviting members of the public to submit memoranda on the Bill that
culminated in the enactment of the impugned amendments.
609. The 1st Interested Party urges the court to give space to Parliament to discharge its constitutional mandate. It
cites in support of this argument the South African case of Land Access Movement of South Africa Association
for Rural Development and others v Chairperson of the National Council of Provinces and others (supra) in
which it was observed that when determining the question whether Parliament’s conduct was reasonable, some
deference should be paid to what Parliament considered appropriate in the circumstances. This is on the basis that
the power to determine how participation in the legislative process will be facilitated rests upon Parliament. The 1st
Interested Party also relies on The 2016 Law Society Case in which it was stated that with regard to public
participation, the court has to look at the entire process and Parliamentary Standing Orders. The 1st Interested Party
concludes that the Petitioners have not demonstrated that the law was not followed in the enactment of the
impugned amendments and calls for the dismissal of the Petitions.
610. We have considered the respective submissions of the parties on the question whether the principle of public

participation was complied with in the enactment of the impugned amendments. We observe at the outset that the
need to involve the public in the legislative processes is grounded in the Constitution.
611. The national values and principles of governance set out in Article 10(2) of the Constitution include
democracy and participation of the people, good governance, transparency and accountability. Participation of the
people in governance is therefore a constitutional imperative. In reference to the legislative process, the concept of
public participation is cemented by Article 118(1) which requires Parliament to conduct its business in an open
manner. Its sittings and those of its committees are to be opened to the public. Apart from the requirement for
transparency, the Constitution directs Parliament and its committees to facilitate public participation and
involvement in its legislative processes and other businesses.
612. The principle of public participation is recognized internationally. In the Doctors for Life Case, Ngcobo, J.
observed that this principle is embedded in international and regional human rights instruments. The doctrine
encompasses the right to participate in political affairs as well as the indirect participation through elected
representatives. There is also the general right to directly take part in the conduct of public affairs. The latter is the
aspect of the principle of public participation that is of concern to us in this matter.
613. In the Doctors for Life Case, Ngcobo, J highlighted the ingredients of the right of the public to participate in
governance affairs and the measures to be taken in order to fulfill this obligation. He stated that:
“The general right to participate in the conduct of public affairs includes engaging in public debate and
dialogue with elected representatives at public hearings. But that is not all; it includes the duty to facilitate
public participation in the conduct of public affairs by ensuring that citizens have the necessary information and
effective opportunity to exercise the right to political participation…. Thus construed, there are at least two
aspects of the duty to facilitate public involvement. The first is the duty to provide meaningful opportunities for
public participation in the law-making process. The second is the duty to take measures to ensure that people
have the ability to take advantage of the opportunities provided. In this sense, public involvement may be seen as
“a continuum that ranges from providing information and building awareness, to partnering in decision-
making.” This construction of the duty to facilitate public involvement is not only consistent with our
participatory democracy, but it is consistent with the international law right to political participation. As pointed
out, that right not only guarantees the positive right to participate in the public affairs, but it simultaneously
imposes a duty on the State to facilitate public participation in the conduct of public affairs by ensuring that this
right can be realised.”
614. The Learned Judge went on to identify the fruits of participatory democracy by stating that:
“The participation by the public on a continuous basis provides vitality to the functioning of representative
democracy. It encourages citizens of the country to be actively involved in public affairs, identify themselves
with the institutions of government and become familiar with the laws as they are made. It enhances the civic
dignity of those who participate by enabling their voices to be heard and taken account of. It promotes a spirit of
democratic and pluralistic accommodation calculated to produce laws that are likely to be widely accepted and
effective in practice. It strengthens the legitimacy of legislation in the eyes of the people. Finally, because of its
open and public character it acts as a counterweight to secret lobbying and influence peddling. Participatory
democracy is of special importance to those who are relatively disempowered in a country like ours where great
disparities of wealth and influence exist. Therefore our democracy includes as one of its basic and fundamental
principles, the principle of participatory democracy. The democratic government that is contemplated is partly
representative and partly participatory, is accountable, responsive and transparent and makes provision for
public participation in the lawmaking processes”.
615. Although Ngcobo, J acknowledged that the law requires the involvement and the facilitation of the public in

public affairs, he was of the view that the manner and means of achieving public participation in the legislative
processes should be left to Parliament. In that regard, he held that:-
“Parliament and the provincial legislatures must be given a significant measure of discretion in determining
how best to fulfil their duty to facilitate public involvement. This discretion will apply both in relation to the
standard rules promulgated for public participation and the particular modalities appropriate for specific
legislative programmes. Yet however great the leeway given to the legislature, the courts can, and in appropriate
cases will, determine whether there has been the degree of public involvement that is required by the
Constitution. What is required by section 72(1)(a) will no doubt vary from case to case. In all events, however,
the NCOP must act reasonably in carrying out its duty to facilitate public involvement in its processes”.
616. The fact that non-compliance with the principle of public participation can result in the declaration of a law
invalid was confirmed by Ngcobo J when he held that:
“When legislation is challenged on the grounds that Parliament did not adopt it in accordance with the
provisions of the Constitution, courts have to consider whether in enacting the law in question Parliament has
given effect to its constitutional obligations. If it should hold in any given case that Parliament has failed to do
so, it is obliged by the Constitution to say so. And insofar as this constitutes an intrusion into the domain of the
legislative branch of government, that is an intrusion mandated by the Constitution itself. What should be made
clear is that when it is appropriate to do so, courts may – and if need be must – use their powers to make orders
that affect the legislative process. Therefore, while the doctrine of separation of powers is an important one in
our constitutional democracy, it cannot be used to avoid the obligation of a court to prevent the violation of the
Constitution.”
617. As to what the court should consider in determining whether the constitutional standards of public
participation were met in the enactment of a given legislation, Ngcobo, J identified some of the factors to be taken
into account as follows:-
“Whether a legislature has acted reasonably in discharging its duty to facilitate public involvement will depend
on a number of factors. The nature and importance of the legislation and the intensity of its impact on the
public are especially relevant. Reasonableness also requires that appropriate account be paid to practicalities
such as time and expense, which relate to the efficiency of the law-making process. Yet the saving of money and
time in itself does not justify inadequate opportunities for public involvement. In addition, in evaluating the
reasonableness of Parliament’s conduct, this Court will have regard to what Parliament itself considered to be
appropriate public involvement in the light of the legislation’s content, importance and urgency. Indeed, this
Court will pay particular attention to what Parliament considers to be appropriate public involvement. What is
ultimately important is that the legislature has taken steps to afford the public a reasonable opportunity to
participate effectively in the law-making process.”
618. It is not incorrect to state that the development of the law on public participation in the legislative process is
advanced in our jurisdiction. There are quite a number of decisions in this area. Odunga, J. did comprehensive work
on the issue in his decision in the Robert Gakuru Case. The learned Judge extensively reviewed the jurisprudence
relating to the principle of public participation and reached the conclusion that:-
“In my view public participation ought to be real and not illusory and ought not to be treated as a mere formality
for the purposes of fulfilment of the Constitutional dictates. It is my view that it behoves the County Assemblies
in enacting legislation to ensure that the spirit of public participation is attained both quantitatively and
qualitatively. It is not just enough in my view to simply “tweet” messages as it were and leave it to those who
care to scavenge for it. The County Assemblies ought to do whatever is reasonable to ensure that as many of
their constituents in particular and the Kenyans in general are aware of the intention to pass legislation and

where the legislation in question involves such important aspect as payment of taxes and levies, the duty is even
more onerous. I hold that it is the duty of the County Assembly in such circumstances to exhort its constituents
to participate in the process of the enactment of such legislation by making use of as may (sic) fora as possible
such as churches, mosques, temples, public barazas national and vernacular radio broadcasting stations and
other avenues where the public are known to converge to disseminate information with respect to the intended
action”.
619. In the 2019 Law Society Case the Court of Appeal stressed the place of the principle of public participation in
governance by stating that:
“From the finding above, the learned judge ought to have found in favour of the appellant based on the claim
made on the lack of public participation. It was an error for the learned judge to require the appellant to prove
the negative, for once it states there was no public participation, the burden shifted to the respondents to show
that there was. Much weight has been placed on public participation because it is the only way to ensure that the
Legislature will make laws that are beneficial to the mwananchi, not those that adversely affect them.
Additionally, the onus is on Parliament to take the initiative to make appropriate consultations with the affected
people. It is therefore a misdirection for the learned judge to hold that the appellant had the responsibility to
prove that the consultations did not happen. We believe that the principle behind the amendments is what must
be interrogated. The 1st respondent is not possessed of an unfettered or carte blanche leeway to table legislation
that is detrimental to the people of Kenya or a section of the citizenry. It must follow due process which includes
consultation with stakeholders. The Constitution establishes that mechanism to enable the Legislature make
laws that are reasonable, having sought and obtained the views of the people. That is the essence of an
accountable limited Government and the shift from the supremacy of Parliament to the Sovereignty of the
people birthed by the 2010 Constitution.”
620. The principle of public participation does not require the legislature to conduct a census-like exercise of
knocking at the door of every person residing in its jurisdiction with a view to confirming that the residents have
given their opinions on a contemplated legislative measure, and where no comments are forthcoming, to
‘forcefully’ extract opinions from residents. The duty placed upon the legislature by the law is to inform the public
of its business and provide an environment and opportunity for those who wish to have a say on the issue to do so.
Indeed in the case of Kiambu County Government & 3 others v Robert N. Gakuru & Others [2017]
eKLR, the Court of Appeal aptly summarized the principle of public participation thus:-
“The bottom line is that public participation must include and be seen to include the dissemination of
information, invitation to participate in the process and consultation on the legislation.”
621. Public participation requires that the legislature takes into consideration the views expressed by the public.
The importance of taking into consideration the views received from the public in the legislative process was
affirmed by Sachs, J in the South African case of Merafong Demarcation Forum and Others v President of the
Republic of South Africa and Others (CCT 41/07) [2008] ZACC 10; 2008 (5) SA 171 (CC); 2008 (10) BCLR
968 (CC) when he stated that:-
“The passages from the Doctors for Life majority judgment, referred to by the applicants, state reasons for
constitutionally obliging legislatures to facilitate public involvement. But being involved does not mean that
one’s views must necessarily prevail. There is no authority for the proposition that the views expressed by the
public are binding on the legislature if they are in direct conflict with the policies of Government. Government
certainly can be expected to be responsive to the needs and wishes of minorities or interest groups, but our
constitutional system of government would not be able to function if the legislature were bound by these views.
The public participation in the legislative process, which the Constitution envisages, is supposed to supplement

and enhance the democratic nature of general elections and majority rule, not to conflict with or even overrule
or veto them. To say that the views expressed during a process of public participation are not binding when they
conflict with Government’s mandate from the national electorate, is not the same as cynically stating that the
legislature is not required to keep an open mind when engaging in a process of that kind. Public involvement
cannot be meaningful in the absence of a willingness to consider all views expressed by the public.”
622. As emerges from the submissions above, all the parties agree that public participation is a key element in the
achievement of democratic governance and is a constitutional imperative. All the parties also agree that the 3rd
Respondent invited memoranda from the public through adverts in the Standard and Daily Nation newspapers of
7th May, 2018. According to the Respondents and the Interested Parties opposing the Petition, the advertisement
fulfilled the constitutional requirement for public participation. The Petitioners and the Interested Parties who
support the Petition think otherwise. The issue for determination therefore revolves around the sufficiency or
otherwise of the public participation conducted in respect of the impugned amendments.
623. In Mui Coal Basin Local Community & 15 Others (supra) the Court expressed itself on the question of
threshold of public participation as follows:
“92. The main question in this context then becomes, what is the test for determining if the threshold of public
participation has been met" We are aware that several Courts in Kenya have dealt with the issue. The emerging
position in Kenya is exemplified by the decision and reasoning of Justice Emukule in John Muraya Mwangi&
495 Others & 6 Others V Minister For State For Provincial Administration & Internal Security & 4 Others
[2014 eKLR. Since it demonstrates the emerging consensus, we apologise for quoting at length the reasoning of
the Learned Judge thus:
“The concept of public participation enshrined in Articles 10 and 12 of the Constitution of Kenya 2010, is a
difficult one but needs to be given effect both before and after legislative enactment. This may take several
forms:-
i. The concept envisages political participation in the conduct of public affairs, such as the right to vote, and to
be elected or appointed to public office,
ii. The right to be engaged in public debate and dialogue with elected representatives at public hearings,
iii. The duty to facilitate public participation in the conduct of public affairs,
i. Ensuring that ordinary citizens the “hoi polloi,” the “lala hoi” have the necessary information and are given
opportunity to exercise their say not merely in election and appointment to political office but also economic
participation, and conduct of their affairs.”
624. As to how to determine whether the public participation conducted was sufficient, the Court stated that:
“96. The issue then arises of how we measure what is sufficient. In our determination we agree with the test
applied in the Merafong Demarcation case and state that, the method and degree of public participation that is
reasonable in a given case depends on a number of factors, including the nature and importance of the issue at
hand and the intensity of its impact on the public.”
625. Even though the cited principles are couched in the context of the day to day governance of the populace, we
find them applicable to some extent to execution of legislative business by Parliament.
626. Through Standing Order No. 127 of the National Assembly Standing Orders (4th Edition), the National

Assembly incorporates the constitutional principle of public participation in its legislative business by providing
that:
“127. (1) A Bill having been read a First Time shall stand committed to the relevant Departmental Committee
without question put.
(2) ….
(3) The Departmental Committee to which a Bill is committed shall facilitate public participation on the Bill
through appropriate mechanism, including-
(a) inviting submission of memoranda;
(b) holding public hearings;
(c) consulting relevant stakeholders in a sector; and
(d) consulting experts on technical subjects.
(3A) The Departmental Committee shall take into account the views and recommendations of the public under
paragraph (3) in its report to the House.”
627. We find that the said provision does indeed incorporate the principles of public participation. A close reading
of the provision readily discloses that Parliament has the discretion on the method to be used in collecting views
from the public, stakeholders and experts. This observation is in line with the case law on public participation.
628. In the Doctors for Life case Ngcobo, J was of the opinion that:
“Whether a legislature has acted reasonably in discharging its duty to facilitate public involvement will depend
on a number of factors. The nature and importance of the legislation and the intensity of its impact on the
public are especially relevant. Reasonableness also requires that appropriate account be paid to practicalities
such as time and expense, which relate to the efficiency of the law-making process. Yet the saving of money and
time in itself does not justify inadequate opportunities for public involvement. In addition, in evaluating the
reasonableness of Parliament’s conduct, this Court will have regard to what Parliament itself considered to be
appropriate public involvement in the light of the legislation’s content, importance and urgency. Indeed, this
Court will pay particular attention to what Parliament considers to be appropriate public involvement. What is
ultimately important is that the legislature has taken steps to afford the public a reasonable opportunity to
participate effectively in the law-making process.”
629. The Petitioners and the Interested Parties who support them have decried the lack of information in regard to
the impugned amendments and NIIMS itself. They also raise the issue of the sufficiency of time given to the public
to submit their views. The request for representations from the public was published in the newspapers on 7th May,
2018, and the representations were to be submitted before the close of business on 14th May, 2018. The
Respondents and the Interested Parties aligned to their cause insist that the pre-enactment information on the
impugned amendments and the post-enactment education on NIIMS was sufficient in the circumstances of this
case.
630. We note that neither of the parties addressed us on which party bears the responsibility of informing the public
on the Bills for purposes of public participation in the legislative process. This is in light of the fact that the
legislative process begins from policy formulation stage, and the sponsor of a legislation, who has the background

information, is a different entity from Parliament. Therefore, placing the onus on Parliament alone in this respect
may be impracticable and unreasonable. In addition, there are opportunities to engage citizens at various stages of
the legislative process, and these can be coordinated by various actors who are responsible for the process at any
given stage, including during the content development of a Bill. Accordingly, there are roles to be played by the
Executive, civil society and Parliament in education the public as actors in the various stages of the development of
a Bill.
631. Be that as it may, we note that the 6th Respondent annexed a copy of the Statute Law (Miscellaneous
Amendments Bill) 2018 together with a Memorandum of Objects and Reasons to its Replying Affidavit sworn on
28th February 2019 by Michael Sialai. The said Memorandum of Objects and Reasons explained that the Bill
proposed to amend the Registration of Persons Act to establish the National Integrated Identity Management
System, and provide for the capture of biometric data and geographical data in the registration of persons in Kenya.
The said Bill was published in the Kenya Gazette Supplement No. 35 (National Assembly Bills No 12) on 10th
April 2018. In terms of the legislative process, the Bill and Memorandum of Reasons and Objects was therefore in
the public domain from 10th April 2018.
632. The 6th Respondent also annexed a copy of the advertisement in the Daily Nation newspaper of 7th May 2018.
The said advertisement informed the public about three events. Firstly, on the publication of the Bill on 10th April
2018. Secondly, that the amendments in the Bill to the various Acts would be committed to various Departmental
Committees of the National Assembly that were listed in the advertisement. Lastly, of an invitation to members of
the public to submit any representations they may have on the Bill. In this respect, the amendments to the
Registration of Persons Act were shown to be committed to the Administration and National Security Committee
of the National Assembly. The minutes of the sittings of the said Committee on 14th, 19th, and 20th June 2019 when
the amendments were discussed were also annexed, as was a copy of a memorandum sent by the 3rd Petitioner
dated 25th May 2018 on the said amendments.
633. The Petitioners on the other hand rely on the advertisement published on 7th May 2018 to show that there was
insufficient time for public participation, and the contents of the Bill, which was amending 68 Acts of Parliament.
634. Our view is that the time that was available for public participation must be considered in light of all the
processes of the legislative process. In the present Petition, the evidence before us suggests that the public was
aware of the Bill from 10th April 2018, when it was published, and could have participated from that date. The
purpose of publication of Bill in this regard is to notify the public and invite representations through the elected
Members or direct submission of memoranda and petitions. It is therefore not entirely correct to state that the
members only had the seven days indicated in the advertisement of 7th May 2018 to present their views on the Bill.
Even after expiry of the seven days, the doors were not closed for members of the public to participate, as there was
still opportunity to participate during the committee hearings as shown in Standing Order 127. The evidence from
the Respondent demonstrates that this opportunity was availed, and that indeed there was participation by the 3rd
Petitioner even after expiry of the time stated in the advertisement. It is thus our finding that sufficient time was
availed for public participation on the enactment Statute Law (Miscellaneous Amendments Bill) 2018.
635. There is sufficient authority for the proposition that the entire process has to be interrogated in order to
determine whether the requirement for public participation was fulfilled in respect of a given law. In 2013 Law
Society Case the Court held that:
“In order to determine whether there has been public participation, the court is required to interrogate the entire
process leading to the enactment of the legislation; from the formulation of the legislation to the process of
enactment of the statute.”
636. We also recognize that there were efforts made by the National Assembly in facilitating public participation

when using the omnibus Bill mechanism in the Statute Law (Miscellaneous Amendments) Bill 2018. Unlike in the
case of 2013 Law Society Case where the object of the Bill was clearly indicated as intended to effect minor
amendments, in the instant case there was clear indication that the legislature intended to carry amendments on the
targeted Acts without the use of the term ‘minor”. It is also clear that from the advertisement of 7th May 2018 that
each Act targeted for amendment was linked to the relevant committee. Therefore, in effect, only a part of the
amendments and not all of them were subject to stakeholder engagement in the Committees. Coupled with the fact
that there was sufficient time availed to the public to give their views on the amendments, we find that there was
sufficient public participations in the circumstances of these Petitions.
The Use of an Omnibus Bill to Effect the Impugned Amendments
637. The second aspect of the Petitioners’ challenge to the impugned amendments is that it was effected by way of
an omnibus miscellaneous statute. In this regard, the 1st Petitioner submits that the violation of the Constitution can
occur either through form or content. Its view is that whether the violation is one of form or content, any violation
is sufficient for the court to find that an impugned law is unconstitutional. The position taken by the 1st Petitioner is
that the impugned amendments were substantive since they were fashioned to overhaul the manner in which
registration and identification of Kenyans and foreign nationals is done. They also created a new system of
registration and storage of the data. The 1st Petitioner identified the various laws affected by the amendments to
demonstrate the far-reaching effects of the changes.
638. Additionally, the 1st Petitioner submits that the implementation of NIIMS affects, in different ways, other
aspects regulated by other laws, for example the Children Act, Prevention of Terrorism Act and the National Police
Service Act. Moreover, the infrastructural outlay required to implement it is enormous and it further affects many
other areas of both national and county governments’ competencies, including provision of services such as health,
education and housing. The 1st Petitioner contends that the implementation of NIIMS affects significant aspects of
public administration and straddles areas of constitutional competencies of both national and county governments
and at least in part, it seeks to implement the 2017 Nouakchott Declaration of the African Union on digitization.
639. In light of these submissions, the 1st Petitioner contends that the use of the miscellaneous amendment process
was inappropriate considering that the courts have limited the use of the process for minor and non-controversial
amendments. Reliance is placed on the decision in the 2016 Law Society Case where it was held that omnibus
amendments in the form of statute law miscellaneous legislations ought to be confined only to minor non-
controversial and generally house-keeping amendments.
640. The 1st Petitioner’s position is that the empowerment of the Respondents by the law to collect sensitive
personal information such as DNA and GPS coordinates can neither be minor nor non-controversial. Moreover, the
major amendments to the Act involve spending of significant amounts of public funds, involve the introduction of a
new registration body and processes, and will prejudicially affect the rights of persons. Such amendments, in the 1st
Petitioner’s view, ought not to have been done through a miscellaneous amendment. It is therefore the 1st
Petitioner’s submission that the use of miscellaneous amendment process to effect significant amendments to the
Act is unconstitutional and to that extent, the amendments are null and void.
641. The 2nd Petitioner supports the position taken by the 1st Petitioner on the use of an omnibus law. It also places
reliance on the 2016 Law Society Case for the proposition that the use of the omnibus procedure in the enactment
of laws ought to be confined only to minor non-controversial and generally house-keeping amendments. It asserts
that the impugned amendments have far-reaching implications on fundamental rights and freedoms protected under
the Bill of Rights. In the 2nd Petitioner’s opinion, the impugned amendments not only deserved robust input from
the public but were also deserving of better and intense debate and deliberations by the National Assembly and the
Senate to ensure proper consideration of all the concerns.

642. The 2nd Petitioner contends that embedding the impugned amendments in an omnibus Bill containing
amendments of 67 other statutes unnecessarily rushed their passage with the obvious consequence that the public
and Parliament itself were deprived of the opportunity to exhaustively debate the reasonableness and necessity of
the amendments relative to their stated objective. Further, that if the proceedings of the relevant Departmental
Committee and the Whole House are anything to go by, it is ex facie evident that in spite of their apparent
implications on fundamental rights and freedoms and particularly the right to privacy, the full import of the
amendments was not at all debated and the logical inference from this is that either the legislators did not
appreciate the extensive consequences of the amendments or they had no reasonable opportunity to debate them, as
they would have done, had the impugned amendments been presented as a stand-alone Bill. In the 2nd Petitioner’s
view, the enactment of the impugned amendments amounted to abuse of legislative discretion and a breach of
public trust.
643. The 3rd Petitioner joined the 1st and 2nd Petitioners in faulting the National Assembly for using an omnibus Bill
to pass the impugned amendments. It is the 3rd Petitioner’s submission that statutory amendments by way of statute
law miscellaneous legislation should strictly be confined to cases of minor non-controversial amendments as was
held in the 2019 Law Society Case. Its view is that the impugned amendments breached the said legal principle in
that the amendments were substantial and should not have been introduced through a Miscellaneous Amendment
Act.
644. The 5th Interested Party also agrees with the position taken by the Petitioners and the authorities relied on in
support of the contention that omnibus amendments in the form of Statute Law Miscellaneous legislation ought to
be confined only to minor non-controversial and generally house-keeping amendments. It further cites the case of
Okiya Omtatah v The Communication Authority of Kenya & 21 others [2017] eKLR for the proposition that
an omnibus Bill is designed to make only relatively minor, non-controversial amendments to various Acts and to
repeal Acts that are no longer required and assist in expediting the government’s legislative programme and
Parliamentary business by reducing the number of separate amendment Bills that deal with relatively minor
amendments and repeals. Further, that an amendment that has an impact on either the letter or the spirit of the
Constitution, however remotely, cannot be termed a minor, non-controversial house-keeping amendments. The 5th
Interested Party therefore submits that NIIMS squarely falls outside the confines of the province of ‘minor non-
controversial and generally house-keeping amendments’ and ought not to have been passed as a miscellaneous
amendment.
645. The 5th Interested Party identifies the large amount of public funds spent in the creation of NIIMS as another
facet of the defects in the procedure used in the enactment of the legislation establishing it. It also relies on the
2016 Law Society Case in which the Court relied on the Canadian Miscellaneous Statute Law Amendment
Program to hold that for a Bill to qualify as non-controversial, it should not involve the spending of public funds,
prejudicially affect the rights of persons, or create new offences or subject a new class of persons to an existing
offence. It is the 5th Interested Party’s case that the Respondents are on record as admitting expenditure of public
funds on the project. It submits that for the above reasons, it was improper to introduce NIIMS through a Statute
Law (Miscellaneous) Amendment Bill. The 5th Interested Party therefore asks the court to find that the amendments
were unlawful and unconstitutional.
646. The 6th Interested Party agrees with the Petitioners on the unconstitutionality of the impugned amendments. It
asserts that the very use of an omnibus Statute Law Miscellaneous Amendment Act betrayed the mischief on the
part of the Respondents, which was to defeat the public’s right and interest to examine the legislation and
participate in public affairs and governance. In its view, the object and scope of a Statute Law Miscellaneous
Amendment Act is to correct anomalies, inconsistencies, outdated terminology or errors, which are minor, non-
controversial amendments to a number of statutes using a single Bill.
647. According to the 6th Interested Party, the impugned amendments were prima facie not minor or non-

controversial as they did not seek to correct anomalies, inconsistencies or outdated terminology or errors but
instead brought about significant changes to the law and introduced wholly new concepts. To buttress this
argument, the decision in the 2016 Law Society Case is identified as explaining the circumstances under which
statutory amendments can be made by use of Statute Law Miscellaneous legislation. It is its submission that the
five-judge bench which heard the matter looked at the position in various countries and ultimately concluded that
while there is no internationally accepted position on the legality of omnibus Bills, both on policy and good
governance, omnibus amendments in the form of Statute Law Miscellaneous legislations ought to be confined only
to minor non-controversial and generally house-keeping amendments.
648. On the authority of the case of Josephat Musila Mutua & 9 Others v Attorney General & 3 Others (2018)
eKLR the 6th Interested Party contends that provisions that affect fundamental rights and freedoms are substantial
amendments. It submits that the introduction of the new markers or identifiers into the Act were not minor or
insignificant amendments but were significant changes with serious import on the fundamental rights and freedoms
of Kenyans, clawing back on the autonomy of Kenyans and the right to be informed and to have a say on such
significant matters of constitutional significance.
649. The Respondents counter the arguments by the Petitioners and Interested Parties who support them by arguing
that there is no constitutionally prescribed procedure for amendment of any statute. According to the 1st
Respondent, the Constitution envisages that it is the legislature that will formulate the procedure for enactment of
legislation, provided the procedure facilitates public participation and public access as required under Articles 118
and 124 of the Constitution. Further, that legislative procedure and policy are exclusively within the ambit of the
legislature under the doctrine of separation of powers and the court and any other arm of government ought not to
question the wisdom of Parliament in preferring one procedure over another provided such procedures are
facilitative of public participation and access. The 1st Respondent takes the view that global jurisprudence on when
and how omnibus Bills can be used is contradictory.
650. As regards the procedural propriety of the enactment of the impugned amendments, the 2nd and 3rd
Respondents submit that the law was complied with. They contend that Article 124 of the Constitution allows the
National Assembly to establish its own procedures for the conduct of its proceedings. Further, that Article 109
vests in Parliament absolute power to exercise legislative powers through Bills. It is their case that pursuant to the
practice of the National Assembly, a Miscellaneous Amendment Bill connotes a Bill that amends various
legislations. They state that the Bill in contention was indeed titled “A Bill for an Act of Parliament to make
various amendments to statute law,” and was not described by the phrase “minor amendments”. More importantly,
that during the enactment of the Bill, each Departmental Committee examined respective clauses of relevance to
their dockets as if they were distinct legislations. That in particular, Clause 9, which forms the subject matter of
these proceedings was examined by the National Assembly Committee on Administration and National Security.
The 2nd and 3rd Respondents observe that during the debates on the Bill, the chairpersons of the respective
committees were given an opportunity to submit the views of their respective committees and the public.
651. It is the 2nd and 3rd Respondents’ further argument that as was held by the Supreme Court in its advisory
opinion in the case of Speaker of the Senate & another v Attorney-General & 4 others [2013] eKLR, courts
should not supervise the workings of Parliament. They therefore urge the court to allow Parliament to regulate its
internal matters as affirmed by the Supreme Court. Further, that it cannot be argued that the usage of a Statute Law
(Miscellaneous Amendments) Bill militated against effective public participation for the simple reason that the
National Assembly took steps to ensure that the quality of public participation was not compromised.
652. On their part, the 4th and 7th Respondents submits that the Petitioners’ allegation that introducing substantive
amendments through omnibus means is unconstitutional lacks any constitutional foundation. Their case is that the
Petitioners have failed to set out with a degree of precision the constitutional provision alleged to have been
infringed. In their view, in the absence of a claim that the legislation passed by the legislature or the process by

which the legislation was enacted violates the Constitution, any consideration of the matter by this Court would
amount to unconstitutional intrusion on Parliament’s legislative mandate and a violation of the doctrine of
separation of powers. This averment is supported by the decision in United States v Butler, 297 U.S. 1[1936].
653. In response to the Petitioners’ allegation that the omnibus Bill inhibited public participation hence violated
Articles 10(2)(a) and 118(1)(b) of the Constitution, the 4th and 7th Respondents submit that no evidence was
tendered before this Court to demonstrate that due to the nature, form and structure of the Statute Laws
(Miscellaneous Amendments) Act No. 18 of 2018), a member of the public was prevented from presenting their
views to Parliament. They therefore urge the Court to hesitate to supervise the manner in which Parliament
executes its legislative mandate in the absence of a link between the impugned amendments and a specific
constitutional or statutory provision that has been violated or is threatened with violation.
654. It is the 4th and 7th Respondents’ submission that the effectiveness of the legislative mechanism of omnibus
Bills must be considered against the importance of the principle of the separation of powers and the principles of
representative democracy. In support of this assertion, they cite the decision of the Supreme Court of Israel in
Israel Poultry Farmers Association v. Government of Israel HCJ 4885/03 at 383 where it was held that not
every formal defect in the legislative process and not every case of ultra vires would lead to intervention in the
legislative process by the court. Further, that for the law to be invalidated, it is not sufficient to prove a violation of
a basic principle of the legislative process, such as the principle of participation, but it is also necessary to show a
severe and substantial violation of that principle.
655. The 4th and 7th Respondents’ assertion that there was nothing wrong in the use of an omnibus Bill to effect the
impugned amendments was boosted by a reference to the doctrine of separation of powers. It is the 4th and 7th
Respondents’ contention that the doctrine of separation of powers is not alien to our jurisprudence as was stated by
the Court of Appeal in Mumo Matemu v Trusted Society of Human Rights Alliance & 5 Others C. A. No. 290
of 2012. They contend that though the arms of government are co-dependent, each branch is reasonably expected to
perform its constitutional functions in the best interest of the people on whom sovereign power lies. In doing so, it
is presumed that the decisions taken by each branch of government are legitimate and rational, until the contrary is
proven. The decision in the case of Community Advocacy and Awareness Trust & 8 others v Attorney General
& 6 others [2012] eKLR is relied on in support of the proposition that courts must resist the temptation to second-
guess the legislature or act as a super legislature and review every piece of legislation. The 4th and 7th Respondents
stress that by dint of Article 94 (1) as read with Article 94(5) of the Constitution, legislative authority is exclusively
vested in Parliament and no other person or body has the power to make provisions having the force of law in
Kenya.
656. The 4th and 7th Respondents conclude by submitting that nowhere in the Constitution or the Standing Orders of
the National Assembly is it prescribed that a Bill should contain a single subject; what is referred to as the ‘single
subject rule’ provision. It is their submission that unlike in the United States of America where 43 States have the
‘single subject provision’, Kenya has no such provision and it would amount to an infraction of the legislative
prerogative of Parliament to arrive at the Petitioners’ desired outcome by reading non-existent provisions into the
Constitution. It is their case that the Petitioners’ allegation that omnibus Bills infringe Articles 10, 73, 93(2) and
94(4) is therefore unfounded. In their view, the cited provisions espouse the constitutional principles that bind
Parliament in the discharge of its legislative mandate and nothing more. Further, that the Petitioners had failed to
adduce cogent evidence to demonstrate the manner in which the Respondents had violated the Constitution and the
specific Article violated.
657. The 5th Respondent did not make any comments on the use of an omnibus Bill to enact the impugned
amendments. In support of his position that the impugned amendments were not unconstitutional for having been
passed by way of an omnibus Bill, the 6th Respondent argues that a Miscellaneous Amendment Bill amends various
legislations and the long title of the Bill usually states the intention and purpose of the Bill. He notes that the long

title for the Statute Law (Miscellaneous Amendment) Bill 2018 was “A Bill for AnActof Parliament to make
various amendments tostatute law”, and, unlike the Statute Law (Miscellaneous Amendment) Bills for 2015 and
2016 whose long titles were “A Bill for An Act of Parliament to make minor amendments to statute law”, the word
‘minor’ was not used in the 2018 statute. He asserts that neither the Constitution nor the rules of the National
Assembly disallow the use of miscellaneous amendment Bills.
658. Developing his case from the above assertions, the 6th Respondent argues that Article 124 of the Constitution
gives the National Assembly power to establish Standing Orders to regulate conduct of Parliamentary proceedings.
He submits that Article 109 of the Constitution gives absolute power to Parliament to exercise legislative authority
which is derived from the people. The implication of this, in the 6th Respondent’s view, is that the Constitution has
not defined and or limited the legislative processes and powers of Parliament and it is left to each House of
Parliament to develop in the Standing Orders how to initiate Bills and other legislative processes. It is the 6th
Respondent’s contention that it would have been different if the Constitution had imposed a limitation on this
function or on the nomenclature of Bills to be determined by Parliament. The decision in the case of Transparency
International v Attorney General and 2 others, HC Petition No. 388 of 2016 is cited in support of this
submission.
659. The 6th Respondent submits that the Petitioners are simply calling upon the court to prescribe to the National
Assembly what should be contained in the House Standing Orders. In his view, the remit of this court does not
extend to the prescription of Standing Orders for the National Assembly. The case of Nathanael Nganga Reuben
v Speaker, Machakos County Assembly & another [2016] eKLR is cited as holding that courts should exercise
judicial restraint as regards Parliamentary and County Assembly proceedings which are closely and directly
connected with the fulfilment by the Assembly or its members of their functions as a legislative and deliberative
body.
660. The 6th Respondent buttresses the above contentions by submitting that the Supreme Court upheld the
principle of allowing Parliament to regulate its internal matters in the case of Speaker of the Senate & another v
Attorney-General & 4 others [2013] eKLR when it held that “[t]his Court will not question each and every
procedural infraction that may occur in either of the Houses of Parliament” and that the “Court cannot supervise
the workings of Parliament”. Also cited in support of the same proposition is the decision of this court in Republic
v National Assembly Committee of Privileges & 2 others Ex-Parte Ababu Namwamba [2016] eKLR and that
of the Court of Appeal in Pevans East Africa Limited and Another v Chairman, Betting Control & Licencing
Board and 7 others, Civil Appeal No. 11 of 2018; [2018] eKLR.
661. The 6th Respondent submits that the use of omnibus Bills is not new to the National Assembly. He cites the
Finance Bill which is passed every year and whose aim is to amend several laws that deal with revenue-raising
measures or even repeal of entire taxation provisions as one of the Acts passed through the use of an omnibus Bill.
It is his case that the amendments in a Finance Bill cannot be said to be minor amendments, and the same scenario
applies to a Statute Law (Miscellaneous Amendment) Bill whose intention is to amend many statutes. His
conclusion is that nothing bars Parliament from using a Statute Law (Miscellaneous Amendment) Bill as long as
the principle of public participation is adhered to.
662. The 6th Respondent explains that among the reasons for the use of Statute Law (Miscellaneous Amendment)
Bills by Parliament is the need to address backlogs in unlegislated areas and to save on parliamentary time. He
contends that as admitted by the Petitioners, the Statute Law (Miscellaneous Amendment) Bill No. 12 of 2018 had
objects and reasons, and a Memorandum of Objects and Reasons gives the intent and purpose of a Bill. In respect
of the Statute law (Miscellaneous Amendment) Act (No. 18 of 2018 [Bill No. 12 of 2018] the objects and reasons
were given as the making of “various wide-ranging amendments on various statutes” thus explaining the intent
and purpose of the Bill.

663. The 6th Respondent’s final submission on the issue, however, is that the doctrine of separation of powers stops
this court from entertaining the Consolidated Petitions. He supports his argument by citing Articles 117 and 124 of
the Constitution and the Parliamentary Powers and Privilege Act of 2017. He further buttresses his contention by
relying on the decision of the Court of Appeal in John Harun Mwau v Dr. Andrew Mullei & Others, Civil
Appeal No. 157 of 2009, and that of the Supreme Court in the case of Speaker of the Senate & another v
Attorney-General & 4 others [2013] eKLR. The decision by the Privy Council in the New Zealand case of
Prebble v Television New Zealand Limited [1995] 1 AC 32 is identified as illuminating the principle of
separation of powers which requires that there be mutual respect between the courts and the legislature.
664. It is apparent from the submissions which we have set out above that the parties have expended considerable
energy on the question of the place of omnibus (Statute Law Miscellaneous Amendment) Bills in enactment of
legislation. The Petitioners are of the firm view that enactment of law through omnibus legislation should be
reserved for minor, non-controversial and generally house-keeping amendments. The text they rely on is found in
the 2016 Law Society Case which has been cited numerous times before us. In its decision in that case, the court
held as follows:
“234. It is therefore clear that both on policy and good governance, which is one of the values and principles of
governance in Article 10 of the Constitution, which values and principles form the foundation of our State and
Nation as decreed in Article 4(2) of the Constitution, omnibus amendments in the form of Statute Law
Miscellaneous legislations ought to be confined only to minor non-controversial and generally house-keeping
amendments.”
665. At this point we owe a duty to the parties and their advocates to place on record the fact that two members of
this court (Mumbi Ngugi & W. Korir, JJ) were among the five members of the Bench that decided that case. It is
also important to note that extensive discussions on the use of omnibus Bills in legislation were carried out in that
case.
666. The Petitioners have also placed before this court the latest decision of the Court of Appeal on the issue. In a
judgment delivered on 27th September 2019 in the 2019 Law Society Case, the Court of Appeal (P. N. Waki, D. K.
Musinga & P. O. Kiage, JJA) held that:
“It is imperative to dissect the issue of whether the amendments contained in the Statute Law Miscellaneous
Amendments) Act, 2012, sought to introduce substantive amendments to the law. The issue turns on what is
considered as substantive according to a reasonable man….
However, it is prudent to look at the ordinary usage of the Statute Law Miscellaneous Amendments) Bill. As was
stated by the appellant and is clear from its long title, it professes and is meant to be “An Act of Parliament to
make minor amendments to Statute Law”. From ordinary use of the word “minor” in this context, it means
something that is of less importance, insignificant even. Indeed, the lexical meaning as obtained from the
Concise Oxford English Dictionary, Twelfth Edition at page 911 is "having little importance, seriousness or
significance". The urging of the appellant is that the Statute Law (Miscellaneous Amendments) Bill is for
correcting anomalies, inconsistencies, outdated terminologies or errors which are minor and non-controversial.
A quick look at Black’s Law Dictionary, Eighth Edition at page 1470, describes substantive law as;
"The part of the law that creates, defines, and regulates the rights and duties, and powers of parties."
The Court must, therefore, satisfy itself that the amendments did not create, define, regulate or confer any
powers to any parties, for if they did, they would not be said to be minor or inconsequential.”

667. Confronted with the said authorities the Respondents’ Counsel, and in particular Mr. Mwendwa for the 6th
Respondent, changed tact and asked the Court to find that the decision of the Court of Appeal on the issue of the
use of omnibus Bills was made obiter dictum. Mr. Mwendwa also reiterated his submission that directing
Parliament not to use omnibus Bills in the enactment of substantive legislation amounts to chipping away the
powers bestowed on Parliament by the people to legislate.
668. The decision of the Court of Appeal in the 2019 Law Society Case may have answered the 6th Respondent’s
concern about the alleged degradation of its legislative powers when it held that:
“In the case of judicial power, its derivation and vesting is provided for in Article 159 of the Constitution;
(1) Judicial authority is derived from the people and vests in, and shall be exercised by, the courts and tribunals
established by or under this Constitution.
Similarly, Parliament’s legislative authority is neither innate nor self-authored. Rather, it is derived from and
delegated to it by the people, is exercised on their behalf and must reflect their will in whom sovereignty
resides.”
669. It is, however, our considered view that the 6th Respondent’s concerns need further interrogation. Before
considering whether the Court can legitimately direct Parliament on the procedures it should employ to transact its
business, we will first deal with the obiter dictum question. Counsel for the 6th Respondent, Mr. Mwendwa, sought
to persuade us that the Court of Appeal decided the case based on the issue of public participation and not on the
question of the use of an omnibus Bill to effect the amendments to the Law Society of Kenya Act which was the
subject of litigation that gave rise to the appeal.
670. In Ekuru Aukot v Independent Electoral & Boundaries Commission & 3 others [2017] eKLR, Mativo, J
dealt at length on the meaning and application of the principle of obiter dictum and concluded that:-
“43. The doctrine of precedent decrees that only the ratio decidendi [13] of a judgment, and not obiter dicta,
have binding effect.[14] The fact that obiter dicta are not binding does not make it open to courts to free
themselves from the shackles of what they consider to be unwelcome authority by artificially characterising as
obiter what is otherwise binding precedent.[15] Only that which is truly obiter may not be followed. But,
depending on the source, even obiter dicta may be of potent persuasive force and only departed from after due
and careful consideration.”[16]
671. A perusal of the Court of Appeal judgment in the 2019 Law Society Case discloses that the issue of the use of
omnibus legislation was one of the grounds of appeal. The Court of Appeal identified the grounds of appeal in its
judgment as follows:-
“The appellant, being dissatisfied with that judgment preferred an appeal to this Court. The memorandum of
appeal contains three (3) grounds, complaining that the learned judge erred in law and in fact by;
a) Misdirecting himself by not finding that the amendments contained in the Statute Law (Miscellaneous
Amendment) Act 2012 particularly those enumerated in paragraph 19(b) – 20 (b) – (d) of the Petition, are
inconsistent with Articles 27,41 and 261 (4) of the Constitution.
b) Failing to appreciate that the amendments contained in the Statute Law (Miscellaneous Amendment) Act
2012 seek to introduce substantive amendments to the law.
c) Failing to appreciate the need for public participation as enshrined in Article 10 (2) as together with Article

118 of the Constitution before the enactment of the Statute Law (Miscellaneous Amendment) Act
2012.” [Emphasis supplied]
672. The invitation to this Court to find that the decision of the Court of Appeal on the issue of the use of omnibus
legislation was made in passing cannot be correct in such circumstances. The issue had been raised by the
appellant. It was a matter for consideration by the Court of Appeal and was indeed decided upon. In the
circumstances we find no substance in the claim by Counsel for the 6th Respondent that the question was dealt with
in passing. We therefore reject the invitation to find that the decision of the Court of Appeal is not binding.
673. We come back to the question of the use of omnibus Bills in the legislative process. The High Court in the
2016 Law Society Case did extensive work on the issue and we need not cite the several authorities considered by
the Court. It is, however, important to note that as observed in that case, there is no uniformity on how omnibus
Bills are used in different jurisdictions:
“This brings to the fore the question of the circumstances under which statutory amendments ought to be
effected by way of Statute Law Miscellaneous legislation. That such a procedure ought to avail only in cases of
minor non-controversial amendments was appreciated by the 2nd Respondent when it indicated in the
Memorandum of Objects and Reasons of the Bill….that….[t]he Statute Law (Miscellaneous Amendments) Bill,
2015 is in keeping with the practice of making minor amendments which do not merit the publication of a
separate Bill and consolidating them into one Bill. .That this is the practice is clearly discernible from the
practice adopted in most jurisdictions, though the practice is not consistent….While we appreciate that there is no
internationally accepted position on the legality of omnibus bills, the reality is that they are used in many
jurisdictions.”
674. There is indeed enough literature on the shortcomings associated with using omnibus Bills to effect
substantive amendments to Acts of Parliament. Some of those shortcomings were captured in the 2016 Law
Society Case in which the High Court cited a paper titled “Omnibus Bills in Theory and Practice” by Louis
Massicotte published in the Canadian Parliamentary Review, Vol. 36 No. 1 2013, where the author states:-
“The real question, however, beyond the convenience of the government or of the opposition parties, may well
be: is the public interest well served by omnibus bills" Take for example the clause-by-clause study in
committee. When a bill deals with topics as varied as fisheries, unemployment insurance and environment, it is
unlikely to be examined properly if the whole bill goes to the Standing Committee on Finance. The opposition
parties complain legitimately that their critics on many topics covered by an omnibus bill have already been
assigned to other committees. The public has every interest in a legislation being examined by the appropriate
bodies.”
675. There is no doubt that the use of omnibus Bills to effect substantive amendments has its shortcomings. Such a
process generally limits the right of the people to participate in the passing of laws. When Parliament proposes to
make several amendments to assorted statutes relating to different activities, chances are that the proposals will not
receive the kind of attention they should if they had been enacted through stand-alone Bills. The risk of excluding
the public from participating in the legislative process is exacerbated if a short period for submitting views is
provided. This risk was appreciated by Louis Massicotte (supra) as cited in the 2016 Law Society Case in the
passage that we have set out above. The use of omnibus Bills may have advantages for government for, as
Massicotte observed:
“From the point of view of the government, omnibus bills have plenty of advantages....First, they save time and
shorten legislative proceedings by avoiding the preparation of dozens of distinct bills necessitating as many
second reading debates. Second, omnibus bills generate embarrassment within opposition parties by diluting
highly controversial moves within a complex package, some parts of which are quite popular with the public or

even with opposition parties themselves.
676. It is therefore apparent that the criticism of the omnibus Bill method is that it denies the public, including
Parliamentarians, the opportunity to critically consider the proposed amendments and provide useful input. The
limiting nature of the omnibus procedure has resulted in the courts discouraging the use of omnibus Bills to effect
substantive amendments to legislation. Indeed in the 2016 Law Society Case the court did not state that the
legislature should not use omnibus Bills to carry out substantive amendments of statutes. What the court said is that
“omnibus amendments in the form of Statute Law Miscellaneous legislations ought to be confined only to minor
non-controversial and generally house-keeping amendments.” The key word here being “ought”.
677. In the 2019 Law Society Case, the Court of Appeal seems to have taken issue with the fact that substantive
amendments were effected through a Statute Law Miscellaneous Amendments Bill whose long title indicated that it
was “An Act of Parliament to make minor amendments to Statute Law”. We are not persuaded that the Court of
Appeal addressed the use of omnibus Bills in the legislative process and concluded that the procedure could not be
used to make substantive amendments to Acts of Parliament.
678. From our analysis of the authorities above, we take the view that whenever the issue of the use of an omnibus
Bill arises, the question to be posed is whether the procedure has, in the circumstances of the particular case,
limited the right of the public to participate in the legislature’s business. In answering this question, the court will
take into account the nature and extent of the amendments. An amendment that is controversial, involves the
spending of public funds, is likely to infringe the rights of persons or creates new offences will draw more attention
from the court. The court will be interested to establish whether the use of the omnibus procedure limited the right
of public participation.
679. However, if there is evidence placed before the court by the legislature to demonstrate that the principle of
public participation was complied with in the adoption of the amendments, then the court should not be quick to
hold such an amendment invalid simply because an omnibus Bill was used to make the amendments. It is not the
place of the courts to dictate the procedures to be used by the two houses of Parliament in executing their
legislative mandate. The business of the court is to confirm that the legislative bodies have complied with the
Constitution and the law in delivering on their mandates.
680. This then brings us to the question whether the use of an omnibus Bill in the enactment of the impugned
amendments negatively impacted on the right of the public to participate, thus necessitating a declaration of
invalidly by this court. In this respect we have already found that there was evidence of sufficient time for public
participation, and that the procedure employed by the 6th Respondent in the stakeholder engagement of the
Omnibus Bill during the Committee Stage by various Committee, did facilitate public participation. In the
circumstances, we find that the use of an omnibus Bill to enact the impugned legislation was not unconstitutional.
Whether the Bill was one concerning Counties and therefore required involvement of the Senate
681. The final issue relating to the procedural infirmities of the impugned amendments concern the question
whether the amendments were on matters concerning counties and therefore required the involvement of the
Senate. In answering this issue in the affirmative, the 1st Petitioner cites the case of The Speaker of the Senate
and Another and the Attorney General and Others (2013) eKLR in which the Supreme Court held that if
Parliament violates the procedural requirements of the supreme law of the land, it is for the courts of law to assert
the authority and supremacy of the Constitution.
682. It is further the 1st Petitioner’s case that for a law to be considered constitutional, it must be so both in form
and content. The case of Institute of Social Accountability & another v National Assembly & 4 others [2015]
eKLR is cited for the proposition that legislation must conform to the Constitution in terms of its content and the

manner in which it was adopted. Failure to comply with the requirements in enacting legislation renders the
legislation invalid.
683. The 1st Petitioner further cites the Supreme Court as stating in The Speaker of the Senate and Another and
the Attorney General and Others, (supra) that the Senate ought to participate in the passing of a Bill as long as it
can be shown that such a Bill has provisions affecting the functional areas of county governments. In support of the
argument that the impugned amendments affected the operational areas of county governments, the testimony of
Dr. Karanja Kibicho is cited as disclosing that NIIMS is intended to benefit county governments, and in particular
on matters to do with food security, healthcare, housing and education.
684. Further, that the Huduma Namba will be needed to access services, including those offered by county
governments. It is the 1st Petitioner’s case that this is a clear indication that the impugned amendments related to
matters concerning county governments, therefore necessitating the involvement of the Senate in the passage of the
law. Reliance is again placed on the decision in the Institute of Social Accountability Case for the proposition
that failure to include the Senate in passage of a law touching on matters concerning county governments renders
the law constitutionally infirm and invalid.
685. The 2nd Petitioner did not submit on the role of the Senate in the enactment of the Statute Law (Miscellaneous
Amendments) Act 2018.
686. The 3rd Petitioner was, like the 1st Petitioner, of the view that the impugned amendments are unconstitutional
as they were not referred to the Senate as required by Article 110 (2) (b) and (3), neither were they subjected to the
mandatory provisions of Article 110(3) of the Constitution as the Speaker of the National Assembly and the Senate
did not jointly resolve the question on whether the Statute law (Miscellaneous Amendment) Bill 2018 was a Bill
concerning counties. According to the 3rd Petitioner, the conduct of the National Assembly undermined the legal
structure and framework of the legislature and the established procedure for enacting legislation. The decision of
the Supreme Court in The Speaker of the Senate and Another and the Attorney General and Others,
(supra) is cited as having conclusively dealt with the question of the roles of the National Assembly and the Senate
with regard to the organization, introduction and consideration, and enactment of Bills. It is the 3rd Petitioner’s case
that the Supreme Court held that the Senate, though entrusted with a less expansive legislative role than the
National Assembly, stands as the Constitution’s safeguard for the principle of devolved government.
687. It is further the 3rd Petitioner’s contention that Article 93establishes Parliament comprising the National
Assembly and the Senate with each House enjoined to perform its respective functions in accordance with the
Constitution. It contends that where the Constitution prescribes a procedure that ought to be followed in enacting a
law, that procedure must be followed. The decision in the Doctors For Life Case is relied upon in support of the
principle that legislation must conform to the Constitution both in terms of its content and the manner in which it is
adopted, and failure to comply with the requirements in enacting legislation renders the legislation invalid.
688. The 5th Interested Party supports the position taken by the Petitioners that the Statute law (Miscellaneous
Amendment) Bill 2018 was a Bill concerning counties and the involvement of the Senate in the legislative process
was required. It relies on Article 110(3) of the Constitution and cites the decision in The Speaker of the Senate
and Another and the Attorney General and Others, (supra) as holding that the Speaker of the Senate should be
consulted in classification of Bills. It is its submission that in this case, there is no evidence that the Speaker of the
Senate was consulted and determined that the Bill was not one concerning county governments.
689. The 5th Interested Party also relies on the case of Re the Matter of the Interim Independent Electoral
Commission, Supreme Court Const. Appl. No. 2 of 2011 in which the Supreme Court advised that the
expression ‘any matters touching on county government’ should be so interpreted as to incorporate any national
level process bearing a significant impact on the conduct of county governments. It is its position that a Bill

concerning counties is therefore one that fits the definition of Article 110 of the Constitution and also has an impact
on the conduct of county governments.
690. To justify its assertion that the impugned amendments concerned counties, the 5th Interested Party submits that
the main stated benefit of NIIMS is to ease delivery of services to the people. It observes that similarly, some of the
purposes of devolution and the creation of county governments according to Article 174 of the Constitution are the
promotion of social and economic development and the provision of proximate, easily accessible services
throughout Kenya; and facilitation of the decentralisation of State organs, their functions and services, from the
capital of Kenya. It therefore asserts that if NIIMS is meant to be a tool to provide easier access to services and the
purpose of devolution is to do the same thing, then the Senate ought to have been consulted in the enactment of a
legislation that encroaches on their function.
691. It is therefore the 5th Interested Party’s firm position that the failure by the National Assembly to involve the
Senate in the legislative process in a Bill that concerned the county government makes the resulting legislation null
and void. The decision in the Institute of Social Accountability Case is cited in support of the assertion that
failure to involve the Senate in the enactment of an Act concerning county governments renders such an Act
unconstitutional.
692. The 6th Interested Party did not make any submission on the issue of the non-involvement of the Senate in the
legislation of the impugned amendments.
693. The Respondents vehemently oppose the position taken by the Petitioners and the Interested Parties who
support them on the role of the Senate with respect to the impugned amendments. The 1st Respondent submits that
Article 109(1) of the Constitution mandates Parliament to legislate through Bills that are eventually assented to by
the President. He asserts that Article 109(3) of the Constitution provides that a Bill not concerning county
governments is considered only in the National Assembly and Article 109(1) defines ‘a bill concerning county
governments’ to include Bills containing provisions affecting the functions and powers of county governments as
set out in the Fourth Schedule, Bills relating to election of members of county assembly or county executive and
Bills affecting finances of county governments.
694. Applying the cited law to the facts of this case, the 1st Respondent submits that national registration and data
and statistics are national government functions as they are not enumerated in Part 2 of the Fourth Schedule which
sets out the functions of county governments.
695. The 2nd and 3rd Respondents agree with the position taken by the 1st Respondent, contending that the Bill did
not warrant consideration by the Senate. In their view, the fact that a proposed amendment may tacitly confer
incidental benefits to county governments does not make such a Bill a Bill “concerning county governments.”
They rely on the Court of Appeal definition of a “bill concerning county governments” in the case of National
Assembly of Kenya & Another v Institute for Social Accountability & 6 Others [2017] eKLR. In their view,
the registration of persons is a function that falls within the category of national statistics and data on population
which is a function reserved for the national government pursuant to section 11 of the Fourth Schedule of the
Constitution.
696. We have considered the respective submissions of the parties on the question whether the Senate had a role in
the enactment of the impugned amendments. We note that the parties are agreed that the impugned amendments
were originated and passed by the National Assembly without reference to the Senate. The only question therefore
is whether the impugned amendments concerned county governments and could only pass with the approval of the
Senate.
697. The Supreme Court extensively dealt with this issue in The Speaker of the Senate and Another and the

Attorney General and Others, (supra) which has been extensively cited before us by the parties. Although the
question of whether the procedure of determining if a Bill concerns county governments is not one of the issues
before this court, for purposes of determining the issue before us, we find it necessary to highlight what the
Supreme Court stated, which is as follows:
“[141] It is quite clear, though some of the counsel appearing before us appeared to overlook this, that the
business of considering and passing of any Bill is not to be embarked upon and concluded before the two
Chambers, acting through their Speakers, address and find an answer for a certain particular question: What is
the nature of the Bill in question" The two Speakers, in answering that question, must settle three sub-questions
– before a Bill that has been published, goes through the motions of debate, passage, and final assent by the
President. The sub-questions are:
a. is this a Bill concerning county government" And if it is, is it a special or an ordinary bill"
b. is this a bill not concerning county government"
c. is this a money Bill"
[142] How do the two Speakers proceed, in answering those questions or sub-questions" They must consider the
content of the Bill. They must reflect upon the objectives of the Bill. This, by the Constitution, is not a unilateral
exercise. And on this principle, it is obvious that the Speaker of the National Assembly by abandoning all
engagement or consultation with the Speaker of the Senate, and proceeding as he did in the matter before this
Court, had acted contrary to the Constitution and its fundamental principles regarding the harmonious motion
of State institutions.
[143] Neither Speaker may, to the exclusion of the other, “determine the nature of a Bill”: for that would
inevitably result in usurpations of jurisdiction, to the prejudice of the constitutional principle of the harmonious
interplay of State institutions.
[144] It is evident that the Senate, though entrusted with a less expansive legislative role than the National
Assembly, stands as the Constitution’s safeguard for the principle of devolved government. This purpose would
be negated if the Senate were not to participate in the enactment of legislation pertaining to the devolved units,
the counties [Article 96(1), (2) and (3)].
[145] It is clear to us, from a broad purposive view of the Constitution, that the intent of the drafters, as regards
the exercise of legislative powers, was that any disagreement as to the nature of a Bill should be harmoniously
settled through mediation. An obligation is thus placed on the two Speakers, where they cannot agree between
themselves, to engage the mediation mechanism. They would each be required each to appoint an equal number
of members, who would deliberate upon the question, and file their report within a specified period of time. It is
also possible for the two Chambers to establish a standing mediation committee, to deliberate upon and to
resolve any disputes regarding the path of legislation to be adopted for different subject-matter.”
698. The Supreme Court explained the role of the Senate in the passage of Bills by stating that:-
“[102] The Court’s observation in Re the Matter of the Interim Independent Electoral Commission is borne out
in an official publication, Final Report of the Task Force on Devolved Government Vol. 1: A Report on the
Implementation of Devolved Government in Kenya [page. 18]:
“The extent of the legislative role of the Senate can only be fully appreciated if the meaning of the phrase
‘concerning counties’ is examined. Article 110 of the Constitution defines bills concerning counties as being

bills which contain provisions that affect the functions and powers of the county governments as set out in the
Fourth Schedule; bills which relate to the election of members of the county assembly or county executive; and
bills referred to in Chapter Twelve as affecting finances of the county governments. This is a very broad
definition which creates room for the Senate to participate in the passing of bills in the exclusive functional
areas of the national government, for as long as it can be shown that such bills have provisions affecting the
functional areas of the county governments. For instance, it may be argued that although security and policing
are national functions, how security and policing services are provided affects how county governments
discharge their agricultural functions. As such, a bill on security and policing would be a bill concerning
counties….With a good Speaker, the Senate should be able to find something that affects the functions of the
counties in almost every bill that comes to Parliament, making it a bill that must be considered and passed by
both Houses.”
699. On its part, this Court (Lenaola, J (as he then was) Ngugi & Majanja JJ) in the Institute of Social
Accountability Case cited above stated that:-
“66. Accordingly it is clear that if the Speaker of the Senate signifies concurrence with a Bill that it falls within
one category or another, it may well be said that would be the end of the matter. However, the issue whether the
matter is one for county government is of constitutional importance and the decision of the respective speakers,
while respected, cannot be conclusive and binding on the court whose jurisdiction it is to interpret the
Constitution and as the final authority on what the Constitution means. Participation of the Senate in the
legislative process is not just a matter of procedure, it is significant to the role of the Senate in our constitutional
scheme as the Senate’s legislative role is limited to matters concerning county governments. Through its
participation in the legislative process, the Senate is seized of the opportunity to discharge its primary mandate
which is, to protect the interests of the counties and county governments as mandated under Article 96(1) of the
Constitution. It is a means of ensuring that the county voice is heard and considered at the national forum and
the interests of counties and their governments secured. This way, the sovereign power of the people is duly
exercised through their democratically elected representatives. Therefore, when the speakers of both chambers
classify bills under Article 110, they are essentially resolving on the question as to whether and to what extent
provisions of a particular Bill affect the interests of county governments, and consequently whether county input
ought to be invited….
69. In our view and we so hold, the fact that the legislation was passed without involving the Senate and by
concurrence of the Speakers of both House of Parliament, is neither conclusive nor decisive as to whether the
legislation affects county government. In other words, while concurrence of the Speakers is significant in terms
of satisfaction of the requirements of Article 110(3) of the Constitution, it does not by itself oust the power of this
Court vested under Article 165(3)(d) where a question is raised regarding the true nature of legislation in
respect to Article 110(1). The court must interrogate the legislation as a whole and determine whether in fact the
legislation meets the constitutional test of a matter, “concerning county government.” We shall revert to this
issue when we review the substance of the CDF Act and the subsequent amendment to determine whether in fact
the legislation is a matter concerning county government.”
700. The Court proceeded to determine that:
“138. We have analysed the CDF Act and concluded that the CDF and the manner it is administered and
projects implemented impacts functions allocated to the county under the Fourth Schedule to the Constitution.
In terms of Article 96(2) and 110 of the Constitution, the CDF (Amendment) Bill as legislation affecting the
functions and powers of the county governments qualifies as, ‘a Bill concerning county government’ within the
meaning of Article 110(1) and ought to have passed by the Senate. The purpose of the CDF (Amendment) Act
was to amend a law that as we have found violates the division of functions between the national and county
governments. Thus, an amendment to the Act would have necessitated the input of the Senate. The purpose of

involving the Senate is to ensure that counties, as far as possible, get to effectively participate in the legislative
business at the national level in matters substantially affecting interests of county governments. This calls for
the court to look beyond the substance or purpose of the statute expressed in the text. The court must unbundle
the specific provisions of the proposed legislation to see if and to what extent they satisfy the criteria set out
under Article 110(1) of the Constitution. An amendment to the Act affecting the manner in which money is
allocated to the CDF is the core part of the Act. As the availability of money affects the financing and
implementation of projects that fall within the competence of the county government, the provision cannot be
severed without undermining the entire Act. The CDF (Amendment) Bill is not an insubstantial amendment. We
therefore find and declare that the CDF (Amendment) Bill unconstitutional for want of involvement by the
Senate and we so declare.”
701. As we understand it, the term “concerning counties” has a wide meaning. According to the Supreme Court,
the phrase:
“…creates room for the Senate to participate in the passing of bills in the exclusive functional areas of the
national government, for as long as it can be shown that such bills have provisions affecting the functional
areas of the county governments.”
702. We, however, do not think that the jurisdiction of the Senate extends to each and every legislation passed by
the National Assembly. To so hold would render Article 110 of the Constitution redundant. It is difficult to think of
any legislation that does not touch on counties. The Fourth Schedule of the Constitution does indeed give a wide
array of functions to the counties. Those functions, in our view, do not include a national population register. It is
therefore our finding and holding that the impugned amendments did not require the involvement of the Senate in
their enactment. That is not to say that the bill should not have been subjected to the procedure identified by the
Supreme Court in The Speaker of the Senate and Another and the Attorney General and Others, (supra).
703. In closing on this issue, we observe that while the Petitioners have argued that the Bill was not subjected to the
process enunciated by the Supreme Court in The Speaker of the Senate and Another and the Attorney General
and Others, (supra)., the issue was not in their pleadings. As expected, therefore, the Respondents did not reply to
it. It would therefore be unfair to make a determination on it in light of the principle of the right to a hearing.
704. It is our finding therefore and we so hold that, in light of the above analysis, the impugned amendments did
not concern counties. As such, we find no merit in the Petitioners’ case that the impugned amendments failed the
constitutional test for non-involvement of the Senate in the process of their enactment.
Whether there is Violation and/or Threatened Violation of the Right to Privacy.
705. All the Petitioners urged on the risks and threats of the impugned amendments and of NIIMS to the right to
privacy, and of the insufficiency of the legal protection of the personal information collected through NIIMS. The
Respondents countered these averments by inter alia explaining that the design of NIIMS will ensure adequate
security of data collected and that there are existing laws for data protection. The arguments made by the parties in
this regard have been collapsed to four sub issues:
(a) Whether the personal information collected pursuant to the impugned amendments to the Registration of
Persons Act is excessive, intrusive, and disproportionate to the stated objectives of NIIMS.
(b) Whether there are sufficient legal safeguards and data protection frameworks for the personal information
that is collected in NIIMS
(c) Whether the impugned amendments to the Registration of Persons Act are an unreasonable and

unjustifiable limitation to the right to privacy;
(d) Whether NIIMS complies with the peremptory constitutional principles of transparency, accountability, and
verifiability and whether it is secure for its intended purpose.
Whether the personal information collected is excessive, intrusive, and disproportionate.
706. There were two limbs of arguments raised as regards this issue. The first limb was that the provisions for
collection of biometric data by the impugned amendments was intrusive and unnecessary. The 1st Petitioner in this
respect urges that DNA and other forms of biometric data are listed by the impugned amendments, without
justification or limitation, which clearly contravenes the principle of data minimization. That this is so particularly
given that NIIMS is being populated without DNA, and the government has publicly stated multiple times that it
lacks the capacity to store this data and to process it.
707. Further, that the Digital Data Capture Form used to gather biographical information is extremely detailed and
extensive. The 1st Petitioner submits that in the context of general collection of biometric data outside of the
criminal law context, it is likely to result in violations of fundamental rights unless there are very strict and rigorous
safeguards. This is for the reason that once there is a breach of the database, the information taken is unlikely to be
recovered in full. Therefore, there being no restrictions on retention of data in law, or in the design and public
information concerning the administration of NIIMS, the NIIMS database is intrusive.
708. Lastly, the 1st Petitioner argues that the Respondents have failed to indicate why collection of biometric
information is necessary at all, beyond distinguishing Kenya from Estonia on the basis of population
“heterogeneity” which purportedly justifies “a more robust identity system”, without explaining why biometrics
would be better-suited to the Kenyan context, and why specifically 10 fingerprints are needed.
709. The 2nd Petitioner on its part submits that the right to privacy is an inherent right of every person and is not
granted by the State, but entrenched as a fundamental right that cannot be lightly diluted, infringed and/or
interfered with by the State without proper justification. The 2nd Petitioner relies on the decision of Chelameswar, J.
in KS Puttaswamy vs Union of India Writ Petition (Civil) No 494 of 2012, as was cited by the Jamaican
Supreme Court in Julian J Robinson vs The Attorney General of Jamaica, Claim No. 2018 HCV01788, which
underscored the fundamental status of rights protected under the bill of rights and specifically the right to privacy
as one of the core freedoms which is to be defended.
710. The 2nd Petitioner also relies on the case of Kenya Legal and Ethical Network on HIV & AIDS (KELIN) &
3 others vs Cabinet Secretary Ministry of Health & 4 Others, [2016] eKLR where Lenaola J (as he then was)
defined privacy as a high level of protection given to the individual’s intimate personal sphere of life.
711. The 2nd Petitioner further submits that the full import of biometric data is to require all persons to surrender
their unique identifiers or attributes including fingerprints, hand geometry, earlobe geometry, retina and iris
patterns, voice waves and Deoxyribonucleic Acid (DNA) in digital form, Global Positioning Systems coordinates,
Land Reference Number, and their Plot Number or House Number, if any. In its view, biometric personal
information to be obtained under the impugned amendments is not only profoundly intrusive compared to the
hitherto physical/manual information, it is also inherently susceptible to the risk of invasion by unintended third
parties and may be used for innumerable unintended purposes.
712. Further, that the Supreme Court of India (Dr. Chandrachud J) in the case of KS Puttaswamy vs Union of
India (supra) cited by the Supreme Court of Jamaica in Julian J Robinson vs The Attorney General of Jamaica
(supra) aptly captures the character of biometric data relative to privacy in that, when adopted in the absence of
strong legal frameworks and strict safeguards, biometric technologies pose grave threats to privacy and personal

security, as their application can be broadened to facilitate discrimination, profiling and mass surveillance.
713. The 2nd Petitioner also urges that privacy ensures autonomy and self-determination in the face of increasing
State power, and that data collection and analysis can be a demoralizing process and can create a false image of an
individual. Thus, broad government access to an individual’s information can significantly upset the delicate
balance of power in a democracy between citizen and State. The 2nd Petitioner’s contends that no evidence has
been provided by the Respondents to support the assertion that biometric data is the most robust authentication and
identification method available, or that there were no alternative/less intrusive means of achieving the stated
purpose of NIIMS.
714. The 3rd Petitioner reiterates that the impugned amendments will enable the Respondents to collect personal
data which qualifies as sensitive personal information which would require consent, clear objectives for collection,
measures to protect the information from any breaches and remedies for breach. However, that the amendments do
not provide for any of the above thereby exposing individuals to violation of their privacy guaranteed under Article
31 of the Constitution.
715. The 5th Interested Party on its part submits that all the information required under NIIMS was unnecessary as
this is information that exists in other State databases that is, the information collected under NIIMS is identical to
the information kept by the Principal Registrar under Section 5 of the Act. Be that as it may, that all the information
sought in the Huduma Namba Data Capture Form amounts to information relating to one’s family and one’s
private affairs.
716. The 5th Interested Party further submits that Section 3 of the Registration of Persons Act was amended to
include the definition of "biometric" as unique identifiers or attributes including fingerprints, hand geometry,
earlobe geometry, retina and iris patterns, voice waves and Deoxyribonucleic Acid in digital form. To that end, it
cites the case of Julian J Robinson vs The Attorney General of Jamaica [2019] JMFC Full 04 (hereinafter
the Julian Robinson Case), where the Supreme Court of Jamaica noted that biometric data, by its very nature, is
intrinsically linked to characteristics that make us ‘humans’ and its broad scope brings together a variety of
personal elements and the collection, analysis and storage of such innate data is dehumanising as it reduces the
individual to but a number. Further, that when an individual is forced to surrender a biometric identifier as part of
State action, they are giving up information about themselves and they disclose truly unique information about their
identity among others.
717. The 5th Interested Party also cites the case of Kenya Legal and Ethical Network on HIV & AIDS (KELIN)
& 3 others v Cabinet Secretary Ministry of Health & 4 others [2016] eKLR where while considering the
problematic aspects of government databases, Lenaola J (as he then was) and Muriithi J held that even where the
goal being pursued by the State is legitimate, the manner in which data is collected can be an infringement on the
right to privacy.
718. It is the 5th Interested Party’s view that data was collected without informed consent from the data subjects
and this being a State-backed exercise, it cannot be said that those who gave their information understood what
they were doing nor can it be said that they gave informed consent to the utilisation of their information. Further,
that the Data Capture Form, and indeed a lot of government propaganda which this court must take judicial notice
of, came with a warning “Huduma Namba Registration is mandatory as per Section 9A of the Registration of
Persons Act (Cap 107). It will enable the Government to provide you with services”, which amounts to deliberately
misleading the public as no reading of section 9A would produce the interpretation stated in the Data Capture Form
nor does it make it compulsory for people to register for the said Huduma Namba or even tie the registration of this
number to the provision of services. Accordingly, if indeed more than 31 million people registered under NIIMS,
they did so under duress and fear of the unknown drove them to register, not their autonomy.

719. Closely related to the first limb of the issue at hand is the second limb that that the data collected pursuant to
the impugned amendments is not supported by the stated purposes of NIIMS and is purpose free. The 1st Petitioner
submits in this regard that the principle of purpose limitation is to form a consensus view of the purpose of data
collection, which in their view does not exist in this case. It further submits that data collection for the purposes of
crime fighting, surveillance or countering terrorism is counterproductive to data collection for the purpose of
service delivery. Nevertheless, it was its submission that the Respondents variously claim all three and more.
Further, because the Data Capture Form was so extensive and the purposes of the NIIMS system so opaque, there
was no reliable way to know the specific purpose of each piece of data collected for a given individual, and to track
whether the data are only used for that purpose.
720. The 1st Petitioner contends that the impugned amendments do not state a single, specific purpose of NIIMS,
and that the Respondents’ replying affidavits and expert evidence take contradictory positions with regard to the
purpose and effect of the NIIMS system, and its relationship to other existing identification infrastructure. For
example, that the 5th Respondent’s response to the petition of the Kenya National Commission on Human Rights
states that NIIMS will eliminate vetting for national identity cards, but the “Digital Data Capture” form does not
collect sufficient information to determine nationality, nor were the registration officials performing enrolments
competent to make such determinations, when in fact Kenyan law does not currently provide for any reliable legal
or administrative means of confirming citizenship by birth. Meanwhile, the 2nd Respondent states that “NIIMS will
not replace the previous registration systems in the short term.”
721. That the Respondents, furthermore, repeatedly state that DNA was not collected, while also affirming that
DNA data is essential for posthumous identification and the prevention of child trafficking and terrorism, two
important capabilities of the NIIMS system. Moreover, unlike other foundational digital identity systems, NIIMS
boasts forensics and crime fighting among its purposes, with the most-cited purpose, being improved service
delivery, relegated lower on the list. Accordingly, the amendment itself does not specify or restrict the potential
purposes of the NIIMS system in any way, nor does it provide an exhaustive list of the potential functions of the
NIIMS system itself.
722. The 2nd Petitioner submits that the averments by the Respondents on the stated benefits of NIIMS erroneously
presuppose that the stated challenges stem from the lack of a unique identification number, and that unless NIIMS
is operationalized in its current form and with the aid of criminal sanctions, then the challenges will persist.
However, they submitted that no empirical or other evidence has been adduced in support of this assertion or that
less invasive alternatives were considered and/or were unavailable to achieve the same objective, and no such
alternatives were even discussed. Reference was made to the decision by the Supreme Court of Jamaica in the
Julian Robinson Case where it addressed a similar situation.
723. It was the 2nd Petitioner’s submission that the African Union Convention on Cyber Security and Personal Data
Convention adopted by the 23rd Ordinary Session of the Assembly of the Union, Malabo, 27th June 2014 (hereafter
“The Malabo Convention”) stresses the protection of personal data, and urges a balance between the use of
information and communication technologies and the protection of the privacy of citizens. It is pursuant to the said
convention that the Data Protection Bill was sponsored and in line with the Malabo Convention, the Data
Protection Bill 2018 proposes among other safeguards the creation of an independent Data Protection Authority,
specifically, the Kenya National Commission on Human Rights, which is a Constitutional Commission established
under Section 3 of the Kenya National Commission on Human Rights Act No. 14 of 2011.
724. On the issue that collection of DNA is justified and necessary for crime prevention including child trafficking,
the 2nd Petitioner submits that no empirical evidence has been adduced by the Respondents to justify the claim that
NIIMS will prevent child trafficking or that countries that have managed to curb trafficking have done so by using
a unique identifier or biometric personal data. In their view, taking measures to address the foregoing challenges
would be less intrusive alternatives of achieving the stated objectives of NIIMS. In any event, the 2nd Petitioner

submits, existing criminal laws such as sanctions prescribed by the Kenya Information and Communications Act,
the Computer Misuse and Cybercrimes Act of 2018 and the Access to Information Act are not sufficient deterrents
for the protection of personal data. It was its argument that once personal data is breached and misused, the
devastating effects such loss would have on data subjects cannot be remedied by any amount of criminal
punishment against the offender and the court in the Julian Robinson Case eruditely captured this problem by
stating that there must be robust systems that minimise data theft and the punishment for data misuse and abuse
must be such that there is a strong deterrent element in the data protection regime.
725. On the argument that NIIMS was established for purposes of compliance with Kenya’s time bound
international obligations pursuant to section 17(3)(c) of the Access to Information Act, the 2nd Petitioner submits
that there is no correlation to support the argument that mandatorily collecting biometric information of the nature
prescribed by the impugned amendments is at all necessary for purposes of computerizing records and information
management systems or to facilitate more efficient access to information. It was further its submission that
collection of biometric data is a new phenomenon under the Registration of Persons Act and the risks attendant to
storing the biometric data in a central database is subjecting it to manipulation with the possibility of generation of
new data which risk was highlighted in the Julian Robinson Case.
726. The 3rd Petitioner’s relies on the case of Institute of Social Accountability & another v National Assembly
& 4 others (supra) which cited with approval the Canadian Supreme Court in theR vs Big M Drug Mart
Ltd (supra) which stated that both purpose and effect are relevant in determining constitutionality; either an
unconstitutional purpose or an unconstitutional effect can invalidate legislation. That there is therefore a real threat
that NIIMS is susceptible to breach that would occasion irreparable harm and damage to the people, and indeed the
country at large.
727. The 5th Interested Party submits in support of the Petitioners that to determine the purpose of a legislation, a
court must be guided by the object and purpose of the impugned statute, which object and purpose can be discerned
from the legislation itself as was stated by the court in Geoffrey Andare v Attorney General & 2 Others, [2016]
eKLR. However, if the purpose is not clear from the Act, then this Court has the discretion to interrogate the
Hansard to determine the legislative intent. Any other source of information is speculative and conjecture at best.
Further, that Section 7 of the Sixth Schedule to the Constitution offers guidance that laws such as this one must be
construed with the alterations, adaptations, qualifications and exceptions necessary to bring it into conformity with
this Constitution.
728. The 5th Interested Party further submits that even if the purposes explained in the Respondents’ pleadings
were contained in the legislation, the same would not constitute a constitutional purpose. In the 5th Interested
Party’s view therefore, NIIMS is a superfluous system serving no specific purpose, and its potential harms far
outweigh any peripheral advantages. Consequently, the court was urged to find that if any activity is to be done
under NIIMS, a proper legislative direction must be given detailing its purpose, safeguards to be used and in line
with both Article 31 and Article 24 of the Constitution.
729. The Respondents replied to the arguments made on the nature and need of the data in NIIMS in their
submissions. With particular respect to unique identifiers or attributes including fingerprints, location information,
land reference number, postal address, and GPS coordinates, the 1st Respondent submits that such information is a
standard requirement all over the world, and are not in any way disproportionate to the legitimate aims of the State.
Further to that, the requirement for GPS location is to comply with section 5(g) of Registration of Persons Act, and
merely have a geographical expression of the location of a physical place for information purposes with a primary
objective of facilitation of government services. To buttress the instances when the right to privacy can be limited,
the 1st Respondent urges the Court to find persuasion in the reasoning of the High Court in Coalition for Reform
and Democracy (Cord) & 2 Others V Republic of Kenya &10; Others [2015] eKLR where it was held that the
right to privacy can never be absolute, and that a balancing test has to be applied to determine whether the intrusion

into an individual’s privacy is proportionate to the public interest to be served by the intrusion.
730. It was his submission that sensitive information such as tribe, race, HIV status, among others specifically
stood excluded, and that following this Court’s orders of 1st April, 2019, the only biometric information that was
actually collected during the pilot phase and the mass registration exercise was only limited to the fingerprints,
which is considered to be the core biometric information. That it is frequently utilized globally to ascertain the
identity of a person. In that regard, they submitted that the information gathered was and is actually non-invasive
and non-intrusive identity information.
731. The 1st Respondent cites the decision by the Indian Supreme Court decision in Justice K.S. Puttaswamy
(Retd.) and Another v. Union of India and Others Writ Petition (Civil) No. 494 of 2012, where it was held that
demographic information, both mandatory and optional, and photographs does not raise a reasonable expectation of
privacy unless under special circumstances such as juveniles in conflict of law or a rape victim’s identity. Further,
that it was held that there is no reasonable expectation of privacy with respect to fingerprint and iris scan as they
are not dealing with the intimate or private sphere of the individual but are used solely for authentication.
732. In addressing children’s privacy concerns, it was the 1st Respondent’s submission that implementation of
NIIMS would be in the best interests of children, for the simple reason that it will enable the State to fulfil its
constitutional obligations of protecting and promoting, inter alia: children’s’ right to free and compulsory basic
education; basic nutrition, shelter and healthcare; to be protected from abuse, neglect, harmful cultural practices, all
forms of violence, inhuman treatment and punishment; and hazardous or exploitative labour as under Article 51(1)
of the Constitution.
733. In regard to the claim that collection of DNA identity data exercise is too intrusive and would violate the
privacy of data subjects, the 1st Respondent contends that the practice is permissible in Kenya, as held in L.N.W. v.
Attorney General & 3 Others [2016] eKLR where it was held that there is need for provision for DNA testing to
be undertaken to establish paternity where it is denied.
734. The 4th and 7th Respondents on their part submit that the personal information collected through NIIMS is of a
similar nature as that currently being held by various government agencies. Further, that the purpose is to integrate
and consolidate the information in order to create, manage and operate a digitized national population register as a
single source of personal information on all Kenyan citizens and residents. It was also submitted that the
information will assist the government to meet its obligation of providing key services to its citizens including
security, healthcare, and education among others
735. According to the 4th and 7th Respondents, the Petitioners’ grievance is with the collection of DNA and GPS
information. With respect to DNA, they submitted that it is a unique identifier that is not part of the personal
information collected by the data capture tools for purposes of registration under NIIMS. Further to that, they
submitted that GPS coordinates and DNA information were not collected by the data capture tools in place during
the mass registration exercise pursuant to this Court’s ruling of 1st April, 2019,
736. The said Respondents however still submitted on the importance of collecting DNA and GPS, and contended
that such information would be critical in enabling many technologies, and that the collection of personal
information of citizens is central to the proper functioning of the State. To that end, reference was made to the
United States Supreme Court case ofMargaret O’Hartigan vs Department of Personnell ET AL 118 Wn. 2d
111, P2d 44 (No. 56063-3 En Banc)where it pointed out that disclosure of intimate information to governmental
agencies is permissible if it is carefully tailored to meet a valid governmental interest, and provided the disclosure
is no greater than is reasonably necessary. The 4th and 7th Respondents therefore submit that the government
interest in collecting information through NIIMS is in keeping State’s duty of care to its citizens, and that vital and
reliable data is central to the discharge of this duty.

737. It was also their submission that the Petitioners failed to adduce any evidence to demonstrate the manner in
which the collection of personal information is an “unnecessary requirement” as set out in Article 31 (c) of the
Constitution, especially in light of the fact that the information is already held by the State, albeit in different
institutions. They further claimed that the Petitioners do not challenge any other statutory provisions which allow
the government to collect personal information on account of an alleged infringement to the right to privacy.
738. The 5th Respondent submits that the amendment complained of does not limit or violate the right to privacy as
alleged, and only captures necessary biometric information in line with globally acceptable requirements in
securing the State against terrorism, money laundering and to aid national planning. Further, that the right to
privacy is only violated when unauthorized persons gain access to the data under protection. In this instance, that
government officers legitimately gain access for a lawful purpose.
739. The 8th and 9th Interested Parties’ submissions were on the role of digital identification in sustainable
development. The said Interested Parties note that following the adoption and ratification of the Sustainable
Development Goals in 2015, various multilateral and international organizations, including the World Bank, UNDP
and UNICEF, to which Kenya is a member, have all stressed the critical role played by digital identity databases in
realizing the said Goals which are in many ways similar and/or identical to the national values and principles of
governance under Article 10 of the Constitution of Kenya.
740. The 8th and 9th Interested Parties make reference to various publications that have found that lack of personal
official identification prevents people from fully exercising their rights and isolates them socially, economically
and politically. Further, that beyond quantifiable economic benefits, digital ID can offer non-economic value to
individuals through social and political inclusion, rights protection and transparency. Therefore, that the right
digital identification technology designed with the right principles and enforced with the right policies, can be used
in the provision of e-government services and benefits, expanding access and saving time for citizens while
reducing costs for governments and improving social welfare.
741. In addressing these two related limbs, this Court is mindful of the provisions of Article 31 of the Constitution
on the right to privacy, which provide as follows:
“Every person has the right to privacy, which includes the right not to have—
(a) their person, home or property searched;
(b) their possessions seized;
(c) information relating to their family or private affairs unnecessarily required or revealed; or
(d) the privacy of their communications infringed.”
742. The Article therefore guarantees a general right to privacy, and in addition also guards against specific
infringements of privacy, including unnecessary revelation of information relating to family or private affairs,
which is the bone of contention in the consolidated petitions herein. The South African Constitutional Court
discussed the elements and scope of the general right to privacy in Bernstein vs Bester NO (1996) 2 SA 751
(CC), wherein Ackermann J. held as follows in the majority judgment in paragraph 67:
“(67)…..The truism that no right is to be considered absolute, implies that from the outset of interpretation each
right is always already limited by every other right accruing to another citizen. In the context of privacy this
would mean that it is only the inner sanctum of a person, such as his/her family life, sexual preference and
home environment, which is shielded from erosion by conflicting rights of the community. This implies that

community rights and the rights of fellow members place a corresponding obligation on a citizen, thereby
shaping the abstract notion of individualism towards identifying a concrete member of civil society. Privacy is
acknowledged in the truly personal realm, but as a person moves into communal relations and activities such as
business and social interaction, the scope of personal space shrinks accordingly.”
743. The learned Judge went to on to give examples of what is commonly considered an intrusion of the right to
privacy as follows in paragraphs 68 to 69:
“(68)….Privacy is an individual condition of life characterised by seclusion from the public and publicity. This
implies an absence of acquaintance with the individual or his personal affairs in this state. In Financial Mail
(Pty) Ltd v Sage Holdings Ltd ([1993] ZASCA 3; 1993 2 SA 451) it was held that breach of privacy could occur
either by way of an unlawful intrusion upon the personal privacy of another, or by way of unlawful disclosure of
private facts about a person. The unlawfulness of a (factual) infringement of privacy is adjudged Ain the light of
contemporary boni mores and the general sense of justice of the community as perceived by the Court.
(69) Examples of wrongful intrusion and disclosure which have been acknowledged at common law are entry
into a private residence, the reading of private documents, listening in to private conversations, the shadowing of
a person, the disclosure of private facts which have been acquired by a wrongful act of intrusion, and the
disclosure of private facts contrary to the existence of a confidential relationship. These examples are all clearly
related to either the private sphere, or relations of legal privilege and confidentiality. There is no indication that
it may be extended to include the carrying on of business activities.”
744. The learned Judge concluded that the scope of a person’s privacy extends only to those aspects in regard to
which a legitimate expectation of privacy can be harbored. In this respect, it was held that a person’s subjective
expectation of privacy is subject to the test that the society recognises that expectation to be objectively reasonable.
745. This position was adopted by the Kenyan Courts in Roshanara Ebrahim v Ashleys Kenya Limited & 3
Others, [2016] eKLR , Kenya Legal and Ethical Network on HIV & AIDS (KELIN) & 3 others v Cabinet
Secretary Ministry of Health & 4 others, [2016] eKLR, and in Tom Ojienda t/a Tom Ojienda & Associates
Advocates v Ethics and Anti-Corruption Commission & 5 others [2016] eKLR. It is notable that section 13 of
the South African Interim Constitution which was the basis of the decision in Bernstein vs Bester was similar to
Article 31 save for the protection of informational privacy, and stated as follows:
“Every person shall have the right to his or her personal privacy, which shall include the right not to be subject
to searches of his or her person, home or property, the seizure of private possessions or the violation of private
communications.”
746. In Tom Ojienda t/a Tom Ojienda & Associates Advocates vs Ethics and Anti-Corruption Commission &
5 others (supra) it was held as follows in this regard:
“77. I also note that a legitimate expectation of privacy has two components; the protection of the individual and
the reasonable expectation of privacy. The reasonable expectation of privacy test itself has two compartments.
Firstly, there must be at least a subjective expectation of privacy and secondly, the expectation must be
recognized as reasonable by the society…..
78. Ackermann J’s reasoning can therefore be summarized as follows; (a) privacy is a subjective expectation of
privacy that is reasonable, (b) it is reasonable to expect privacy in the inner sanctum, in the truly personal
realm, (c) a protected inner sanctum helps achieve a valuable good-one’s own autonomous identity. It emerges
to my mind that, and from the decision in Bernstein vs Bester NO (supra), that privacy is not a value in itself but
is valued for instrumental reasons, for the contribution it makes to the project of ‘autonomous identity’. This

protection in return seeks to protect the human dignity of an individual.”
747. The right to privacy has also been expressly acknowledged in international and regional covenants on
fundamental rights and freedoms. It is provided for under Article 12 of the Universal Declaration on Human
Rights, Article 17 of the International Convention on Civil and Political Rights, Article 8 of the European
Convention on Human Rights and Article 14 of the African Charter on Human and Peoples’ Rights.
748. The scope of the right to privacy is therefore incapable of definition, and may be described as a bundle or
continuum of rights which have a variety of justification. The Indian Supreme Court in Justice K.S. Puttaswamy
(Retd.) and Another v. Union of India and Others Writ Petition (Civil) No. 494 of 2012 summarised the
holdings in various Court decisions on the right to privacy, and expounded on the scope and aspects of the right to
privacy, including the protection of informational privacy as follows in paragraph 232 :
(i) “privacy has always been a natural right, and the correct position has been established by a number of
judgments starting from Gobind. Privacy is a concomitant of the right of the individual to exercise control over
his or her personality. Equally, privacy is the necessary condition precedent to the enjoyment of any of the
guarantees in Part III. The fundamental right to privacy would cover at least three aspects(i) intrusion with an
individuals physical body, (ii) informational privacy and (iii) privacy of choice. Further, one aspect of privacy is
the right to control the dissemination of personal information. Every individual should have a right to be able to
control exercise over his/her own life and image as portrayed in the world and to control commercial use of
his/her identity.
(ii) The sanctity of privacy lies in its functional relationship with dignity. Privacy ensures that a human being
can lead a life of dignity by securing the inner recesses of the human personality from unwanted intrusions.
While the legitimate expectation of privacy may vary from intimate zone to the private zone and from the private
to the public arena, it is important to underscore that privacy is not lost or surrendered merely because the
individual is in a public place. Privacy is a postulate of dignity itself. Privacy concerns arise when the State seeks
to intrude into the body and the mind of the citizen.
(iii) Privacy as intrinsic to freedom, liberty and dignity. The right to privacy is inherent to the liberties
guaranteed by Part-III of the Constitution and privacy is an element of human dignity. The fundamental right
to privacy derives from Part-III of the Constitution and recognition of this right does not require a constitutional
amendment. Privacy is more than merely a derivative constitutional right. It is the necessary basis of rights
guaranteed in the text of the Constitution.
(iv) Privacy has both positive and negative content. The negative content restrains the State from committing an
intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the State to
take all necessary measures to protect the privacy of the individual.
(v) Informational Privacy is a facet of right to privacy. The old adage that knowledge is power has stark
implications for the position of individual where data is ubiquitous, an all- encompassing presence. Every
transaction of an individual user leaves electronic tracks, without her knowledge. Individually these information
silos may seem inconsequential. In aggregation, information provides a picture of the beings. The challenges
which big data poses to privacy emanate from both State and non-State entities.
(vi) Right to privacy cannot be impinged without a just, fair and reasonable law. It has to fulfil the test of
proportionality i.e. (i) existence of a law (ii) must serve a legitimate State aim and (iii) proportionate.
749. The protection of informational privacy is what is specifically in issue in the instant Petition, and is provided
for in Article 31 (c) of the Constitution. The scope of the right to and protection of informational privacy is

explained in The Bill of Rights Handbook, 5th Edition (2005) by Iain Currie and John de Waal at page 323, as
follows:
“More particularly, this is an interest in restricting the collection, use and disclosure of private information. It
also encompasses a related interest in having access to personal information that has been collected by others in
order to ascertain its content and to check its accuracy. These interests can readily be accommodated under the
value of dignity since publication of embarrassing information, or information which places a person in false
light, is most often damaging to the dignity of the person. But the right to privacy guarantees control over all
private information and it does not matter whether the information is potentially damaging to a person’s dignity
or not. The publication of private photographs, however flattering, will for example constitute a violation of the
right to privacy of in this sense. So would be the use of a person’s name or identity without his or her consent.
But as with the other two elements of the right to privacy, there must be a reasonable expectation of privacy.
For example, a person does not have the right to refuse to provide identification to a police official when so
requested.”
750. Information privacy includes the rights of control a person has over personal information. Such personal
information will in the first place concern information which closely relates to the person and is regarded as
intimate, and which a person would want to restrict the collection, use and circulation thereof. Examples include
information about one’s health. But other information about that person may also be considered ‘private’ and
hence protected under the right to information privacy, even if this information relates to his or her presence or
actions in a public place or a place accessible for the public. Such information over which individuals have an
interest to keep private in our view also include information and data about their unique human characteristics,
which allows them to be recognized or identified by others, as it is information about one’s body and about one’s
presence, image and identity, in both private and public places.
751. We accordingly adopt the definition in Kenya Legal and Ethical Network on HIV & AIDS (KELIN) & 3
others v Cabinet Secretary Ministry of Health & 4 others (supra), where Lenaola J. and Muriithi J. summarised
the right to informational privacy as follows:
“Article 31(c) of the Constitution must be understood in this context – it protects against the unnecessary
revelation of information relating to family or private affairs of an individual. Private affairs are those matters
whose disclosure will cause mental distress and injury to a person and there is thus need to keep such
information confidential. Taken in that context, the right to privacy protects the very core of the personal sphere
of an individual and basically envisages the right to live one’s own life with minimum interference. The right
also restricts the collection, use of and disclosure of private information.
752. In light of the different facets and bases for the right to privacy, the applicable test in determining whether
there is an invasion or violation of the right was laid down in Bernstein vs Bester NO (supra) as follows:
“It essentially involves an assessment as to whether the invasion is unlawful. And, as with other forms of anuria,
the presence of a ground of justification (such as statutory authority) means that an invasion of privacy is not
wrongful. Under the Constitution, by contrast, a two-stage analysis must be employed in deciding whether there
is a violation of the right to privacy. First the scope of the right must be assessed to determine whether law or
conduct has infringed the right. If there has been an infringement it must be determined whether it is justifiable
under the limitation clause”.
753. Specifically as regards a determination of whether there is a violation of the right to informational privacy, the
Constitutional Court of South Africa in the case of Mistry v Interim National Medical and Dental Council of
South Africa (1998) (4) SA 1127 (CC) stated that the Court ought to take into account the fact; (i) whether the
information was obtained in an intrusive manner, (ii) whether it was about intimate aspects of an applicants’

personal life; (iii) whether it involved data provided by an applicant for one purpose which was then used for
another purpose and (iv) whether it was disseminated to the press or the general public or persons from whom an
applicant could reasonably expect that such private information would be withheld.
754. In the present Petition, the Petitioners have alleged that the amendments to the Registration of Persons Act
violates the right to privacy as it seeks to introduce the collection of biometric data, which is sensitive personal data
and is intrusive. Particular mention was in this regard made of the collection of DNA, which the Petitioners claim
can not only be used to reveal and profile a person’s genetic, health and other physical characteristics, but also that
of their relatives. Also challenged was the requirement to provide Global Positioning System (GPS) co-ordinates,
which the Petitioners claim can be used to track and conduct mass surveillance on the people in Kenya.
755. The Respondents did not dispute that biometric data in digital form will be collected in NIIMS, and argued
that such biometric data is in any event already being collected in existing identification and registration databases,
and was allowed by section 5(1)(j) of the Act which allowed the Principal Registrar to keep any other particulars
about the identity of a person. The Respondents specifically denied that DNA and GPS coordinates data will be, or
was collected in NIIMS. The Respondents however did point out and explain why DNA data and GPS co-ordinates
is necessary for identification.
756. In normal parlance, biometric data is any physical, biological, physiological or behavioral data, derived from
human subjects, which has the potential to identify an individual. Biometric data identifies an individual through
one or more unique factors specific to the physical identity of a person. It is in this regard not in dispute that section
3 of the Registration of Persons Act was amended by the impugned Act to include a definition of “biometric” as
“unique identifiers or attributes, including fingerprints, hand geometry, earlobe geometry, retina and iris patterns,
voice waves and Deoxyribonucleic Acid (DNA) in digital form” It also introduces a definition of Global
Positioning Systems (GPS) coordinates to mean “unique identifier of precise geographical location on the earth,
expressed in alphanumeric character being a combination of latitude and longitude”.
757. In addition section 5 (1)(g) of the Act was also amended to include GPS coordinates as part of the information
to be provided on place of residence, and a new paragraph 5 (1)(ha) inserted that provides for biometric data to be
kept in the register of all persons in Kenya by the Principal Registrar. Lastly, a new section 9A was included, which
is the one that establishes NIIMS which will inter alia harmonise, incorporate and collate data relating to
registration of persons from all registers, including biometric data.
758. We start our analysis by addressing the legitimacy of the privacy concerns raised by the Petitioners about
biometric data. The first observation we make in this regard is that biometric data, by its very nature, provides
information about a given person, and is therefore in this regard personal information that is subject to the
protection of privacy in Article 3. The Data Protection Act No. 24 of 2019 has adopted at section 2 the definition of
personal data that is in the European Union’s General Data Protection Regulations (GDPR) and in the African
Union Convention on Cyber Security and Personal Data Protection, namely, any information which is related to an
identified or identifiable natural person.
759. The GDPR details the elements of such information as follows in Article 4(1);
“The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an
identifier such as a name, an identification number, location data, an online identifier or one of several special
characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social
identity of these natural persons. In practice, these also include all data which are or can be assigned to a
person in any kind of way. For example, the telephone, credit card or personnel number of a person, account
data, number plate, appearance, customer number or address are all personal data”.

760. A similar definition of an identifiable natural person is now provided for in the Data Protection Act No. 24 of
2019. We note that the unique attributes and identifiers that are included in the definition of biometric data as
defined in section 3 of the Registration of Persons Act, GPS coordinates, and the data collected by NIIMS as
evidenced by the NIIMS Data Capture Form, clearly fall within the above definition of personal data. The
quali"cation of biometric data as personal has important consequences in relation to the protection and processing
of such data, and as such invites a risk of violation of the right to privacy in the event of inadequate protection
measures.
761. The Petitioners also urged that the amendments introducing biometric data allow collection of sensitive data
about persons. The concept of sensitive data has its origin in the European Union jurisprudence on the right to
privacy and data protection, and the GDPR also recognizes that in addition to general personal data, there are
special categories of personal data, known as sensitive personal data, which are subject to a higher level of
protection. Similar provisions on sensitive data are provided in Article 1 of the African Union Convention on Cyber
Security and Personal Data Protection. The Data Protection Act No. 24 of 2019 likewise defines sensitive personal
data as data revealing the natural person’s race, health status, ethnic social origin, conscience, belief, genetic data,
biometric data, property details including names of the person’s children, parents, spouse or spouses, sex or sexual
orientation of the data subject.
762. We note that such data is considered sensitive data because of the more serious impact of its loss or
unauthorized disclosure, particularly in terms of the attendant social, reputational, or legal risks and consequences.
It is thus evident that biometric data and in particular DNA must be protected against unauthorized access, and
access to such data should also be limited through sufficient data securitypractices designed to prevent
unauthorized disclosure anddata breaches.
763. The last allegation by the Petitioners was that biometric data and personal information being collected as a
result of the impugned amendments is intrusive. Intrusion is defined in Black’s Law Dictionary, Ninth Edition at
page 900 as “a person entering without permission”. Therefore, personal data is intrusive when it is collected
without a person’s knowledge of consent.
764. The Respondents testified in this regard that the data collected by NIIMS was with the consent of the subjects,
while the Petitioners have contended that data collection was mandatory, and as such there was no informed
consent. The Respondents brought evidence of the Data Capture Form used during the collection of the biometric
data, which had a caption on the consent of the data subject, and also testified that they had removed the statement
in the said Form that registration would be mandatory, in compliance with this Court’s orders. The Petitioners did
not bring any evidence of any person who was forced to give the consent, or did not understand the nature of the
consent being given. In addition, this Court in its ruling delivered on 1st April 2019 had directed that the collection
of the data would not be mandatory.
765. We however observe that at the time of the said data collection, there was no legal requirement for consent to
be given by a data subject to the collection of biometric data. The Data Protection Act 24 of 2019 which has since
been enacted now specifically provides for the rights of the data subject, including the right to object to the
processing of his or her personal data in section 26 thereof. The Act also further provides in section 30(1) that the
data subject must consent to processing of his or her personal data. We are therefore constrained to find that the
data collection exercise undertaken pursuant to the impugned amendments was done with the consent of the data
subjects.
766. As to whether the categories of personal data that will be collected pursuant to the impugned amendments is in
their nature intrusive, this Court is guided by the observations in the Working Document on Biometrics P 80 by
the Article 29 Data Protection Working Party, which was an independent European Union Advisory Body on Data
Protection and Privacy established pursuant to Article 29 of the then EU Directive 95/46/EC. The working Group

stated as follows in the said Working Document, which it adopted on 1st August 2003:
“A further point which is crucial from a data protection point of view is the fact that some biometric systems are
based on information, like fingerprints or DNA samples, that may be collected without the data subject being
aware of it since he or she may unknowingly leave traces. In applying a biometric algorithm to the fingerprint
found on a glass, one may be able to find out if the person is on file in a database containing biometric data, and
if so, who he is, by proceeding with a comparison of the two templates. This also applies to other biometric
systems, such as those based on keystroke analysis or distance facial recognition, on account of the specific
features of the technology involved. The problematic aspect is, on the one hand, that this data collection and
processing may be performed without the knowledge of the data subject and on the other hand that regardless of
their current reliability, these biometric technologies lend themselves to blanket utilisation on account of their
"low-level intrusiveness". Therefore, it seems necessary to lay down specific safeguards in respect of them.”
767. These observations confirm the Petitioners’ concerns as raised as regards the intrusive nature of some of the
biometric characteristics that are provided for in section 3 of the Registration of Persons Act, including DNA.
Irrespective of the fact that there are legitimate uses of DNA in identification, as pointed out by the Respondents,
we are mindful of the risks of indiscriminate collection of genetic information and other biometric identifiers which
makes such information susceptible to extraneous use, including negative profiling of individuals for ulterior
motives as observed by Dr. Malombe in his affidavit. He noted that this can be done by matching a DNA profile or
other biometric characteristic that can be collected without a person’s knowledge or consent, and he gave the
example of how a DNA profile from a coffee cup can be compared with a stored DNA profile or other biometric
characteristic in the identification database, and provide details about an individual’s name and address, among
other things, and can be used to profile the individual.
768. On the concerns raised on the privacy and surveillance risks posed by the requirement to give information on
GPS co-ordinates, this Court takes judicial notice of the fact that the GPS technology is satellite-based and its usage
has different aspects, and is more commonly used in cars and phone mobiles which help in determining directions
and locations. The potential usage of such technology may include information from the providers of internet and
telecommunication services that permits real-time tracking of the directions, speed and locations of monitors. The
privacy implications and risks arising from the use of GPS monitors is that the said devices can be used to track and
monitor people without their knowledge.
769. The U.S. Supreme Court addressed these risks and threats in a unanimous decision in United States v.
Antoine Jones 565 US (2012), and ruled that law enforcement must obtain a warrant prior to attaching a GPS
device to a suspect's vehicle in order to monitor its movements. The issue before the Court was whether the
attachment of a Global-Positioning-System (GPS) tracking device to an individual’s vehicle, and subsequent use of
that device to monitor the vehicle’s movements on public streets, constitutes a search or seizure within the meaning
of the Fourth Amendment. The Fourth Amendment provides in the relevant part that the right of the people to be
secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be
violated.
770. Sotomayor J. in his concurring judgment observed that the Government had usurped Jones’ property for the
purpose of conducting surveillance on him, thereby invading privacy interests long afforded, and undoubtedly
entitled to Fourth Amendment protection, and held as follows in this regard:
“GPS monitoring generates a precise, comprehensive record of a person’s public movements that reflects a
wealth of detail about familial, political, professional, religious, and sexual associations……Disclosed in GPS data
will be trips the indisputably private nature of which takes little imagination to conjure: trips to the psychiatrist,
the plastic surgeon, the abortion clinic, the AIDS treatment center, the strip club, the criminal defense attorney,
the by-the-hour motel, the union meeting, the mosque, synagogue or church, the gay bar and on and on The

Government can store such records and efficiently mine them for information years into the future…. And
because GPS monitoring is cheap in comparison to conventional surveillance techniques and, by design,
proceeds surreptitiously, it evades the ordinary checks that constrain abusive law enforcement practices”
771. Therefore, while Mr. Ochieng (the 5th Respondent’s witness), explained that the GPS co-ordinates in the
impugned amendments are required only for purposes of digital identification of an individual’s geographical
location, their potential uses are much more, and in the context of identification of persons possess a risk to
privacy. There is need for more detailed and strict regulation on the use of GPS co-ordinates, to avoid abuse and
misuse of the provisions in the impugned amendments.
772. The upshot of our findings in the foregoing is that biometric data and GPS coordinates required by the
impugned amendments are personal, sensitive and intrusive data that requires protection. This Court prohibited the
analysis and use of the personal data collected during NIIMS for this reason, and even though there was no
evidence brought by the Petitioners of any violations of rights to privacy in this respect, this Court finds that the
impugned amendments impose an obligations on the relevant Respondents to put in place measures to protect the
personal data.
773. To this extent, the answer to the question as to whether there is threat of a violation to the right to privacy in
the provision for collection of biometric data and GPS coordinates is dependent on the adequacy of the protection
measures of the said data, and will await an examination of the existing legal framework on the protection of data.
774. It is also notable that in Article 31 (c) of the Constitution, a violation of the right to informational privacy
occurs when personal information is unnecessarily required or revealed. Therefore, the outstanding question before
us is whether the requirement of, and collection of biometric data was necessary or not. The Petitioners in this
regard urged that the said biometric data was not necessary for reasons that its purpose was not stated, and was
purpose free. Closely related to this argument was the averment by the Petitioners that there is unnecessary data
that was collected under NIIMS that was not necessary for identification, such as information on agricultural
activities and landholding.
775. The Petitioners also challenge the utility of the biometric data in identification. The Petitioners also challenge
the utility of the biometric data in identification, and their expert witnesses testified to the challenges some sections
of the population may face in enrolling or authenticating certain biometric features such as worn fingerprints, the
possibilities of reaching false conclusions while relying on biometric data as it relies on probabilities, and there will
thus be no deduplication of data.
776. The justification put forward by the Respondents for the collection of biometric data was that the right to
privacy is not an absolute right, that biometric data is necessary as the most deterministic method of identification,
and that reliable data is necessary for the State to provide services and security to its citizenry. The Respondents
also urged that the biometric data being collected is necessary for the purpose of creating a digitized national
population register as a single source of personal information on all Kenyan citizens and residents. Their expert
witnesses gave detailed evidence on the NIIMS design as a multi-modal system that will ensure that the biometric
data is deterministic.
777. We have considered and appreciate the detailed information and evidence given by the parties on the nature of
biometric data, and its use in identification. We need to clarify two aspects of the relevance of this evidence at the
outset. Firstly, it is evident from the various definitions of biometric data that its main utility is with regard to
identification of a natural person. To this extent, biometric data is necessary for identification purposes. We in this
respect adopt the findings of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) and Another v.
Union of India and Others (supra) on the necessity of the different types of biometric data in identification as
follows:

“251. Face Photographs for the purpose of identification are not covered by a reasonable expectation of privacy.
Barring unpublished intimate photographs and photographs pertaining to confidential situations there will be
no zone of privacy with respect to normal facial photographs meant for identification.
Face-photographs are given by people for driving license, passport, voter id, school admissions, examination
admit cards, employment cards, enrolment in professions and even for entry in courts. In our daily lives we
recognize each other by face which stands exposed to all, all the time. The face photograph by itself reveals no
information.
252 There is no reasonable expectation of privacy with respect to fingerprint and iris scan as they are not
dealing with the intimate or private sphere of the individual but are used solely for authentication. Iris scan is
nothing but a photograph of the eye, taken in the same manner as a face photograph. Fingerprints and iris
scans are not capable of revealing any personal information about the individual except for serving the purpose
of identification. Fingerprints are largely used in biometric attendance, laptops and mobiles. Even when a
privacy right exists on a fingerprint, it will be weak. Finger print and iris scan have been considered to be the
most accurate and non-invasive mode of identifying an individual. They are taken for passports, visa and
registration by the State and also used in mobile phones, laptops, lockers etc for private use. Biometrics are
being used for unique identification in e passports by 120 countries.”
778. Therefore, the only relevant consideration as regards the necessity of biometric data is its utility with respect
to the authentication or verification of a person. The Article 29 Data Protection Working Party in its Working
Document on Biometrics identified the necessary qualities required of biometric data for purposes of
authentication and verification are that the data should have attributes that are: (a) universal, in the sense that the
biometric element exists in all persons; (b) unique, in that the biometric element must be distinctive to each person,
and (c) permanent, in that the biometric element remains permanent over time for each person, and a data subject is
in principle not able to change these characteristics.
779. It is notable in this respect that the biometric attributes required by the impugned amendments meet these
criteria, as most of them are universal and unique to the data subjects. The only reservation we have is as regards
the utility of DNA for identification purposes. This is for the reason that unlike other biometric characteristics, the
technique used in DNA identification, which is a DNA comparison process, does not allow for the veri"cation or
identi"cation to be done “in real time”, the comparison is also complex, requires expertise, and takes time.
780. The European Court of Human Rights in S and Marper v United Kingdom 30562/04 [2008] ECHR 1581
addressed the issue of the utility of holding DNA in a database, and found that the continued holding of DNA
samples of individuals who are arrested but later acquitted or have the charges against them dropped, is a violation
of the right to privacy under the European Convention on Human Rights. Some of the reasons given by the Court
as to why the retention of cellular samples and DNA profiles was a breach of the right to privacy were as follows:
“73.Given the nature and the amount of personal information contained in cellular samples, their retention per
se must be regarded as interfering with the right to respect for the private lives of the individuals concerned.
That only a limited part of this information is actually extracted or used by the authorities through DNA
profiling and that no immediate detriment is caused in a particular case does not change this conclusion (see
Amann, cited above, § 69).
74.As regards DNA profiles themselves, the Court notes that they contain a more limited amount of personal
information extracted from cellular samples in a coded form. The Government submitted that a DNA profile is
nothing more than a sequence of numbers or a barcode containing information of a purely objective and
irrefutable character and that the identification of a subject only occurs in case of a match with another profile
in the database. They also submitted that, being in coded form, computer technology is required to render the

information intelligible and that only a limited number of persons would be able to interpret the data in
question.”
781. We find that the limitations observed by the Court in the said case on the use of DNA equally apply, if not
with more potency, to the Kenyan situation, given the concession by the Respondents of their inability to process
DNA information for the entire population. Lastly, we also find that the necessity of GPS monitors in identification
is even less evident, given the risk they pose to the right to privacy as we found earlier on in this judgment, and the
Respondent’s concession of its inability to collect this information.
782. It is also our view that the evidence by the Petitioners as regards the shortcomings of some of the biometric
data in these respects is one that is material to the identification system designs to ensure that usability, reliability
and effectiveness. As explained by the different experts who testified before us, the uniqueness of the
characteristics captured by the NIIMS identification system will determine the effectiveness of biometric systems.
The choice of one or more particular characteristics for a system will further be influenced by the acceptance of its
use by the individuals, and may also influence the architecture of a biometric system. It however does not obviate
the need or necessity for biometric data in identification. Therefore, for example, even though a biometric
characteristic may be considered universal, for example a "ngerprint, it does not mean that all persons will have the
required biometric characteristic. Persons may have lost a biometrically relevant characteristic through accident,
sickness or peculiar circumstances. In such cases, more than one biometric characteristic of the same data subject
are combined to improve performance.
783. We therefore are persuaded by the evidence of the experts called by the Respondents that the combination of
two characteristics, for example more than two "ngerprints, or the use of more than one type of characteristics, such
as face and voice, generally improves the performance of the system. We also found the evidence by the
Respondents on the multi-modal nature of NIIMS relevant, to the extent that the system entails the collection of
different types of biometric data to improve its deterministic nature. To this extent, we also find that the
Respondents did demonstrate why the provision for, and collection of different types of biometric characteristics
was necessary.
784. Accordingly, in light of our analysis in the preceding paragraphs of this judgment, our findings are that other
than the DNA and GPS coordinates, information to be collected pursuant to the impugned amendments to the
Registration of Persons Act is necessary and is therefore not unconstitutional. However, with regard to collection of
DNA and GPS co-ordinates for purposes of identification, it is our finding that it is intrusive and unnecessary. To
the extent, therefore, that it is not authorised and specifically anchored in empowering legislation, it is
unconstitutional and a violation of Article 31 of the Constitution.
785. On the last aspect raised as regards the purpose of the data collected in NIIMS, the Respondent testified that
the purpose of collection of the biometric data was to create a digital database which they termed “a single source
of truth” as regards the identity of persons in Kenya in the form of NIIMS. Reference was made to section 9A of
the Registration of Persons Act on the establishment of and purposes of NIIMS. The said section provides for the
functions of NIIMS as follows:
(a) to create, manage, maintain and operate a national population register as a single source of personal
information of all Kenyan citizens and registered foreigners resident in Kenya;
(b) to assign a unique national identification number to every person registered in the register;
(c) to harmonise, incorporate and collate into the register, information from other databases in Government
agencies relating to registration of persons;

(d) to support the printing and distribution for collection all national identification cards, refugee cards,
foreigner certificates, birth and death certificates, driving licenses, work permits, passport and foreign travel
documentation, student identification cards issued under the Births and Death Registration Act. Basic
Education Act, Registration of Persons Act, Refugees Act, Traffic Act and the Kenya Citizenship and
Immigration Act and all other forms of government issued identification documentation as may be specified by
gazette notice by the Cabinet Secretary;
(e) to prescribe, in consultation with the various relevant issuing authorities, a format of identification document
to capture the various forms of information contained in the identification documents in paragraph (d) for
purposes of issuance of a single document where applicable;
(f) to verify and authenticate information relating to the registration and identification of persons;
(g) to collate information obtained under this Act and reproduce it as may be required, from time to time;
(h) to ensure the preservation, protection and security of any information or data collected, obtained,
maintained or stored in the register;
(h) to correct errors in registration details, if so required by a person or on its own initiative,
(i) to ensure that the information is accurate, complete, up to date and not misleading; and
(j) to perform such other duties which are necessary or expedient for the discharge of functions under this Act.
786. Some of the stated purposes of NIIMS under section 9A are the creation of a national population register, the
assigning of a unique identification number to every person registered in the register, and the verification and
authentication of information on the identity of persons. It is thus principally an identification and verification
system. These two functionalities are explained in the text on Privacy and Data Protection Issues of Biometric
Applications, by Els Kindt (2003) in paragraphs 85 to 88, wherein it is opined that the identi"cation function
recognizes an individual by comparing the submitted biometric characteristic with all previously submitted and
stored biometric characteristic in one or more databases through a search. Further, that the veri"cation is possible
with a comparison of one submitted set of characteristics with a pre-de"ned and pre-stored set of characteristics.
787. Therefore, the identification and verification functionalities will always need the existence of a database with
the biometric data stored for comparison. Such storage can be done centrally, for example in a central database, but
it is also possible to store the biometric data for comparison locally, for example on an object which the data
subject holds and which remains in his or her possession. In addition, the verification and identification
functionalities may also be combined in one system. To this extent, the biometric data collected is necessary to the
stated purposes of NIIMS as is clear that the system can only provide trustworthy information about the identity of
the person if the characteristics of that person are stored in its database.
788. These functionalities in our view also explain the utility of NIIMS and the other existing identification and
registration databases that was urged by both the Petitioners and Respondents. It is thus our finding that NIIMS is
not superfluous from an identification and verification point of view, as the biometric data collected therein is
necessary for identification, and will be used for verification purposes in relation to other existing databases.
789. As regards the other data that was collected during the NIIMS registration, additional stated purposes of
NIIMS in section 9A are that of harmonizing and collating of data information from other databases in Government
agencies relating to registration of persons and also prescribing consultation on the issuance of identification
documents. The Respondents testified that the collection of the additional data was decided and agreed upon by the

concerned Government agencies in the Inter-Ministerial Committee implementing NIIMS arising from the need for
the data, and for the Government to be cost effective but also for efficiency reasons. We find this explanation to be
reasonable, and given that such cooperation with other agencies in registration of persons is also allowed by the
law, we do not find the data so collected to be unnecessary.
790. In conclusion, it seems to us that the Petitioners’ concerns in this respect conflated the stated purpose of
NIIMS as provided in the law, with the veracity of its benefits as alleged by the Respondents. As held in R vs Big
M Drug Mart Ltd (supra) both the purpose and effect of a legislation are relevant in determining the
constitutionality of a legislation. In this regard the Respondents have demonstrated that the purpose of the
impugned legislation is to set up an identification system, and to the extent that it is necessary, then the same is
constitutional. On the other hand, the Petitioners did not demonstrate in what manner the benefits are
unconstitutional, and instead seemed to demand evidence of their existence, and the ranking of their priority and
importance. It is our view and finding that the stated benefits of NIIMS given by the Respondents in their evidence
are in the public interest and not unconstitutional.
Whether there is a Violation of Children’s’ Rights to Privacy
791. An additional limb of the challenge to the NIIMS process with respect to its alleged violation of the rights to
privacy relates to the rights of privacy of children. The Petitioners and the Interested Parties who support them
argue that while the impugned amendments and the resultant process of digitisation of data applies to everyone,
including children, section 2 of the Act does not include children. It is their argument that by providing that it
applies to persons over the age of 18 years, it specifically excludes the application of its provisions to children.
792. In its submissions, the 2nd Petitioner notes that one of the reasons advanced for NIIMS is that it was
discovered that information relating to children was not being captured comprehensively at birth. The government
was accordingly keen to achieve 100% registration of births, and one of the ways it intended to do so was by
employing suitable technology. The 2nd Petitioner argues, however, that section 2 of the Act applies the Act
exclusively to persons who are citizens of Kenya and who have attained the age of eighteen years or over or, where
no proof of age exists, are of the apparent age of eighteen years or over. It submits that though the impugned
amendments purport to apply the Act to all persons, the limitation under section 2 is a patent defect that renders the
Act vague and, accordingly, defective. It was also its submission that for the above reasons, its application to
children is unreasonable, unjustifiable and unnecessary.
793. According to the 2nd Petitioner, section 9A(2) of the Act establishes a very generic, wide and ambiguous scope
of the functions of NIIMS. It further notes that there are essentially no restrictions with regard to what the personal
data collected, including children’s personal data, may be used for. It is its submission that given children’s
vulnerable status, clear distinctions should have been prescribed for collection, use, processing and storage of
children’s data relative to adults.
794. The 2nd Petitioner notes that under the impugned amendments, parents have a mandatory duty to surrender
their children’s information failing which they face the threat of criminal sanctions which is contrary to
international laws, best practices and standards. It was its view that there was no problem or challenge so grave that
required mandatory registration of children backed by criminal sanctions. The 2nd Petitioner relies on the decision
in the Julian Robinson Case for the proposition that difficulty in establishing identification is not a synonym for
an inability to establish identity.
795. The 5th Interested Party, echoes the submissions of the 2nd Petitioner with regard to the application of section 2
of the Act. It submits that the section only applies to citizens of Kenya who have attained the age of 18 years, not to
children or foreign nationals. It notes that in the training manual produced as evidence by Dr. (Eng) Karanja
Kibicho the registration assistants were given express instructions to collect personal information on children. It is

its submission that the collection of personal information on children and non-citizens is ultra vires section 2 of the
Act.
796. With respect to the contention by the Respondents that the collection and digitisation of children’s data will
help in combating child labour and child trafficking, the 5th Interested Party argues that this will not in fact be the
case, that the use of biometrics does not help in the protection of children and only creates their digital identity
earlier than is necessary.
797. In its response to the arguments on this issue, the 1st Respondent contends that from a national security
perspective, NIIMS would play an indispensably crucial role in obviating and combating contemporary crimes such
as terrorism, child labour and trafficking in children, and would aid in keeping the country safe from terrorist
attacks.
798. In their submissions in response, the 2nd and 3rd Respondents note the constitutional requirement under Article
53 that a child’s best interests shall be the primary consideration in any matter concerning the child. They further
submit that the implementation of NIIMS is in the best interests of children. This is because it enables the State to
fulfil its constitutional obligations to children, which include the obligation to protect and promote children’s right
to free and compulsory basic education, basic nutrition, shelter and healthcare, as well as the obligation to be
protected from abuse, neglect, harmful cultural practices, all forms of violence, inhuman treatment and punishment,
and hazardous or exploitative labour in accordance with Article 53 of the Constitution.
799. The 2nd and 3rd Respondents further note that the constitutional obligations are also provided for in
international instruments ratified by Kenya, among them Article 8(1) of the 1989 United Nations Convention on
the Rights of the Child and Article 24(1) of the 1966 International Covenant on Civil and Political Rights. The 2nd
and 3rd Respondents submit that the non-existence of a mechanism for uniquely identifying children has prevented
the government from meeting its obligations under the Constitution and international covenants. It is their
submission that birth certificates which act as the only contemporary legal means of identification of children are
solely distinguished by use of serial numbers and do not bear a child’s fingerprints, facial image or any other
biometric. They argue that as a result, criminal elements have capitalized on the limitations of a birth certificate to
perpetuate child trafficking and child labour and other child-related offences. In their view, NIIMS would cure the
mischief that is attributable to the current child identification system.
800. The 2nd and 3rd Respondents term the allegation that NIIMS would violate children rights due to the absence of
mechanism for correcting and updating inaccurate information on children’ data unfounded. It is their submission
that the legislative provisions impugned by the Consolidated Petitions provide for corrective measures. They cite in
this regard section 9A(2) (i) of the Act which empowers NIIMS to correct errors in registration details, if so
required by a person or on its own initiative in order to ensure that the information in the system is “accurate,
complete, up to date and not misleading.” They submit that parents and guardians of children may therefore,
correct and update the identity information of the children for whom they are responsible.
801. The 2nd and 3rd Respondents submit that as demonstrated by the NIIMS data capture form, the children data to
be stored under NIIMS would be limited to registration and identity data. They assert that the principle of data
minimization was adopted in the design architecture of NIIMS in the sense that any information that may be
incorporated into the NIIMS database from databases of other government agencies would be limited to
information on registration of persons, citing in this regard section 9A(2) (c) of the Act.
802. The 2nd and 3rd Respondents assert that the fear of threat of constant surveillance of children is unfounded. It is
their case that they have demonstrated that functional data will remain resident in their respective functional
databases as maintained by various ministries, departments and agencies. In their view, in the unlikely event that
the NIIMS database was to be compromised, the functional data of children such as academic and health records

will be unaffected.
803. The 2nd and 3rd Respondents contend that the 2nd Petitioner’s claim that the collection of DNA identity data is
too intrusive and would violate the privacy of data subjects is baseless. They submit that the collection and
processing of DNA is generally permissible in this country. They rely in support on the decision in L.N.W. v.
Attorney General & 3 Others [2016] eKLR in which it was held that changes should be made in the law to allow
for the names of fathers of children born outside marriage to be entered in the births register and the children’s
birth certificates, and that provision should also be made for DNA testing to be undertaken to establish paternity
should paternity be denied. It is their submission that the decision in L.N.W v Attorney General & 3 others
(supra) was an affirmation by the Court that DNA testing of children is permissible for purposes of the realization
of the right of children to know their parents. In their view, it followed that the collection of DNA would be
permissible for the attainment of other rights, more so where such rights are crucial to the life and security of
children.
804. The 2nd and 3rd Respondents further submit that the collection of DNA is in certain circumstances a crucial
form of identification. This is particularly so where there are no other personal identifiers. They cite in this regard
cases of fatal flight accidents where all other components of an individual’s biometrics are destroyed, leaving the
use of DNA as the only way of identifying the remains. It is also their submission that DNA evidence is also a
crucial part of the law of evidence in resolving certain crimes such as rape, murder or manslaughter.
805. The 2nd and 3rd Respondents observe that the data privacy concerns in relation to children raised by the 2nd
Petitioner have been grounded on the European Union’s General Data Protection Regulation (GDPR). It is their
submission that the GDPR are European Union law and have no binding effect in Kenya. Further, that the
principles espoused in the GDPR have not attained the status of universal applicability, having entered into force on
25th May 2018.
806. It is their submission, however, that in the event that this court finds that the GDPR is binding on Kenya, they
would invoke Article 86 of GDPR which gives the Member States the discretion to determine the specific
conditions for the processing of a national identification number or any other identifier of general application. It is
their case that this provision acknowledges the legitimacy of the use of a national identification number and the
lawfulness of processing of personal information for purposes of generating the said national identification number.
807. The 2nd and 3rd Respondents further note that recital 46 of GDPR renders lawful the processing of personal
data where such processing is necessary to protect an interest essential for the life of the data subject or of another
natural person. It is their case that some types of processing may serve both important grounds of public interest
and the vital interests of the data subject. Such situations in which processing is necessary for humanitarian
purposes include for monitoring epidemics and their spread and humanitarian emergencies such as in situations of
natural and man-made disasters.
808. The 2nd and 3rd Respondents therefore submit that the existence of an efficient and organized system of
registration and identification of individuals coupled with responsible use of public resources in the process
justifies the processing of personal information under NIIMS.
809. The reasons advanced by the Respondents for the registration of children into NIIMS sound reasonable and
laudable. They include national security concerns such as the need to combat terrorism, the need to enable the State
to fulfil its obligations to children under Article 53 of the Constitution, deal with the inadequacies presented by the
birth certificate as an identifier for children in light of the fact that it only has a serial number and does not have
children’s biometric data and is therefore not suitable as a means to combat child trafficking and child labour. To
this extent we cannot find the impugned amendments’ effect on children unconstitutional.

810. The Respondents have not, however, addressed the core issues that we believe the Petitioners’ objection to the
collection of children’s data are hinged upon: that the Act does not apply to children, the collection and security of
their biometric data, and the criminalisation of failure by a parent or guardian to register a child with NIIMS. While
the Respondents argue that one of the reasons for NIIMS is that the government had discovered that information
relating to children was not being captured comprehensively at birth and NIIMS was intended to assist the
government achieve 100% registration of births through the use of technology, they have elected to anchor the
system under which they intend to collect children’s data on legislation that expressly excludes children. Enacted
in 1949, the Act’s long title indicates that it is an “Act of Parliament to make provision for the registration of
persons and for the issue of identity cards, and for purposes connected therewith.”
811. Section 2 of the Registration of Persons Act provides as follows:
This Act shall apply to all persons who are citizens of Kenya and who have attained the age of eighteen years or
over or where no proof age exists, are of the apparent age of eighteen years or over.
812. The Petitioners are thus correct in their contention that the Act does not apply to children and persons who are
not citizens of Kenya. Section 9A which was introduced by the impugned amendments, however establishes the
NIIMS system, and provides that one of its functions is to create a national population register as a single source of
personal information of all Kenyan citizens and registered foreigners resident in Kenya. It does not make any
exception for children. The question is what is the effect, with respect to collection of children’s data, of anchoring
NIIMS in legislation that specifically excludes children" The Petitioners argue that this renders the Act vague and
defective, and its application to children unreasonable, unjustifiable and unnecessary.
813. It appears to us that the manner in which NIIMS was brought into being does not reflect much thought on the
part of the Respondents. While from the Respondents’ evidence it is clear that NIIMS is intended for all citizens
and foreigners’ resident in Kenya, it was however provided for in legislation providing for registration and
issuance of identification documents for adults who are citizens of Kenya. We note that in response to the
contention that there are inconsistencies between NIIMS and other registration institutions and systems such as
IPRS, the 2nd and 3rd Respondents argue that where appropriate, NIIMS would be deemed to override any earlier
statutory provision that is inconsistent with it. Reliance is placed for this contention on the authority of Kenya
Pharmaceutical Distributors Association v Kenya Veterinary Board & 3 others [2017]eKLR where the Court
held that the provisions of the Veterinary Surgeons and Veterinary Para-Professionals Act, being of a latter statute,
override those of the Pharmacy and Poisons Act where appropriate. The Court was guided in its decision by what it
referred to as the settled principle that “a latter provision or statute overrides the older one or is deemed to have
repealed the earlier one.”
814. The question before us is whether this reasoning is applicable in respect of a latter amendment to a statute that
conflicts with an earlier provision with respect to the application of the Act. To find a solution to this conflict, we
can only seek guidance from the principle of statutory construction and interpretation. The rules of statutory
interpretation of relevance in this respect are those on implied amendment and implied repeal. These rules provide
that where a later enactment does not expressly amend (whether textually or indirectly) an earlier enactment which
it has power to override, but the provisions of the later enactment are inconsistent with those of the earlier, the later
by implication amends the earlier so far as is necessary to remove the inconsistency between them. If the later Act
cannot stand with an earlier, Parliament is taken to intend an amendment of the earlier.
815. This is a logical necessity, since two inconsistent texts cannot both be valid without contravening the
principles of contradiction, that is, contradictory statements cannot both at the same time be true and the court must
do its best to reconcile them. If the entirety of an earlier Act is inconsistent, the effect amounts to a repeal of it. The
test to applied to determine whether there has been a repeal by implication by subsequent legislation is whether the
provisions of a later Act are so inconsistent with, or repugnant to, the provisions of an earlier Act that the two

cannot stand together, as stated by A.L. Smith J. in West Harm Church Wardens and Overseers v Fourth City
Mutual Building Society (1892) 1 QB 654 at 658. Also see the detailed explanations in this respect in Francis
Bennion on Statutory Interpretation, 3rd Edition, pg 214-226, and the decisions in Martin Wanderi & 19
others vs EngineersRegistration Board of Kenya & 5 others (2014) eKLR and AO O & 6 others v Attorney
General & another [2017] eKLR.
816. Applying these principles to the present Petition, it is evident that the provisions of section 9A of the
Registration of Persons Act on the purposes of NIIMS contradicts section 2, and the two provisions cannot operate
at the same time with regards to the application of NIIMS to children. After applying the rules of statutory
interpretation on implied amendment and repeal detailed out in the foregoing, it is our finding section 9A being a
later amendment is deemed to have amended section 2 with respect to its application to NIIMS, and to this extent
the inconsistency is thereby resolved. We therefore find that section 9A of the Registration of Persons Act and
NIIMS applies to children.
817. A second concern raised by the Petitioners with respect to the collection of children’s data is that the
amendments set out in section 9A(2) of the Act establish NIIMS and vest in it functions that are very generic, wide
and ambiguous in scope; that there are no restrictions with respect to what the personal data collected, including
children’s personal data, may be used for. In its view, given children’s vulnerable status, clear distinctions should
have been prescribed, distinct from those made regarding data collected from adults, with respect to the collection,
use, processing and storage of children’s data. This contention ties in with the concerns raised in the affidavit and
oral evidence of Ms. Grace Bomu Mutung’u. While Ms. Mutung’u’s expertise with respect to children’s data was
exposed, particularly in the cross-examination by Mr. Regeru, as rather limited, one cannot fault the principles she
presented to court with regard to children, relative to adults.
818. The 2nd Petitioner also submitted that under the impugned amendments, parents have a mandatory duty to
surrender their children’s information failing which they face the threat of criminal sanctions which is contrary to
international laws, best practice and standards. It was its view that there was no problem or challenge so grave that
requires mandatory registration of children backed by criminal sanctions.
819. We start our analysis on the concerns raised as regards the protection of children’s’ personal data and privacy
by clarifying that there is no specific provision in the impugned amendments that provide for criminal sanctions for
parents of children, as alleged by the 2nd Petitioner, and the 2nd Petitioner did not point us to any such amendment.
The only effect of the impugned amendments that establish NIIMS in this regard is to extend the application of the
Act to children, which we have already addressed in the foregoing.
820. Having made that clarification, we are of the view and find that the general principles and protections that
apply with regards to the right to informational privacy, and our findings in this regard with respect to the biometric
data collected under NIIMS, are also applicable to children as much as they apply to adults, and perhaps even more.
This is because unlike adults, children’s ability to make reasonable choices about what information to share is
limited, as a result of their limited capacities, development and education, and they may thus be less aware of the
risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. In
addition, we are also of the view that while digital literacy may be considered a dimension of the rights of children
to freedom of expression, participation and education, the digital environment can also exposes children to harmful
content, as well as privacy and data protection risks.
821. The question that therefore arises is whether the impugned amendments and NIIMS provide specific
protection with regard to children’s personal data, in light of the above-stated realities. In this regard, there is need
for particular conditions that will apply to a child's consent to process personal data, which clearly indicate the age
when a child is capable of giving such an informed consent, and the requirement of informing the child in an
appropriate manner of the implications of such consent. In addition, where a child is not capable of giving such

consent, the consent must be given or authorised by the verified holder of parental responsibility over the child. The
status of the data given by a child upon attaining the age of majority and the rights to that data also needs to be
addressed by legislation, particularly where the data subject gives his or her consent as a child and is not fully
aware of the risks involved by the processing, and later wants to remove such personal data.
822. We note that no such special protection was provided with respect to the biometric data collected from
children under the impugned amendments, and there is clearly a risk of violation to children’s right as a result of
this inadequacy. We however note that the Data Protection Act No. 24 of 2019 now provides for the processing of
personal data relating to a child under section 33 as follows:
“(1) Every data controller or data processor shall not process personal data relating to a child unless—
(a) consent is given by the child's parent or guardian; and
(b) the processing is in such a manner that protects and advances the rights and best interests of the child.
(2) A data controller or data processor shall incorporate appropriate mechanisms for age verification and
consent in order to process personal data of a child.
(3) Mechanisms contemplated under sub-section (2) shall be determined on the basis of—
(a) available technology;
(b) volume of personal data processed;
(c) proportion of such personal data likely to be that of a child;
(d) possibility of harm to a child arising out of processing of personal data; and
(e) such other factors as may be specified by the
(f) Data Commissioner.
(4) A data controller or data processor that exclusively provides counselling or child protection services to a
child may not be required to obtain parental consent as set out under sub-section (1).”
823. We have noted some gaps in the said provisions, namely that there is no definition of a child in the Act, and
the rights of the child in relation to the personal data collected during minority and upon attaining majority are also
not specified, particularly in light of their evolving capacities. In addition, as observed earlier, despite NIIMS being
applicable to children, there are no special provisions in the impugned amendments, and no regulations that govern
how the data relating to children is to be collected, processed and stored in NIIMS. It is thus our finding that the
legislative framework on the protection of children’s biometric data collected in NIIMS is inadequate, and needs to
be specifically provided for.
Whether there are Sufficient Legal Safeguards and Data Protection Frameworks
824. This issue was similarly argued from several fronts by the parties. The first front presented by the Petitioners
was that there are insufficient data protection laws to secure the personal information collected in NIIMS. The 1st
Petitioner submits that the impugned amendments incorporate a broad, non-exhaustive, definition of “biometric”,
however, that there are no laws in place for the protection of such sensitive data to be collected by the Respondents.

Moreover, that the amendment does not provide with precision the persons that shall have access to the sensitive
data collected and with what persons the data can be shared.
825. The 1st Petitioner further argues that the laws in place such as the Access to Information Act and Computer
Misuse and Cybercrimes Act were not enacted to implement Article 31 of the Constitution. It was contended that
the effect of such a void in the law is that the data could fall in the hands of unauthorized third parties which is a
contravention of the right to privacy and no one shall take responsibility for the damages suffered.
826. The 2nd Petitioner’s submissions were that the impugned amendments sanction mandatory or non-consensual
collection of personal information without concomitant data protection laws. Further, that the data protection laws
legislate and operationalize key data protection principles that strike the balance between the use of information
and communication technologies and the protection of the privacy of citizens. The said principles of data protection
were detailed by the 2nd Petitioner. It was its submission that contrary to international standards and best practices
that advocate for the clear and explicit regulation of the entire spectrum of data collection, retrieval, processing,
storage, use and disclosure, the impugned amendments appear to place a premium on what the Government
believes will make its work easier with least or no regard whatsoever to the effect of its actions on privacy rights.
827. Furthermore, that the Principal Secretary in the Interior Ministry has been given free rein to prescribe
subsidiary regulations on critical aspects of personal data, which should otherwise be regulated by a substantive
data protection law, which is in breach of Article 94(6) of the Constitution which provides for conditions that apply
when regulation making power is given to any public officer.
828. The 2nd Petitioner further submits that the risks of the foregoing weaknesses of NIIMS are further exacerbated
by the absolute lack of data protection laws for the sensitive personal biometric data proposed for collection under
the impugned amendments. In its view, the conceptualization of NIIMS and its operationalization contravene every
known data protection law, rule, standard, policy and best practices, most of which were adduced as evidence by
the Respondents, including the Data Protection Policy and Bill of 2019 and the EU GDPR .
829. In conclusion, the 2nd Petitioner submits that criminal sanctions cannot be sufficient safeguards to mitigate
against the risks of data misuse and privacy breaches. Further, that by its very nature, technology is borderless and
can be breached from anywhere including overseas. Accordingly, for the operationalization of NIIMS to give effect
to the right to privacy under Article 31, it is imperative that appropriate technical and legal standards be formulated
to ensure the security of the proposed digital identification system and the privacy of personal data collected by the
same, and that no prejudice will be occasioned to any person in suspending the impugned laws until then.
830. The submissions by the 3rd Petitioner were that there is no data protection law or policy in place that would
adequately address the concerns in the event there is misuse of information, and yet Article 24 of the Constitution
sets out clear, concrete and objective circumstances in which a right or fundamental freedom in the Bill of Rights
may be limited.
831. The 5th Interested Party joins the Petitioners in reiterating that the law under which all the activities under
NIIMS are purported to be done, including collection of personal information, lacks the safeguards required of a
law that authorizes the processing of personal information. It relied on the Julian Robinson Case where the
Supreme Court of Jamaica directed that the law must afford appropriate safeguards to prevent use of the data in a
manner inconsistent with the guaranteed right. Further, that the GDPR also prohibits the processing of biometric
information, which may only be allowed where the data subject has given explicit consent and in specified
circumstances, and provide for suitable and specific measures to safeguard the fundamental rights and the interests
of the data subject. It was also pointed out that these standards are replicated in the African Union Convention on
Cyber Security and Personal Data Protection, which is evidence that data protection standards may be elevated to
the level of a general rule of an international law, making it a valid source of law in Kenya.

832. The Respondents in their submissions sought to illustrate that there were sufficient data protection laws. The
1st Respondent submits that there are ample statutory and regulatory safeguards for data protection, and that active
steps are being taken to make the said safeguards even more robust. To that end, that section 28 of Access to
Information Act 2016 makes provisions for the punishment of three years imprisonment or a fine not exceeding 1
million or both to any person who knowingly discloses exempt information, including information that entails
unwarranted invasion of the privacy of an individual. It was its submission further, that the Kenya Information and
Communication Act No. 2 of 1998, and Computer Misuse and Cybercrimes Act No.5 of 2018 provide additional
protection that enable timely and effective detection, prohibition, prevention, response, investigation and
prosecution of computer and cybercrimes.
833. In this respect, it was contended that NIIMS as introduced by the impugned amendment is a “protected
computer system” which by definition means a computer system used directly in connection with, or necessary for
the provision of national registration systems. Further, that the penalty for any unlawful interference is enhanced to
25 million shillings or imprisonment of a term not exceeding twenty years or both. In view of the foregoing, the 1st
Respondent submits that there exists legal and institutional framework for the promotion and protection of personal
data.
834. The 2nd and 3rd Respondents urge that that the constitutionality of the subject amendments cannot be
challenged on the basis of alleged absence of adequate data protection law. They based that submission on the
reasoning of Chief Justice Sykes in the Julian Robinson Case, where he opined that “constitutionality or lack of it
cannot be decided on what legislation is to come; and is determined on what is.” The said Respondents further
relied on the case of Bernard Murage v Fineserve Africa Limited & 3 others [2015] eKLR, where the Court
declined the invitation to halt the roll out of Thin SIM technology pending the enactment of the Data Protection
Bill, and observed that it cannot order Parliament to make specific laws but only test both the process leading to
those laws and their contents against the constitutional muster.
835. The 4th and 7th Respondents also submit that there are safeguards in place to ensure the security of the
information through extensive legislative framework on data protection, information security, modalities on access
to information as well as protection of the integrity of government records and information. Furthermore, that the
Access to Information Act, 2016 contains safeguards for the protection of the data to be stored in NIIMS, and
provides that it is an offence for any person to disclose exempt information in contravention of the Act.
836. The above submissions were echoed by the 5th Respondent, who acknowledged that there is no exclusive data
protection law, save for a data protection policy which is in operation. It was further its submission that there is a
Data Protection Bill currently under debate in the National Assembly. That once passed, the Bill shallgive effect to
Article 31(c) of the Constitution, and shallalso regulate the collection, retrieval, processing, storing, use and
disclosure of personal data. In addition, the 5th Respondent submits that notwithstanding the lack of a specific data
protection law, numerous statutes offer safeguards to State held data.
837. To that end reference was made to the Kenya Information and Communication Act (KICA) which provides for
specific offences in this regard. The 5th Respondent further submits that the Official Secrets Act classifies
government information and protect personal data and the Computer Misuses and Cyber Crimes Act 2018, provides
for offences and penalties relating to computer systems. With particular respect to Registration of Persons Act, it
was the 5th Respondent’s submission that it has a limitation on who may access personal data and who can use it or
share it. Furthermore, that there has been no previous breach of the data, that would have required an amendment to
cater for NIIMS.
838. In light of the intervening events after the hearing of this case in terms of enactment of the Data Protection Act
of 2019, we will address the arguments on the legal framework for data protection at this stage, before dealing with
the other arguments made by the Petitioners on the adequacy of the safeguards for data protection. In this respect,

when the parties were given an opportunity to submit on the Data Protection Act, all the parties requested the Court
to take judicial notice of the Data Protection Act. There were however differing opinions as to how we should do
so. The Petitioners were emphatic that we should take judicial notice of the passing of the Act and nothing more,
while the Respondents submitted that taking judicial notice of the Act, entailed consideration of the Act’s
provisions.
839. Section 60 (1) of the Evidence Act obliges this Court to have judicial notice of all written laws, and provides
as follows in this regard:
“60. (1) The courts shall take judicial notice of the following facts –
(a) all written laws, and all laws, rules and principles, written or unwritten, having the force of law, whether in
force or having such force as aforesaid before, at or after the commencement of this Act, in any part of Kenya”
840. The role and effect of judicial notice is explained in Halsbury’s Laws of England, Fourth Edition at
paragraph 100 as a special mode of proving evidence, and it is stated therein that in addition to the adducing of
documents and testimony of witnesses, the other modes of proving or establishing a fact are formal admissions,
judicial notice, presumptions and inspection. Judicial notice is therefore a rule in the law of evidence that allows a
fact to be introduced into evidence, if the truth of that fact is so notorious or well known, or so authoritatively
attested, that it cannot reasonably be doubted.
841. Furthermore, facts and materials admitted under judicial notice are accepted without being formally
introduced by a witness or other rule of evidence, and they are even admitted if one party wishes to lead evidence
to the contrary. It is thus our opinion that we will not only take judicial notice of the fact that the Data Protection
Act 24 of 2019 was enacted, but also of the law contained therein, as expressly provided by section 60 (1) of the
Evidence Act. In this respect we note that the date of commencement of the Data Protection Act 24 of 2019 was
25th November 2019.
842. We have observed in our earlier findings that the protection of personal data depends largely on a legal,
regulatory and institutional framework that provides for adequate safeguards, including effective oversight
mechanisms. This is especially the case with NIIMS, whereby a vast amount of personal data is accessible to State,
and data subjects currently have limited insight into and control over how information about them and their lives is
being used.
843. Having taken judicial notice of the existence of the Data Protection Act, our focus in our analysis of the issues
raised by the parties, is the extent to which the Act complies with internationally accepted standard on data
protection. Parties in this respect made reference to the EU GDPR which provides for principles of data protection.
This is however a regional negotiated regulation. Likewise, the United Nations Principles on Personal Data
Protection and Privacy which were cited by some of the parties are only applied by the United Nations System
Organizations in carrying out their mandated activities. In considering this issue, we take the view, and will be
guided by the principles developed by the Organisation for Economic Co-operation and Development (OECD)
namely the OECD Privacy Principles, which is in our view a more comprehensive and internationally recognized
data privacy and protection framework that we deem most appropriate for our purposes. We also note that the said
principles have been replicated in the African Union Convention on Cyber Security and Personal Data Protection.
844. The first set of principles in the OECD Privacy Principles relate to the collection, processing and use of data.
In this respect, the Collection Limitation Principle, which provides that there should be limits to the collection of
personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the
knowledge or consent of the data subject. In addition, the Data Quality Principle provides that personal data should
be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be

accurate, complete and kept up-to-date.
845. Thirdly, the Purpose Specification Principle provides that the purposes for which personal data are collected
should be specified not later than at the time of data collection, and the subsequent use limited to the fulfilment of
those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of
change of purpose. The Use Limitation Principle provides that personal data should not be disclosed, made
available or otherwise used for purposes other than those specified except with the consent of the data subject; or
with the authority of law.
846. Principles 1 to 3 on processing of data in Article 13 of the African Union Convention on Cyber Security and
Personal Data Protection in this respect provides for similar principles of consent and legitimacy, lawfulness and
fairness, and purpose, relevance and storage.
847. The Data Protection Act has provided for detailed principles on collection, processing and transfer of data in
Parts IV, V, and VI of the Act. In particular section 25 of the Act provides for and summarises the principles of
personal data protection as follows:
“25. Principles of data protection
Every data controller or data processor shall ensure that personal data is—
(a) processed in accordance with the right to privacy of the data subject;
(b) processed lawfully, fairly and in a transparent manner in relation to any data subject;
(c) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible
with those purposes;
(d) adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed;
(e) collected only where a valid explanation is provided whenever information relating to family or private
affairs is required;
(f) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any
inaccurate personal data is erased or rectified without delay;
(g) kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was
collected; and
(h) not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from
the data subject.”
848. The elements of these principles are detailed in subsequent sections of the Act. The next set of principles in
the OECD Privacy Principles relate to the storage and rights to collected data. The Security Safeguards Principle
provides that personal data should be protected by reasonable security safeguards against such risks as loss or
unauthorized access, destruction, use, modification or disclosure of data. The Openness Principle requires general
policy of openness about developments, practices and policies with respect to personal data. Furthermore, that
means should be readily available of establishing the existence and nature of personal data, and the main purposes
of their use, as well as the identity and usual residence of the data controller.

849. Under the Individual Participation Principle, and an individual should have the right:
a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating
to him;
b) to have communicated to him, data relating to him
i) within a reasonable time;
ii) at a charge, if any, that is not excessive;
iii) in a reasonable manner; and
iv) in a form that is readily intelligible to him;
c) to be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such
denial; and
d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed
or amended.
850. Lastly, under the Accountability Principle, a data controller should be accountable for complying with
measures which give effect to the Privacy Principles. It is notable that the African Union Convention on Cyber
Security and Personal Data Protection in this respect provides for the principles of accuracy, transparency,
confidentiality and security as principles 4 to 6 in Article 13.
851. The Data Protection Act in this respect provides for an independent office of the Data Commissioner, who is
appointed by the Public Service Commission, to oversee the implementation of the Act, and who is also given
power to register data controllers and processors. Data Controllers are defined as the persons or entities that
determine the purpose and means of processing of personal data, while data processors are the persons or entities
that process data on behalf of the Data Controller. The Act also provides for the rights of Data Subjects including
rights of access to personal data and correction or deletion of misleading data. It also details the procedures for
rectification and erasure of personal data. Lastly, the Act has an enforcement section which among other provisions
provides for a procedure for complaints and offences for unlawful disclosure of data. The Data Commissioner is
required to give an Annual Report to the relevant Cabinet Secretary, and may carry out audits of data controllers.
852. While we find that the Data Protection Act has included most of the applicable data protection principles, we
noted that the Registration of Persons Act is not one of the Acts to which the Data Protections Act applies as part of
the consequential amendments. This notwithstanding, since one of the objectives of the Act is the regulation of the
processing of personal data, whose definition as we have already found includes biometric data collected by
NIIMS, it is our finding that it also applies to the data collected pursuant to the impugned amendments. We also
note that there are a number of areas in the Data Protection Act that require to be operationalized by way of
regulations, including circumstances when the Data Commissioner may exempt the operation of the Act, and may
issue data sharing codes on the exchange of personal data between government departments. It is our view that
these regulations are necessary, as they will have implications on the protection and security of personal data.
853. Once in force, data protection legislation must also be accompanied by effective implementation and
enforcement. The implementation of the Data Protection Act 24 of 2019 requires an implementation framework to
be in place, including the appointment of the Data Commissioner, and registration of the data controllers and
processors, as well as enactment of operational regulations. Therefore, it is our finding that while there is in

existence a legal framework on the collection and processing of personal data, adequate protection of the data
requires the operationalization of the said legal framework.
854. The second front of the arguments put forward on the protection and security of the personal data to be
collected pursuant the impugned amendments relate to the design and implementation of NIIMS. There were three
limbs to these arguments. The first limb of the arguments made by the Petitioners in this regard was that extensive
personal information is being collected by NIIMS in a centralized database which is linked to other functional
databases, exposing it to breaches and unauthorised disclosure.
855. The 1st Petitioner submit in this respect that it is clear from the Respondents’ evidence and public statements
that NIIMS and the Huduma Namba associated with it are designed to create a cross-fertilized web of databases
containing personal data of all sorts, and the Respondents have not provided any evidence to suggest that the
NIIMS database and other government databases will not be linked in any way. In its view, the Respondents have
not controverted the Petitioners’ prima facie case that the databases will seed each other, permitting invasive
searches using a single unique identifier that links across multiple government databases. Furthermore, that,
contrary to the assertions of the Respondents and their experts, NIIMS fails to capture the more recent innovations
developed to strengthen data protection in the Aadhaar system, let alone other options that would not establish a
massive, centralized biometric database.
856. The 1st Petitioner contends that the 5th Respondent’s expert witness, Loyford Muriithi, states in his affidavit
that the NIIMS database will not have access to functional data, except on a “need basis,” but also states that the
NIIMS database “cannot access functional data” stored in institutional databases. Thus, the assertion, without any
support, is internally contradictory and conflicts with multiple other descriptions of the NIIMS database by the
Respondents’ other experts.
857. Accordingly, that there are no legal limitations on access between the NIIMS database and functional
databases, and no verifiable public information on the technical structure of the system precludes it. Furthermore,
that the Respondents’ evidence misstates the inevitability of a centralized master population registry model, and
that the seeding of data from one database to another further undermines the argument that NIIMS could
conceivably be considered data-minimal. The 1st Petitioner submits that the real hazardous data trail comes not just
from the master population register, but also from all the other databases that are linked using Huduma Nambas and
the authentication logs. It was pointed out in this regard that the absence of integration and seeding between
Aadhaar and functional databases is a chief reason that the system was upheld in the Justice K.S. Puttaswamy
(Retd.) and Another v. Union of India and Others (supra).
858. The 2nd Petitioner submissions on this limb were that NIIMS will be accessible to various government
agencies from the centralized data base, which re-affirms the fear that biometric data stored therein will be
susceptible to meddling by third parties. The 2nd Petitioner submits that there is no evidence that encryption will
guarantee the security or privacy of the said information. Moreover, there are no regulations, principles or
standards against which the propriety or sufficiency of the security systems purportedly deployed for NIIMS can be
measured and no attempt has been made to demonstrate, by way of actual verifiable evidence, that NIIMS does
have the security features the Respondents say they have.
859. The 2nd Petitioner further argues that it has not been demonstrated that it is even necessary for other
Ministries, Departments and State agencies to directly access NIIMS for purposes of ‘authentication or verification
of identification’, as opposed to requesting for authentication from the central database and thereby eliminate the
need for third party access. It was submitted that the fact that NIIMS was purportedly developed by the State and is
under the exclusive control of the State engenders the idea of a monopoly of data collection, processing, storage
and use contrary to best practice and standards for data protection. In conclusion, the 2nd Petitioner submits that the
objects and benefits of centralized databases are far outweighed by the potential risks to fundamental rights and

freedoms attendant on the said databases.
860. The 3rd Petitioner did not specifically address this limb in their submissions, while the 5th Interested Party
counsel contends that while collation of information into one database would make work easier, this does not
constitute a necessary reason to violate one’s privacy. Furthermore, that one of the effects of collating all the
information into one database would be that of State surveillance, as acknowledged by the Supreme Court of
Jamaica in the Julian Robinson Case (supra).
861. Closely related to the first limb of the Petitioners’ arguments on the design of NIIMS, is the second limb that
the legal and technical principles on data protection and security were not incorporated in the NIIMS system design
and architecture. This aspect was mainly addressed by the 2nd Petitioner, who submitted that by their own
testimonies, the Respondents have demonstrated that the NIIMS software was developed contrary to established
international norms, standards and best practices for similar identity systems, including the recommendations of
their own expert witness ,Mr. Brian Omwenga, in his report titled Principles Of Government Enterprise
Architecture.
862. The 2nd Petitioner further submits that some of the core principles of data protection is that personal data
should be collected for specified, explicit and legitimate purposes. In addition, that the principle of data
minimization requires that personal data collected be adequate, relevant and limited to what is necessary in relation
to the purposes for which it is collected. The 2nd Petitioner further argued that at the very least, the digital
identification related technical standards employed for NIIMS should be well documented including standards for
platform independence for interoperability, network security, incident handling, database security, and critical
infrastructure security. As it were, they argued that those omissions offend the principles of transparency and
accountability under Article 10 of the Constitution and essentially surrender the safety and security of vital personal
information to the whims of the State.
863. Lastly, the 2nd Petitioner submits that any and all implementation tools designed by the Respondents for
NIIMS, including the data capture forms, ought to be anchored in law and regulations for certainty and oversight.
Therefore, that all information gathered under the impugned amendments was unlawfully gathered using a data
capture form whose legal status is, by the Respondents’ own admissions, unknown in law.
864. The Respondents defended the NIIMS architecture and design in their submissions. The 2nd and 3rd
Respondents submit that the NIIMS database would be linked with functional databases for purposes of enabling
functional institutions such as the Directorate of Criminal Investigations to request for authentication of identity of
individuals. To that effect, the NIIMS database will be accessible to functional databases, whilst functional
databases will be inaccessible to the NIIMS database, which is a concept of data-minimization architectural design
that ensures high security and integrity, and that it retains purely identity information.
865. The 2nd and 3rd Respondents further submit that there are measures in place to ensure the safety of personal
identity information collected in NIIMS as follows:
(a) Encryption of the requisite biometric and biographical information at the point of capture by the NIIMS data
capture kits (at the point of registration).
(b) Transmission of the encrypted data to the requisite servers for deduplication.
(c) The templates of biometric and biographical information stored in the NIIMS database are encrypted as well.
It was their submission that any data breach of the NIIMS database would only reveal encrypted templates of
personal identity information, which cannot be unmasked without the requisite decryption key.

866. The 5th Respondent also maintain that there are sufficient safeguards in law and that Kenya has adequate
infrastructure to protect data, and point to the various levels of security applied to safeguard the collected data,
namely that the data is encrypted, and access is restricted using almost impenetrable and highly sophisticated
mechanisms in line with international best practices, assuring confidentiality and integrity of data. Further, that
NIIMS adopted UNICEF remedial measures which addressed the gaps in data sharing protocol between
government agencies, underwent sufficient tests and trials, and was benchmarked on errors that was a problem in
other jurisdictions including India, in order to provide a system that will not be threatened by malicious individuals.
867. The 5th Respondent further submits that their experts had demonstrated that there are no deficiencies in the
NIIMS system design, and that the data in the custody of the State is well secured. That Mr. Brian Omwenga, who
was its expert witness, was categorical that access and security of the data is subject to three common modes of
authentication, namely, something you know, such as a password; something you have, such as an access card; and
finally something you are, such as biometrics. Further, that the said expert stated that any or all of three modes of
authentication may be incorporated in identity systems, and that while it has become common practice to combine
the said modes, it is generally agreed that a most robust factor of authentication and identification is based on
biometrics.
868. It was the further submission of the 5th Respondent that the evidence of the expert witness was that identity
systems entail the maintenance of population registers which contain selected personal information, including
biometrics, pertaining to each member of the resident population of a country, and that the population registers may
either be centralized, decentralized or a combination of both. Further that they could also be manual or electronic,
and that the United Nations Principles and Recommendations for a Vital Statistics System, provides that a
population register need not take a specific form.
869. It was also argued by counsel for the 8th and 9th Interested Parties that the use of integrated databases,
including DNA databases is now one of the most effective tools in fighting crime especially crimes involving
violence, terrorism and sexual offences. The said Interested Parties argue that the consolidated Petitions are
predicated on the theory that governments should be treated with suspicion and are not to be trusted with data or are
incapable of responsibly dealing with data, yet millions of Kenyans have entrusted their most private data with
private entities and social media companies including Facebook, Twitter, Tinder, and Google, who retain such data
in cloud repository servers.
870. The last limb of the arguments made on the inadequacy of the safeguards of personal data, was on the paucity
of information on the security features of NIIMS. The 1st Petitioner’s submissions on this aspect were that the
thrust of the Respondents’ arguments were on “security by obscurity”, which is a largely elementary and
discredited approach to data security, and is also a convenient means of ensuring that neither the Petitioners, nor
this court, nor any data subject, will be able to verify the truth of the Respondents’ unsupported assertions
concerning the security of data, the technical constraints on purpose creep, or any of the other design features that
might mitigate the concerns raised in these petitions, given that once a biometric system is compromised, it is
compromised forever.
871. The 1st Petitioner further submits that the Respondents have furnished no information on how individuals will
learn of, let alone address, flaws in original data registered associated with their person, or false positives and
negatives generated through the (non-public) algorithms being employed, at any stage (enrolment or authentication,
for example). In addition, that there is no information concerning how the Respondents will address discrepancies
in existing administrative data housed in functional institutional databases.
872. The 2nd Petitioner on its part submits that Loyford Muriithi one of the Respondent’s experts, in his evidence
on cross-examination admitted that a certain level of information on architecture can be shared without
compromising the system, to facilitate critique and understanding of the system by persons skilled in the art of

information technology. Yet, that no such information has been shared with the Kenyan public despite the clear
constitutional directive under Article 10. Therefore, that the inevitable conclusion in the circumstances is that the
public was deliberately misledwith promises of better services by NIIMS, without any information on risks
attendant to centralized mass personal data in the system whose security, if any, is clouded in opaqueness and
mystery.
873. The 5th Respondent responded to this argument by submitting that information on NIIMS ought not to be
made available to every well-wisher as that would make it susceptible to compromise. That in the interest of
national security, access to information is limited to avoid placing national data into jeopardy. Reliance was placed
on the decision inTrusted Society of Human Rights Alliance & 3 Others v Judicial Service Commission [2016]
eKLR, where the Court held that exceptions to the right to access information apply where there is a risk of
substantial harm which is greater than the overall public interest in having access to the information.
874. Our analysis will address all the three limbs of argument made, as they all relate to the safety and security of
the NIIMS design and its implementation framework. We received detailed testimony on the architecture and
design of NIIMS, in particular as to it procurement, whether it is a centralized database or decentralized database or
both, the standards that apply to the architecture of identification systems, and whether NIIMS is using closed or
open source technology. We note in this regard that even though arguments were made on the procurement of
NIIMS, and participation of the companies known as OT Morphi or Idemia in the process, no evidence was tabled
before this Court on the process of tendering and of the award of the tender of NIIMS. We are therefore not able to
make any findings on the procurement of NIIMS.
875. In addition, while the architecture and the design of a biometric identification determines how the components
of the system are organized and integrated, including the ways the flows and transfers of data take place, and the
specifications of where the data will be stored and how it will be accessible, it is beyond the scope of this Court’s
jurisdiction and capabilities to prescribe the choices that can be made in such a system’s architecture and design.
We are also of the view that legislation that aims to regulate technology driven innovations should not depend on
the particularities of a given technology at a particular time, as biometric technologies will further evolve, and
cannot be the criterion for issuing legislative obligations. For these reasons, we are also not able to make any
specific finding as invited by Mr. Anand, the 1st Petitioner’s expert witness to do, on the archaic, progressive or
other nature of NIIMS.
876. We will therefore restrict ourselves to the risks to the right to privacy and to data protection of data attendant
with the design of, and security of NIIMS, that will require legal intervention. In this respect we are persuaded by
the evidence of Dr. Fisher, the 1st Petitioner’s expert witness as to the risks that may arise with biometric identity
systems. He deposed that identity systems can lead to exclusion, with individuals not being able to access goods
and services to which they are entitled, thus potentially impacting upon other rights, including social and economic
rights. He stated that exclusion as a result of an identification system can come in two forms. Firstly, in cases where
individuals who are entitled to but are not able to get an identification card or number that is used for service
provision in the public and private spheres. Secondly, that even people enrolled on to biometric systems can suffer
exclusion arising from biometric failure in their authentication.
877. On data breaches, Dr. Fisher averred that breaches associated with identity systems tend to be large in scale,
with rectification either being impossible or incurring a significant cost. Further, that the breaches affect individuals
in a number of ways, whether identity theft or fraud, financial loss or other damage. His view was that the more
data and the more sensitive that data, the higher the risk. With regard to the concern of function creep, Dr. Fisher
averred that the mere existence of data in a centralised identification system leads to the temptation to use it for
purposes not initially intended, what he referred to as ‘mission or function creep’.
878. The concerns of access to and retention of data was explained by Dr. Fisher as arising from the fact that the

introduction of an identity system entails the mass collection, aggregation and retention of people’s personal data
which has implications on the right to privacy. It was his averment therefore, that adequate safeguards should be
put in place to ensure that such data is relevant and not excessive in relation to the purposes for which it is stored,
and that it is preserved in a form which permits identification of the data subjects for no longer than is required.
Further, that the law must also afford adequate guarantees that retained personal data is efficiently protected from
misuse and abuse.
879. Mr. Anand, similarly raised similar concerns in his evidence about the purpose free architecture of NIIMS, its
lack of data minimization, its exclusionary design, and the risks of mass surveillance, breaches and fraud during
decryption of data.
880. Our view as regards the centralized storage of the biometric data of data subjects is that there will be risks of
attacks or unauthorized access which exist with any storage of other personal data, but the most important risks are
related to the misuse of the biometric data because this is data which are uniquely linked with individuals, which
cannot be changed and are universal, and the effects of any abuse of misuse of the data are irreversible. The misuse
can result in discrimination, profiling, surveillance of the data subjects and identity theft. In addition, as a result of
the central storage of biometric data, in most cases the data subject has no information or control over the use of his
or her biometric data.
881. The report of the United Nations High Commissioner for Human Rights on The Right to Privacy in the Digital
Age indicated as follows in this regard:
“The creation of mass databases of biometric data raises significant human rights concerns. Such data is
particularly sensitive, as it is by definition inseparably linked to a particular person and that person’s life, and
has the potential to be gravely abused. For example, identity theft on the basis of biometrics is extremely difficult
to remedy and may seriously affect an individual’s rights. Moreover, biometric data may be used for different
purposes from those for which it was collected, including the unlawful tracking and monitoring of individuals.
Given those risks, particular attention should be paid to questions of necessity and proportionality in the
collection of biometric data. Against that background, it is worrisome that some States are embarking on vast
biometric data-based projects without having adequate legal and procedural safeguards in place.”
882. We also note that these risks will also arise where the storage of biometric data is distributed between a central
and federated or decentralized databases, which can be sometimes even amplified. In particular, there will be
increased risks of unauthorized access and use and tracking of personal data during the process of linking the
information, and the possibilities for re-use for unintended purposes of data held in decentralized databases. For
these reasons, biometric data should be protected at every phase by the system design, from the collection,
processing, use and retention of the data, and in all types of biometric identification databases, whether centralized
or decentralized.
883. It is our conclusion therefore that all biometric systems, whether centralised or decentralised, and whether
using closed or open source technology, require a strong security policy and detailed procedures on its protection
and security which comply with international standards. We were referred to some of the applicable principles and
standards that should govern the design and architecture of NIIMS in relation to its data, its application,
technology, architecture and security, by both the Petitioners and Respondents’ experts, and which are highlighted
in the report by Mr. Brian Omwenga on Principles Of Government Enterprise Architecture.
884. For our purposes, what is relevant is that the said principles and standards should be provided and actualized
in regulations that will govern the operation of NIIMS. In addition, the biometric data and personal data in NIIMS
shall only be processed if there is an appropriate legal framework in which sufficient safeguards are built in to
protect fundamental rights. An example of similar Regulations in India that were framed under the Aadhaar Act,

were the Aadhaar (Enrolment and Update) Regulations, 2016, The Aadhaar (Authentication) Regulations, 2016,
The Aadhaar (Data Security) Regulations, 2016 and the Aadhaar (Sharing of Information) Regulations, 2016.
885. In this respect, while the Respondents explained the measures they have put in place to ensure the safety of the
data collected by NIIMS and the security of the system, including the encryption of the data and restricted access, it
was not disputed by the Respondents that there is no specific regulatory framework that governs the operations and
security of NIIMS. The Respondents also did not provide any cogent reason for this obvious gap. To this extent we
find that the legal framework on the operations of NIIMS is inadequate, and poses a risk to the security of data that
will be collected in NIIMS.
886. Lastly, on the arguments made on the paucity of information on the security and safeguards of personal data
provided by NIIMS, we note that the Petitioners did not bring any evidence of having complied with the Access to
Information Act, for us to find a violation on this account. The procedures for accessing information are set out in
sections 8 to 11 of the Access to Information Act, which includes that an application for access to information
should be made by an applicant who shall provide details and sufficient particulars for the public officer or any
other official to understand what information is being requested.
887. Therefore, the duty to disclose any information on NIIMS on the part of the Respondents will only arise where
there is a request made and there is a refusal by the Respondents to disclose. No such evidence of such request and
refusal was presented by the Petitioners, and it is thus our finding that their arguments on this front did not have a
legal basis.
Whether the Impugned Amendments are an Unnecessary, Unreasonable and Unjustifiable Limitation.
888. The 1st Petitioner submits that if the Court finds that a limitation to a right is provided by law such as the
amendments to the Registration of Persons Act, then it should proceed to the proportionality analysis contained in
Article 24(1). It cites the cases of Kenya National Commission on Human Rights & Another vs Attorney
General & 3 Others, [2017] eKLR and Jacqueline Okuta & Anor vs Hon. Attorney General & 2 Others,
Petition No. 397 of 2016, for the position that the determination of the issue whether a law that limits rights is
justified is by arrived at by asking whether the law is proportionate. Further, that proportionality is defined as ‘the
set of rules determining the necessary and sufficient conditions for a limitation on a constitutionally protected right
by a law to be constitutionally protected’, the elements of which are delineated in Article 24(1).
889. The 1st Petitioner cites the Jamaican Supreme Court decision in the Julian J Robinson Case which opted for
“the strict application” of the proportionality test as “the best way to preserve fundamental rights and freedoms”.
Further, that in Geoffrey Andare v Attorney General & 2 others [2016] eKLR the court extensively relied on the
Oakes Test in interpreting the Constitution in a manner that advances the rule of law and human rights.
890. The 2nd Petitioner on its part cites the case of Kenya Human Rights Commission v Communications
Authority of Kenya & 4 others [2018] eKLR for the test against which limitation of any right recognized under
the Bill of Rights may be permitted under Article 24 of the Constitution. It submits that under Article 24(3) of our
Constitution, the burden of proving the reasonableness and proportionality of any limitation of a fundamental right
is expressly reposed in the state and has to be discharged on a high standard based on cogent and persuasive
evidence. The case of Robert Alai v The Hon Attorney General & Another [2017] e KLR was cited in this
regard.
891. According to the 2nd Petitioner, when held against the above standards, it is clear that the Respondents have
merely strived to justify the purpose of NIIMS amendments without cogent and/or persuasive evidence to
demonstrate that the stated purpose is sufficiently important to warrant overriding the fundamental right to privacy
and connected rights; or that the measures adopted have been carefully designed to achieve the stated purpose of

NIIMS; or that the means used to achieve the stated objectives of NIIMS are the only available and viable
alternatives that would least violate the right to privacy; or that the benefit arising from the violation is in fact
greater than the harm to the right.
892. The 3rd Petitioner on its part points out that Article 24 of the Constitution sets out clear, concrete and objective
circumstances in which a right or fundamental freedom in the Bill of Rights may be limited.
893. The 5th Interested Party introduces the argument that the collection of personal information as was done to
implement NIIMS was ultra vires the Registration of Persons Act, since the information collected using the data
capture form is identical to the information to be collected by the Principal Registrar under Section 5 of the
Registration of Persons Act. According to the 5th Interested Party, the power to collect that kind of information is
only reserved for the Principal Registrar. For this reason, counsel urged the court to find that the Registration of
Persons Act does not grant any powers to any person to collect personal information under NIIMS, and the
information collected during the mass registration exercise was therefore unlawful and consequently
unconstitutional. It is however noted by this Court that the Petitioners did not plead this specific illegality in their
Petitions, and the Respondents therefore had no opportunity to respond to matters being raised by the 5th Interested
Party for the first time in submissions.
894. The 6th Interested Party submits that the Respondents deliberately sought to circumvent Article 24 of the
Constitution by pretending that the amendments are minor and of no significance. However, that as long as it is
demonstrable that the amendments threaten and/or limit a fundamental right or freedom, the Respondents cannot
escape the requirement to comply with Article 24 of the Constitution. According to the 6th Interested Party, the
amendment to the Registration of Persons Act to include biometric data is excessive, unwarranted, unreasonable
and unjustifiable in an open and democratic society and impacts directly on an individual’s right to privacy and
bodily integrity secured under Article 31 of the Constitution.
895. Further, that the requirement or collection of DNA of any individual is generally and widely recognised to be
the exception rather than the norm and its retrieval or collection must be for a specific proven purpose, specifically
authorised by a legal warrant where proved to be necessary and on a case-by-case basis. In addition, that the data is
easily susceptible to serious abuse and/or misuse in the wrong hands that can lead to irreparable damage including
security threats to individuals.
896. The 1st Respondent submitted on this issue in rebuttal, and contends that the Constitution sanctions the
requisition or revelation of one’s private affairs or that of the family where necessary. It beseeched the court not to
adopt the Jamaican decision in Julian J Robinson Case (supra) on the basis that the Court has the obligation to
place those decisions in their rightful context whenever it applies comparative jurisdiction. They urged the Court to
find persuasion in the dissenting opinion in In the Matter of the Principle of Gender Representation in the
National Assembly and the Senate [2012] eKLR .
897. It was the 1st Respondent’s submission that there was a clearly set out legitimate State aim in seeking the
information; to create an integrated national identity management system. To further emphasize the fact that
constitutional rights are not absolute, the 1st Respondent finds persuasion in R vs Director of Serious Fraud
Office, ex parte Smith [1993] AC 1, where it was held that few would dispute that some curtailment of the liberty
is indispensable to the stability of society.
898. In conclusion, the 1st Respondent submits that the amendments in issue were legal, contemplated in the
Constitution and for a defined legitimate State aim. That it accounts for proportionate interference within the
context of contemporary practices, developments and sophistication of life. Further, that it was in the province of
the political arm of the government to determine what constitutes necessary information for government purposes,
and as such Courts ought to exercise some measure of deference to the repository of the constitutional powers on

matters of policy under the doctrine of separation of powers.
899. The 4th and 7th Respondents similarly submit that the right to privacy is not absolute. Therefore, that in
determining the type of information that may be revealed, it would be prudent to establish the purpose/objective of
doing so and the value of that information. Further, that the collection of personal information by the State is in
accordance with the social contract theory, in that, when ceding their sovereignty to the State, the citizens cede
control of certain aspects of their lives and give up the condition of unregulated freedom, including their personal
information, in exchange for the security of a civil society governed by a democratically elected government.
Reliance was placed on the decision by the European Court of Justice in Michael Schwarz v Stadt
Bochum C"291/12, EU:C:2013:670 (17 October 2013) for this position.
900. The 5th Respondent echoes the arguments by the other respondents and submits that the Petitioners failed to
state with the required degree of precision the manner in which the alleged threat to the right to privacy has or
would be infringed. Further, that they have not demonstrated the way the Respondents intend to obtain any
information for unlawful purpose. As such, the petition is hypothetical and speculative. According to the 5th
Respondent, it was not disputed that the state bears the right to limit rights bargained by society upon appropriate
legal criteria that meets a public interest and purpose.
901. The 5th Respondents argues that that two main standards apply when legislation limits a fundamental right in
the Bill of Rights, namely, the rationality test and the reasonableness orproportionality test, in line with the
provisions of Article 24 (1) of the Constitution, which provide that such a limitation is valid only if it is
“reasonable and justifiable in an open and democratic society”.
902. In justifying rationality of the impugned data, it was the 5th Respondent’s argument that data was collected for
a reasonable State objective. The 5th Respondent invited this Court to note that the right to privacy is not a non-
derogable right under Article 25 of the Constitution, and cited the decision in Canadian Supreme Court in case ofR
vs Oakes 1 SCR 103, which restated the key principles that apply to determine whether a limitation of a right is
reasonable and demonstrably justified in a free and democratic society.
903. The 6th Respondent on its part submits that the right to privacy is not absolute, and is subject to limitation as
provided for in Article 24 of the Constitution. With particular respect to the impugned amendments, it was the 6th
Respondent’s submission that the amendments are intended to enhance development and State security and as such
are reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom.
Reliance was placed on the decision of the Constitutional Court of South Africa in Samuel Manamela & Another
vs The Director General of Justice, CCT 25/99 on the interpretation of Article 24(1).
904. While justifying the fact that it did not downplay Article 24 when enacting the impugned legislation, the 6th
Respondent referred to the case of Attorney General & another v Randu Nzai Ruwa & 2 others [2016]
eKLR, where it was observed that interests of national security can be invoked to limit rights, if they are
reasonable and justifiable. Further reliance on justification for the limitation of the right to privacy was placed on
the decision of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) and others vs Union of India
and Others (supra).
905. The Respondents’ positions were supported by the 1st Interested Party, who submits that all the rights which
the Petitioners allege to have been infringed by the implementation of NIIMS are not absolute, and can be limited
under Article 25 of the Constitution. Further, that in considering the limitation under Article 24 (1) of the
Constitution, the Court must bear in mind that there are no superior rights and take into consideration, factors such
as the nature and extent of the limitation and the need to ensure that enjoyment of rights and fundamental freedoms
by one individual does not prejudice the rights of others. Therefore, that this calls for balancing of rights under the
principle of proportionality as was held in the case of University Academic Staff Union (UASU) vs Attorney

General & others, [2018] eKLR.
906. The 1st Interested Party also cites the case of Robert Alai vs The Hon Attorney General & Another, [2017]
eKLR where the court observed that constitutionally guaranteed rights should not be limited except where the
limitation is reasonable and justifiable, and the objective of that limitation is intended to serve the society. It also
cites the case of R.v.Oakes, [1986] 1 S.C.R. 103 , where the court stated that the onus of proving that a limitation
on any Charter right is reasonable and demonstrably justified in a free and democratic society rests upon the party
seeking to uphold the limitation.
907. It is the 1st Interested Party’s view that the implementation of NIIMS is reasonable and justifiable, and meets
the constitutional muster under Article 24 of the Constitution, considering that NIIMS shall ease tracing of families
of separated children with special needs and by this the government shall be able to reunite these children with their
families. Further, that NIIMS would curb cases of illicit adoption practices, child trafficking and permanent
separation of children from their biological families. In addition, that NIIMS will facilitate the matching of
resources to children socio economic needs and enable the government deliver its key constitutional mandate as
envisaged in Article 53 of the Constitution of Kenya.
908. The 8th and 9th Interested Parties submissions focused on justification presented by the terrorists incidents in
Kenya, and they contend that Article 24(1) of the Constitution permits limitation of the rights and fundamental
freedoms in the Bill of Rights that are reasonable and justifiable, and that the greater public interest and security
concerns far outweigh individual rights. They further argue that terrorist attacks have led to the curtailment of
privacy through activities that are now routine, including registering identification data at nearly every public
building including places of worship, and undergoing searches at all public gatherings.
909. Accordingly, they argue that the aggregation and verification of data already available to State agencies
through a system such as Huduma Namba can thwart future attacks and deter terrorists and criminals from
operating freely in the country. The 8th and 9th Interested Parties point out that the limitations to the rights in Article
31 were tested in Coalition for Reform and Democracy (CORD) & 2 others v Republic of Kenya &10 others,
[2015] eKLR where the Court found the limitations imposed on the right to privacy by the National Intelligence
Service Act to be reasonable and justifiable on account of the circumstances of our nation, the adequacy of
safeguards built into the law and the availability of remedies for any breach.
910. We note that the issue of whether the impugned amendments violate and limit the constitutional right to
privacy has already been dealt with extensively in this judgment, and this Court has made two findings in this
respect. Firstly, that other than the collection of DNA and GPS coordinates, the other biometric data that is required
to be collected by the amendments is necessary for purposes of identification, and there is thus no violation of the
right to informational privacy under section 31(c) of the Constitution.
911. Secondly, this Court has found that although a legal framework for protection of personal data now exists in
Kenya, there are inadequacies in the said legal framework in terms of operationalization, and also in terms of the
implementation and operationalization of NIIMS, to guarantee the security of the data that will be collected in
NIIMS. To this extent, there is a risk that the data collected in NIIMS may be accessed by unauthorized persons or
used for improper or illegal purposes, which is a threat to the right to privacy which may occur in the
implementation of NIIMS. To this extent, there is the possibility of a limitation on the right to privacy
912. We commence our analysis by noting that the right to privacy is not one of the rights that cannot be limited
under Article 25(c) of the Constitution. Therefore, a limitation is permissible so long as it meets the criteria set out
in Article 24 (1), which provides that a right or fundamental freedom in the Bill of Rights shall not be limited
except by law, and only to the extent that the limitation is reasonable and justifiable in an open and democratic
society based on human dignity, equality and freedom, taking into account the nature of the right or fundamental

freedom. It was in this regard held as follows in Robert Alai v The Hon Attorney General & another (supra) as
regards the application of Article 24(1):
“50. The principle enunciated above is that constitutionally guaranteed rights should not be limited except
where the limitation is reasonable, justifiable and the objective of that limitation is intended to serve the society.
The standard required to justify limitation, is high enough to discourage any limitation that does not meet a
constitutional test. And that limitation to a right is an exception rather than a rule.
913. In the Canadian case of R v. Oakes (supra), the Court considered the question whether section 8 of the
Narcotic Control Act, which had been found to be unconstitutional for violating section 11 of the Canadian Charter
of Rights and Freedom, was a reasonable limit prescribed by law and demonstrably justified in a free and
democratic society. In reaching the conclusion that it was not, the Court enunciated the criteria to be followed in
answering the question as follows:
“69.To establish that a limit is reasonable and demonstrably justified in a free and democratic society, two
central criteria must be satisfied. First, the objective, which the measures responsible for a limit on a Charter
right or freedom are designed to serve, must be "of sufficient importance to warrant overriding a
constitutionally protected right or freedom": R. v. Big M Drug Mart Ltd., supra, at p. 352. The standard must be
high in order to ensure that objectives which are trivial or discordant with the principles integral to a free and
democratic society do not gain s. 1 protection. It is necessary, at a minimum, that an objective relate to concerns
which are pressing and substantial in a free and democratic society before it can be characterized as sufficiently
important.
70. Second, once a sufficiently significant objective is recognized, then the party invoking s. 1 must show that
the means chosen are reasonable and demonstrably justified. This involves "a form of proportionality test": R.
v. Big M Drug Mart Ltd., supra, at p. 352. Although the nature of the proportionality test will vary depending on
the circumstances, in each case courts will be required to balance the interests of society with those of
individuals and groups. There are, in my view, three important components of a proportionality test. First, the
measures adopted must be carefully designed to achieve the objective in question. They must not be arbitrary,
unfair or based on irrational considerations. In short, they must be rationally connected to the objective.
Second, the means, even if rationally connected to the objective in this first sense, should impair "as little as
possible" the right or freedom in question: R. v. Big M Drug Mart Ltd., supra, at p. 352. Third, there must be a
proportionality between the effects of the measures which are responsible for limiting the Charter right or
freedom, and the objective which has been identified as of "sufficient importance".
914. Further, in Geoffrey Andare vs Attorney General, (supra) the Court held as follows in this regard:
“90. The questions that beg, bearing in mind the express provisions of Article 24 and the criteria in R vs Oakes
are: what is the purpose of the limitation, and how important is it" What is the relationship between the
limitation and its purpose" Are there less restrictive means to achieve the purpose intended"”
915. Therefore, in the context of this Petition, the stated purpose of the impugned amendments of identification of
persons should be based upon the rule of law, the means used to reach this purpose should not only be relevant and
necessary, but also not lead to disproportionate harm and burdens for the citizens. As was held in the Julian J
Robinson Case (supra), the proportionality test used to determine whether a law can be justified in a free and
democratic society is a two-stage test. The first stage is that the law must be passed for a proper purpose. The
second stage has three components, namely:
a) the measure must be carefully designed to achieve the objective,

b) the means used must violate the right as little as possible; and
c) there must be proportionality between the measure and the effect, that is to say, the benefit must be greater than
the harm to the right.
916. The propriety and sufficiency of the impugned amendments for the collection of personal data has been
challenged with respect to two types of data, namely DNA and GPS coordinates. As noted by Dr. Malombe in his
evidence, DNA information can have far reaching consequences as it not only reveals the identity of a given
person, but also genetic properties, which include the likeliness to develop particular diseases, parentage and also
family links. In addition, it can be recovered from a multitude of sources, and it provides or is likely to provide
scienti"c, medical and personal information pertinent for a person throughout his or her life.
917. It is thus our finding, that because of the speci"city of the information that DNA may disclose, and the harm
this disclosure may cause not just to the data subject but other family members in terms of both identi"cation and
genetic information, DNA information requires and justi"es a particular and specific legal protection. This was
confirmed by the Article 29 Working Party in its Report on the Processing of Genetic Data.
918. Likewise, specific authorization anchored in law is required for the use of GPS coordinates, in light of the
privacy risks we have already identified in terms of their possible use to track and identify a person’s location.
There is also the added risk that centralized databases can use GPS information, to create “watchlists” or
“blacklists” to create information on individuals to be watched and tracked. These individuals as a result become
suspects, leading to a reversal of the presumption of innocence.
919. Accordingly, we find that the provision for collection of DNA and GPS coordinates in the impugned
amendments, without specific legislation detailing out the appropriate safeguards and procedures in the collection,
and the manner and extent that the right to privacy will be limited in this regard, is not justifiable. The Respondents
in this respect conceded that they will not collect DNA and GPS coordinates, and that in any event they have no
capacity to do so. However, our position is that as long as the collection of DNA and GPS coordinates remain a
provision in the impugned amendments, there is the possibility that they can be abused and misused, and thereby
risk violating the rights to privacy without justification.
920. This Court has also discussed at length the necessity of the biometric data that is required by the impugned
amendments and the necessity of NIIMS as an identification and verification system. We have also noted that such
system that stores biometric data is susceptible to risks and any breaches can cause irreparable harm to the data
subjects. An inadequate legislative framework for the protection and security of the data is therefore clearly a
limitation to the right to privacy, in light of the risks it invites for unauthorized access and other data breaches.
921. In addition, a law that affects a fundamental right or freedom should be clear and unambiguous. This principle
was stated in the case of Andrew Mujuni Mwenda vs Attorney General (supra), and was echoed in the case of
Geoffrey Andare vs Attorney General (supra) where the court stated;-
“…The principle of law with regard to legislation limiting fundamental rights is that the law must be clear and
precise enough to enable individuals to conform their conduct to its dictate…”
922. This position equally applies to any law that seeks to protect or secure personal data, particularly in light of the
grave effects of breach of the data already alluded to. To this extent the lack of a comprehensive legislative
framework when collecting personal data under the impugned amendments, is contrary to the principles of
democratic governance and the rule of law, and thereby unjustifiable. It is also notable in this respect that no
justification or reasons were given by the Respondents for this lapse, leading to our earlier conclusion that the
process of NIIMS appeared to have been rushed.

Whether there was a Violation of the Right to Equality and Non-Discrimination
923. The 1st Petitioner challenges the impugned amendments on the procedural grounds relied on by the other
Petitioners and supported by the Interested Parties who support the Petitions. At the core of its case, however, is the
contention that the impugned amendments violate or threaten to violate the rights of members of the Nubian
community and other vulnerable groups to equality and non-discrimination. The 1st Petitioner argues that the
impugned amendments disclose violations of the rights to privacy, right to be free from any form of discrimination,
citizenship rights, the right to dignity, as well as the right to information. It is also the 1st Petitioner’s contention
that the impugned amendments implicate social- economic rights as well as the rights and the best interests of the
child.
924. The 1st Petitioner’s arguments are set out in the submissions dated 19th June 2019 and Supplementary
Submissions dated 8th October 2019. They were highlighted by the 1st Petitioner’s counsel, Mr. Waikwa and Mr.
Bashir.
925. The 1st Petitioner’s case is premised on the contention that the system introduced by NIIMS will perpetuate
the discrimination that members of the Nubian community have been subjected to over the years. It is submitted on
their behalf that despite having been settled in Kenya more than 100 years ago and qualifying as citizens under
Kenyan law, most of them have not been recognized as citizens and are treated as aliens, which they term as
contrary to the constitutional prohibitions of discrimination. In support of this argument, it is submitted that
Nubians are required to go through a long and complex vetting procedure to obtain identity cards and birth
certificates necessary for recognition of their citizenship, and essential for everyday life. As a result, most of them
have been unable to access the basic services offered by the State or to enjoy their constitutional rights.
926. In elaborating on the question of violation of the right to equality and non-discrimination the 1st Petitioner
submits that through the NIIMS systems, the State is content to continue with the exclusionary practices under the
present legal regime and leave thousands of people behind instead of fixing the present discriminatory practices. It
is its contention that Nubians and other vulnerable minority groups in Kenya undergo mandatory heightened
scrutiny on the basis of race, religion and tribe prior to registering as citizens and obtaining a national ID card. The
averments of Ms. Fatuma Abdulrahman and Ahmed Khalil Kafe, as well as the supporting affidavit of Mr. Shafi
Ali Hussein are cited in support.
927. The 1st Petitioner observes that the State has continued with the discriminatory practices despite international
opprobrium and judicial censure of such practices. It contends that the Respondents have not controverted its
contentions that, unlike other Kenyans, Nubians are subjected to an unfair and arbitrary vetting process in which
they are required to prove their citizenship by producing extra documents such as their grandparents’ birth
certificates which most of them cannot reasonably access.
928. In linking up the contention of past discrimination with the system mooted under the impugned amendments,
the 1st Petitioner contends that enrolment in NIIMS presents a number of potential harms that will be suffered
disproportionately by Nubians and other similarly situated groups. The basis of this contention is that there are
hardships which they are already being subjected to which the Respondents were aware of at the time the impugned
amendments were made.
929. According to the 1st Petitioner, these hardships are, first, that individuals who have been unsuccessful in
obtaining documentation of their Kenyan nationality on account of the government’s discriminatory practices have
been unable to enroll because enrolment hinges on possession of identity documents. The second is that the
enrolment process requires an administrative determination of citizenship or non-citizenship. Accordingly, because
of the ongoing effects of vetting and the exclusionary attitudes towards minorities it represents, Nubians are at a
heightened risk of being “successfully” enrolled as non-citizens, even though they are entitled to Kenyan

citizenship by birth. The 1st Petitioner argues that this ‘quasi-denationalization' re-labeling of Kenyans as
foreigners across all government systems linked to NIIMS represents a massive threat to Nubians on account of
their ethnicity, race or tribe, without any safeguards put in place to prevent it, and no hint of an effective remedy.
930. The 1st Petitioner contends, thirdly, that after “successful” enrolment in NIIMS, Nubians and other
communities who are heavily scrutinized and policed face a heightened risk of profiling and tracking within the
system just as they do in respect of the existing national registration system. They term these failings with respect
to the impugned amendments in general and NIIMS in particular as contrary to Article 27 of the Constitution.
931. The 2nd Petitioner supports the contentions by the 1st Petitioner that the impugned amendments and the NIIMS
process will result in a violation of the right to equality and non-discrimination guaranteed under Article 27. It
further agrees with the 1st Petitioner that the process will lead to discrimination against those communities and
groups such as the 1st Petitioner, stateless persons, refugees and persons who have perennially been denied the
opportunity to register for purposes of identification. It further contends that the impugned amendments have not
addressed the underlying legal and institutional issues that face stateless and other undocumented persons, and that
the amendments will therefore merely entrench and exacerbate these issues in the digital sphere. It is also the 2nd
Petitioner’s contention that the fact that the impugned law does not expressly apply to stateless persons, refugees
and aliens will lead to their continued marginalization.
932. The main contention by the 2nd Petitioner, however, with respect to violation of the constitutional right to
equality and non-discrimination is that the impugned law effectively makes it mandatory to register under NIIMS
and to obtain the unique identification number. It submits that under section 9A(2)(d), NIIMS shall, among other
things, support the printing and distribution for collection of all national identification cards, refugee cards,
foreigner certificates, birth and death certificates, driving licences, work permits, passport and foreign travel
documentation, and student identification cards issued under the Births and Deaths Registration Act, Basic
Education Act, Registration of Persons Act, the Refugee Act, the Traffic Act and the Kenya Citizenship and
Immigration Act, and all other forms of government issued identification documentation as may be specified in a
Gazette Notice by the Cabinet Secretary. The 2nd Petitioner submits that from this provision, public services
connected to these identification documents will only be offered to those who surrender their personal biometric
information and are issued with the unique identification number known as the Huduma Namba.
933. It is the 2nd Petitioner’s contention that the overall effect of the impugned amendments will be to offend
Article 27 of the Constitution which guarantees the right of equality before the law and explicitly prohibits
discrimination on any ground. It submits that denying any person constitutionally guaranteed rights to public
services based only on lack of biometric identification is unreasonable and unjustifiable in a free and democratic
society.
934. The 2nd Petitioner argues that no cogent or persuasive evidence has been provided to demonstrate that the said
services can only be efficiently provided using biometric data of the nature sought under the Act. To buttress its
argument, it cites the decision in R vs Big M. Drug Mart Ltd [1985] 1 S.C.R. 295 in which the court stated that
freedom means that, subject to such limitations as are necessary to protect public safety, order, health, or morals or
the fundamental rights and freedoms of others, no one is to be forced to act in a way contrary to his beliefs or his
conscience.
935. It is also its contention that the impugned amendments have not addressed the underlying legal and
institutional issues that face stateless and other undocumented persons and will therefore merely entrench and
exacerbate them in the digital sphere.
936. The 3rd Petitioner did not address itself to this issue, while the 3rd and 4th Interested Parties, though they
indicated their support for the Petitions, did not file any submissions. The 6th Interested Party also supported the

Petitions and filed submissions, but it did not address itself to the issue of alleged violation of the right to equality
and non-discrimination.
937. In its submissions in support of the Consolidated Petitions, the 5th Interested Party agrees with the 1st and 2nd
Petitioners that the impugned amendments would lead to violation of Article 27, for various reasons. It argues that
the collection of biometric identifiers during the registration process implies an intent by the State to subsequently
use biometric identifiers for authentication of identity. In its view, this Act, coupled with the messaging from the
State that Huduma Namba will be needed in order to access government services as set out in the Data Capture
Form, implies several things which the 5th Interested Party deems detrimental to fundamental rights. It submits,
first, that the mass registration exercise is not the only time biometric identifiers will be collected by the State; that
biometrics will be required at the point of service to determine the authenticity of the person being served; and that
this may happen every time a person requires services from any government agency.
938. Its second contention is that all government agencies will have a copy of the biometric identifiers which they
will use to authenticate identity of every person served, and every agency with access to this information can tell
the behavioural patterns of a data subject from the digital footprint left at every authentication. It is its submission
that this creates a fertile basis for covert surveillance, and even if such information was only to be held by one
agency, there would still be potential for surveillance, which is frowned upon under the Constitution. It cites in this
regard the decision in Kenya Human Rights Commission v Communication Authority of Kenya & 4 others
[2018] eKLR. In the 5th Interested Party’s view, such surveillance could lead to profiling, which in turn could lead
to discrimination, and the effect of such a system is therefore unconstitutional.
939. The contention that the impugned amendments will result in violation of Article 27 is strenuously contested by
the Respondents. The 1st Respondent submits, first, that the 2nd Petitioner had, in its written submissions, admitted
that the text of the amendments in issue in and of itself was not discriminatory. In the 1st Respondent’s view, to the
extent that the Petition is premised entirely on the constitutionality or otherwise of the enactments in issue, the
admission was dispositive of the issue. This was because what was at issue was not the administrative practices of
the Respondents but constitutionality or otherwise of the amendments. We observe at the outset that our perusal of
the submissions by the 2nd Petitioner have not disclosed this alleged admission on its part.
940. It is also the 1st Respondent’s contention that there is no material placed in evidence before the court, save for
the bare and general allegation of discrimination by the 1st Petitioner, to support its allegation of discrimination.
Such material, in the 1st Respondent’s view, would have consisted of cogent evidence from specific members of
the Nubian community on the alleged discrimination. In the absence of such evidence, the claim of discrimination
remained unproven. To the 1st Respondent, the pilot projects on NIIMS, which were conducted in several locations
within the Republic including Kibera and Eastleigh North in Nairobi County, as well as those undertaken in
Marsabit and Wajir counties where no issues of discrimination arose, are pointers that there is no discrimination in
the implementation of NIIMS.
941. With regard to the reliance by the 1st Petitioner on the African Commission of Human and People’s Rights
decision as a basis for the claim that there was discrimination against members of the Nubian community, the
position of the 1st Respondent is that the said Commission is not a judicial body and its recommendations are
neither conclusive nor binding. Further, that in any event, the said Commission has in reported cases before the
African Court on Human and Peoples’ Rights submitted that it does not have confidence in Kenya’s judicial
processes in giving timely and effective redress. It is his contention further that the Commission, which is actively
engaged in legal proceedings against the Republic of Kenya, cannot be said to be impartial towards the Republic of
Kenya. The 1st Respondent further takes the position that the report by the African Commission has no nexus in any
way with the legislative amendments in issue.
942. The 1st Respondent takes the position that the 1st Petitioner has no justiciable controversy in its Petition before

this court. It relies on the decision in Patrick Ouma Onyango & 12 Others v the Attorney General & 2 Others,
Misc Appl No. 677 of 2005 in which the court took the view that “[i[n order for a claim to be justiciable… it must
“present a real and substantial controversy which unequivocally calls for adjudication of the rights asserted.” It is
its submission that in the present case, the entire ground alleging discrimination is premised on mere apprehension
not directly attributable to the enactments in issue. Rather, it has its basis on alleged past administrative action that
has never been subject to judicial inquiry and determination.
943. In their submissions, the 2nd and 3rd Respondents also oppose the allegation that the impugned amendments
and the NIIMS process will result in discrimination against the 1st Petitioner and other marginalised communities.
They note that the 1st Petitioner challenges the impugned amendments on the basis that sections 3, 5 and 9 of the
Act would perpetuate discrimination against members of the Nubian Community who are allegedly being
discriminated against under the current registration systems. The 2nd and 3rd Respondents deny that this is the case.
They rely on the definition of discrimination in the case of Jacqueline Okeyo Manani & 5 Others v. Attorney
General & Another [2018] eKLR.
944. The 2nd and 3rd Respondents note that from the above decision, the elements of discrimination are unequal
treatment, unfavourable bias and bias based on the constitutional definition of discrimination.
945. They submit that contrary to the allegations by the 1st Petitioner, NIIMS does not meet the above elements.
This is because, first, the Act as amended does not make any distinction in the registration of persons onto NIIMS,
and the Act is clear that all residents are free to enlist onto NIIMS. They further submit that the Kenya Citizenship
and Immigration Act, 2012 already provides for the criteria and process of registration of foreigners in Kenya,
including the stateless, as does the Refugees Act, 2006, with respect to refugees residing in the country. Their
submission is that NIIMS does not replace these existing processes, systems and documents.
946. According to the 2nd and 3rd Respondents, the 1st Petitioner’s contentions are based on a misapprehension of
the role to be played by NIIMS. Their case is that the Act does not confer citizenship. On the contrary, it is based
on pre-existing laws on citizenship and registration which are all perfectly constitutional. They illustrate their
position by citing the Kenya Citizenship and Immigration Act, 2012, the Refugees Act, 2006, and the Children Act
to submit that since these Acts are presumed to be constitutional, and since NIIMS is based on them, it cannot
therefore be deemed to be discriminatory or unconstitutional.
947. The 2nd and 3rd Respondents maintain that the documents under the respective Acts would continue to be
issued under the existing framework, which means that passports would be issued under the provisions of the
Kenya Citizenship and Immigration Act; births and deaths certificates under the Births and Deaths Registration
Act; while refugee and alien cards would be issued on the basis of the Refugee Act and the Kenya Citizenship and
Immigration Act respectively. Their submission is that none of these documents would be issued under the Statute
Law (Miscellaneous Amendments) Act No 18 of 2018. Further, that NIIMS does not introduce any new
requirements outside of the existing legal framework, nor does it contain any provision that fosters discrimination.
948. With regard to the 1st Petitioner’s contention that NIIMS would perpetuate discrimination against members of
the Nubian community due to the requirement for vetting, the 2nd and 3rd Respondents submit that this allegation
has no basis. This is because it is not sections 3, 5 and 9 of the Act that introduced vetting as a process for the
issuance of identification documents to the Nubians or any other border community. They ask the court to take
judicial notice of the fact that vetting committees are a legally sanctioned part of the process of issuing
identification documents pursuant to section 23 of the Security Laws (Miscellaneous Amendments) Act, 2014
which amended the Act by adding section 8(1A) on vetting.
949. They contend that despite the fact that vetting only applies to border communities, this does not make it
discriminatory within the meaning of Article 27 of the Constitution. They rely in support of this submission on the

decision in John Harun Mwau v. Independent Electoral and Boundaries Commission & Another [2013]
eKLR.
950. The 2nd and 3rd Respondents emphasise, on the basis of the averments by Dr. (Eng.) Karanja Kibicho in his
affidavit of 14th May 2019, that the process of vetting is neither a creature of the impugned amendments nor is it
targeted at the Nubians only. It is also their submission that vetting is necessitated by, among other factors, national
security and the fact that all individuals must prove their nationality before being issued with national identification
documents. It is their submission that in any event, the question of the vetting process for border communities falls
outside the purview of section 9 of the impugned amendments and of this matter. They reiterate that the impugned
amendments are not in any way discriminatory against the 1st Petitioner or any other individuals residing in the
country.
951. With regard to the reliance by the 1st Petitioner on the decisions of the African Commission and the African
Committee on the Rights and Welfare of the Child, it is their submission that while the African Commission is
mandated under the ACHPR to hear communications on violation of rights under the Charter and make
recommendations, its recommendations are not legally binding on States, nor does the Charter obligate States to
implement the recommendations of the Commission. They submit, however, that States are at liberty to implement
such recommendations based on the principle of good faith based on their ratification of the African Charter. The
2nd and 3rd Respondents cite in support Nelson Enonchong’s article “The African Charter on Human and
Peoples’ Rights: Effective Remedies in Domestic Law"” in which he notes that:
“the African Commission has no jurisdiction to make binding decisions against state parties that have violated
the provisions of the Charter. Once the Commission reaches a decision on the merits of a case, its only
jurisdiction is to make recommendations to the Assembly of Heads of State and Government (AHSG) of the
African Union (previously Organization of African Unity). But the AHSG itself cannot make binding decisions
against state parties. It can only decide to permit publication of their violations.”
952. It is their submission that the above position notwithstanding, the Government of Kenya has implemented
measures aimed at ensuring that Nubians and all other perceived marginalized communities are registered as
citizens. They assert that it is within the knowledge of the 1st Petitioner that the government acknowledged and
endeavored to ensure equality and non-discrimination against the Nubian Community. They draw the court’s
attention to the letter dated 8th April, 2017 in which the 1st Petitioner acknowledged that the Government, through
the National Registration Bureau, had taken commendable measures for the registration of Nubians.
953. The 2nd and 3rd Respondents assert that in any event, the recommendations of the African Commission and the
African Committee on the Rights and Welfare of the Child cannot be implemented through constitutional petitions
such as the instant ones, as the said recommendations were not based on interpretation of the Constitution of
Kenya.
954. The 4th and 7th Respondents note that the challenge to NIIMS on the basis that it will perpetuate discrimination
is based on the vetting procedures in obtaining an identification card as a prerequisite for registration in NIIMS, as
emerged from the testimony of Ahmed Khalil Kafe (PW 3), Mr. Ali Shafi Hussein (PW 4) and Ms. Fatuma
Abdulrahman (PW 5). They note that these witnesses all said that they had no issue with the Huduma Namba, their
problem being with the vetting procedures that members of the Nubian community undergo in obtaining
identification cards.
955. The 4th and 7th Respondents submit that, as outlined by Dr. Karanja Kibicho (RW 3), every person who
applies for an identification card undergoes a form of vetting in which the Assistant Chief of the applicant’s
locality must be able to first identify the applicant prior to approving the application. It is their submission that the
4th Respondent is clothed with the discretion, pursuant to section 8 of the Act, to require further information from

an applicant on a case by case basis. They submit that the constitutionality of section 8 of the Act is not challenged
in the present proceedings, and the procedure set out in the section enjoys the presumption of constitutionality.
956. The 4th and 7th Respondents further note that the 1st Petitioner’s witnesses, Mr. Hussein and Ms. Abdirahman,
stated in their evidence that they are aware of two levels of vetting for the Nubian community, the first stage of
which is by members of the Nubian community. It is their submission that no government official is involved in
this stage of the vetting, and it is only the members of the Nubian community themselves who have the initial
mandate to confirm the authenticity of the applicant’s claim to Kenyan citizenship. The second level of vetting,
according to the 4th and 7th Respondents, is the one that involves committees comprising government officers. They
note that while the 1st Petitioner has raised concerns about the representation of the Nubian community in this
second level, Dr. Kibicho had clarified that the decisions of the committee are not based on majority voting.
957. It is their submission that, in any event, the concerns raised by the members of the 1st Petitioner are in respect
to a process which is separate from NIIMS. They contend that the 1st Petitioner has not challenged the NIIMS
process in these proceedings, nor does its witnesses, in their evidence, demonstrate the manner in which the vetting
process is arbitrary, unreasonable or without a basis.
958. It is also the submission of the 4th and 7th Respondents that as testified by Dr. Kibicho, NIIMS is a continuous
process. Accordingly, members of the Nubian community as well as any other person who is yet to acquire an
identification card or a birth certificate will be able to register through NIIMS once they acquire these documents.
959. While observing that Shafi Hussein had, in his testimony, maintained that having had a three-step perspective
of NIIMS registration, that is prior to, during and after the mass registration exercise, his concerns on the alleged
discrimination remain, the 4th and 7th Respondents submit that his testimony could not be given credence given that
he admitted that he had not registered for a Huduma Namba and could not therefore comment on the process. They
further observe that he had admitted that he did not undergo vetting when applying for an identification card.
960. The 4th and 7th Respondents submit that the 1st Petitioner had failed to demonstrate how members of the
Nubian community had been denied equal protection or benefit of the law. They note that Dr. Kibicho had testified
that various initiatives have been put in place to facilitate the issuance of identity cards to Nubians, such as the
Rapid Response Initiative (RRI), a fact which Shafi Hussein (PW 4) had acknowledged in his letter to the 4th
Respondent dated 8th April 2017.
961. The 4th and 7th Respondents also agree with the rest of the Respondents that NIIMS will not result in
discrimination against the 1st Petitioner’s members or any other group. They submit that the contention that the
deployment of NIIMS was discriminatory to the Nubian community because they undergo vetting processes to
obtain identification cards and birth certificates, which documents are required to register under NIIMS, are
unfounded. It is their case that registration pursuant to NIIMS does not limit access to opportunities, benefits and
advantages available to other members of society. They further submit that like any other citizens living on the
border, the Nubians are required to undergo the vetting process. They agree with the submissions of the 2nd and 3rd
Respondents that the vetting process, which the Nubians and other border communities have to undergo, has a
statutory underpinning in section 8 (1) of the Act.
962. It is their case that the purpose of the vetting process is to ensure that only those with a legitimate claim to
Kenyan citizenship are registered by the 4th Respondent. They further argue that the said process seeks to address
the influx into the country of such communities’ counterparts from neighboring countries. In their view, it is
incumbent upon the 1st Petitioner to demonstrate the manner in which the vetting is discriminatory.
963. The 4th and 7th Respondents go into some details on the composition of the vetting committees. They note that
they comprise an Assistant County Commissioner, a civil registration officer, an immigration officer where

applicable, a chief and elders representing all communities in that locality, as well as government security agencies.
They submit that the composition of these committees ensures that all communities are included in the respective
Committees.
964. Like the other Respondents, the 4th and 7th Respondents maintain that equality before the law and freedom
from discrimination as enshrined in Article 27 of the Constitution does not mean that every law must have
universal application for all, regardless of their circumstances. It is their submission that the varying needs of
different classes of persons require special treatment, and that differentiation is inherent in the concept of equality,
which requires parity of treatment under parity of conditions. They cite in support the decision in EG & 7 others v
Attorney General; DKM & 9 others (Interested Parties); Katiba Institute & another (Amicus Curiae)
Petition Nos. 150 & 234 of 2016 (Consolidated).
965. They also rely on the decision of the South African Constitutional Court in Harksen v Lane NO and
Others (CCT9/97) [1997] ZACC 12 in which the court set out the test for determining whether a claim based on
unfair discrimination should succeed. Reliance is also placed on the decision in John Harun Mwau v
Independent Electoral and Boundaries Commission & Another (supra) for the proposition that different
treatment or inequality does not per se amount to discrimination and a violation of the Constitution. In their view,
the differential treatment accorded to members of certain communities in the country serves a legitimate purpose
and does not amount to unfair discrimination.
966. In his submissions on the issue of non-discrimination, the 5th Respondent submits that he understands the term
‘discrimination’ to imply any distinction, exclusion, restriction or preference which is based on any ground,
including race, sex, pregnancy, marital status, health status, ethnic or social origin, colour, age, disability, religion,
conscience, belief, culture, dress, language or birth. He relies on Black’s Law Dictionarywhich defines
discrimination as:
“The effect of a law or established practice that confers privileges on a certain class or that denies privileges to a
certain class because of race, age, sex, nationality, religion or handicap or differential treatment especially a
failure to treat all persons equally when no reasonable distinction can be found between those favoured and
those not favoured.”
967. The 5th Respondent submits that the Petitioners’ contention that the impugned amendments will result in
violation of Article 27 has no basis, noting that the Petitioners have not discharged the evidentiary burden of proof.
He relies on the case ofNyarangi & 3 Others vs. Attorney General (Supra) to submit that the law prohibits, not
discrimination, but unfair discrimination.
968. With regard to the process of registration in NIIMS, the 5th Respondent argues that the only requirement for a
person to be registered and issued with a unique identifying number is a national identity card. It is his case that the
Respondents had provided a Data Capture Form which all Kenyans, including members of the 1st Petitioner, are
required to complete. In his view, the inability of Nubians, Somalis and Arabs to provide the supporting documents
as a result of extra vetting could not amount to discrimination.
969. The 5th Respondent argues that the introduction of the NIIMS database is to make the registration process
much easier. His submission is that the new system will be more efficient than the current system which requires
supporting documents before any identity documents are issued to the applicant. It is his case that the introduction
of the NIIMS database is in no way proof of Kenyan nationality, and registration thereto does not translate to being
conferred with Kenyan nationality. The 5th Respondent reiterates the purposes of NIIMs as being to create, manage,
maintain and operate a national population register as a single source of personal information of all Kenyan citizens
and foreigners resident in Kenya, assign a unique national identification number on every person and to harmonize,
incorporate and collate into the register, information from other databases in government agencies relating to the

registration of persons.
970. In further support of his argument that there would be no discrimination as a result of the impugned
amendments and the introduction of NIIMS, the 5th Respondent relies on the decision in John Kabui Mwai & 3
Others vs. Kenya National Examination Council & 2 Others [2011] eKLR on the form of discrimination that is
prohibited by law. He submits that a claim of discrimination should be analysed from both a subjective and an
objective perspective, and that in determining whether there is discrimination on grounds relating to the personal
characteristics of the individual or group, the court should consider not only the impugned legislation which has
created a distinction that is alleged to violate the right to equality but also to the larger social, political and legal
context. The 5th Respondent also relies on the decision in Jacques Charl Hoffmann vs. South African Airways,
CCT 17 of 2000 which was cited in the High Court decision in Centre for Rights Education and Awareness
(CREAW) & 7 Others vs. Attorney General [2011] eKLR] in support of this argument. It is his position that the
1st Petitioner has failed to establish the grounds upon which the members of the Nubian community have been
discriminated or even differentiated against as compared to other Kenyans. In his view, the absence of
differentiation means that there is no discrimination against the Nubians and they have failed to meet the threshold
set for proving the allegations of violation of the right to equality and non-discrimination.
971. The 6th Respondent also supports the position taken by the other Respondents on the issue of alleged violation
of the right to equality and non-discrimination. He poses the question whether NIIMS excludes or discriminates
against citizens from marginalised communities such as the Nubians. He notes that the 1st Petitioner is aggrieved
that the introduction of a more complex system of registration without first addressing the challenges faced under
the older, simpler system will discriminate and or exclude citizens from marginalized groups such as the Nubians
who have faced difficulties in the process of registration under the current simpler system and many of them have
failed to register. He notes that the 1st Petitioner has not, however, produced anything at all to support its assertion,
and relies on the decision inMohammed Abduba Dida v Debate Media Limited & another [2017] eKLR in
which the court held that the burden lies on a person alleging unfair discrimination to establish his claim, for it is
not every differentiation that amounts to discrimination.
972. It is argued on behalf of the 6th Respondent that the jurisprudence on discrimination suggests that law or
conduct which promotes differentiation must have a legitimate purpose and should bear a rational connection
between the differentiation and the intended purpose. Further, that the rationality requirement is intended to prevent
arbitrary differentiation, and that the right to equality does not prohibit discrimination but unfair discrimination. Its
submission is that in this case, there is nothing to show that NIIMS is likely to lead to discrimination against the
Nubians or any other marginalized class of persons.
973. The 1st Interested Party agrees with the position taken by the Respondents that the Petitioners have failed to
establish their allegations of discrimination against the members of the Nubian Community and other marginalised
groups. Its submission is that the Petitioners have not set out the manner in which the impugned amendments
violate any of the rights they allege violation of. In its view, there needs to be a clear manifestation of the
contravention of the fundametal rights. It cites in support the decision of the Supreme Court in Communications
Commission of Kenya & 5 others v Royal Media Services Limited & 5 others [2014] eKLR. In its view, the
Petitioners’ allegations of discrimination are vague, speculative and unsubstantiated, the Petitioners having failed
to demonstrate the manner in which the implementation of the impugmed amendments have violated any
constitutional provisions.
974. The 1st Interested Party contends that all the rights which the Petitioners allege shall be infringed by the
implementation of NIIMS are not absolute and can be limited, citing in support Article 25 of the Constitution. It is
its contention that in considering the limitation under Article 24 (1) of the Constitution, the court must bear in mind
that there are no superior rights and take into consideration factors such as the nature and extent of the limitation
and the need to ensure that enjoyment of rights and fundamental freedoms by one individual does not prejudice the

rights of others. Its view is that this calls for balancing of rights under the principle of proportionality because
rights have equal value. Further, that the court should maintain the equality of rights as was held in the case of
University Academic Staff Union (UASU) v Attorney General & others [2018] eKLR.
975. The 1st Interested Party further cites the case of Attorney General & another v Randu Nzai Ruwa & 2
others [2016] eKLR in which the Court relied on the decision by the Constitutional Court of South Africa in
Samuel Manamela & Another v The Director General of Justice CCT 25/99 for the proposition that the court
must engage in a balancing exercise and arrive at a global judgment on proportionality and not adhere mechanically
to a sequential check-list. Further, that as a general rule, the more serious the impact of the measure on the right,
the more persuasive or compelling the justification must be.
976. It is its argument further that Article 24 of the Constitution and various judicial precedents emphasize the
importance of considering the object, purpose and effect of legislation; that they require that the importance of the
purpose of the limitation should be considered, as well as the relationship between the limitation and its purpose;
and further, that whether there are less restrictive means of achieving the purpose should also be considered. The 1st
Interested Party cites in this regard the case of Robert Alai v The Hon Attorney General & another [2017]
eKLR in which the court observed that constitutionally guaranteed rights should not be limited except where the
limitation is reasonable, justifiable and the objective of that limitation is intended to serve the society. Reliance was
also placed on the Canadian case of R. v. Oakes [1986] 1 S.C.R. 103 in which the court stated that the onus of
proving that a limitation on any Charter right is reasonable and demonstrably justified in a free and democratic
society rests upon the party seeking to uphold the limitation.
977. The 1st Interested Party invites the court to take into account the fact that the government regularly rescues up
to 200 children at a go, including abandoned and disabled children, who are committed to the 1st Interested Party
for care and protection. The 1st Interested Party argues that it is then expected to reunite such children with their
families. It is its contention that in light of such obligations placed upon it, the implementation of NIIMS is
reasonable and justifiable and meets constitutional muster under Article 24 of the Constitution. Its view in this
regard is on the basis that NIIMS shall ease tracing of families of separated children with special needs and the
government shall be able to reunite these children with their families.
978. The 1st Interested Party further argues that NIIMS would curb cases of illicit adoption practices, child
trafficking and permanent separation of children from their biological families; that NIIMS seeks to capture and
store data in a centralized digital database for effective and efficient tracing of a child’s family and to confirm
parentage; and that the NIIMS platform will also facilitate the matching of resources to children’s socio-economic
needs and enable the government deliver its key constitutional mandate in accordance with its obligations under
979. Its position, therefore, is that NIIMS is reasonable, proportionate and justifiable in an open and democratic
society when the the plight of Kenyan children, whose rights are protected under Article 53 of the Constitution, is
considered.
980. The 8th and 9th Interested Parties also discount the argument that NIIMS will lead to violation of the
Petitioners’ rights under Article 27 of the Constitutioin. They submit, through their Learned Counsel, Mr.
Omuganda, who highlighted their submissions dated 14th October, 2019 that the Constitution contemplates
limitation of the rights and fundamental freedoms, and the greater public interest and security concerns far
outweigh individual rights. It is their position that Article 24(1) of the Constitution permits limitation of rights if
the limitation is reasonable and justifiable in an open and democratic society based on human dignity, equality and
freedom, taking into account all relevant factors. Their view is that the rights to privacy, equality and non-
discrimination fall within the purview of rights that can be limited for security reasons.

981. From the respective submissions of the parties set out above, it appears to us that there are two facets of the
alleged denial of the right to equality and non-discrimination disclosed. The first relates to the argument, advanced
by the 1st Petitioner and supported by the 2nd Petitioner and the 5th Interested Party, that the impugned amendments
and the implementation of NIIMS will perpetuate discrimination against members of the Nubian community and
other marginalised groups. The second relates to the contention that the impugned law makes it mandatory for
everyone to obtain a Huduma Namba, failing which one will be denied Government services.
On Discrimination of the Nubian Community
982. The starting point in considering this issue is to look at the law and previous jurisprudence with regard to
discrimination. So far as is relevant for present purposes, Article 27 of the Constitution guarantees to everyone the
right to equality and non-discrimination in the following terms:
27. (1) Every person is equal before the law and has the right to equal protection and equal benefit of the law.
(2) Equality includes the full and equal enjoyment of all rights and fundamental freedoms.
(3)…
(4) The State shall not discriminate directly or indirectly against any person on any ground, including race, sex,
pregnancy, marital status, health status, ethnic or social origin, colour, age, disability, religion, conscience,
belief, culture, dress, language or birth.
(5) …
983. The precise meaning and implication of the right to equality and non-discrimination has been the subject of
numerous judicial decisions in this and other jurisdictions. In its decision in Jacqueline Okeyo Manani & 5
Others v. Attorney General & Another (supra) the High Court stated as follows with respect to what amounts to
discrimination:
“26. Black’s Law Dictionary, 9th Edition defines “discrimination” as (1)”the effect of a law or established
practice that confers privileges on a certain class because of race, age sex, nationality, religion or hardship” (2)
“Differential treatment especially a failure to treat all persons equally when no reasonable distinction can be
found between those favoured and those not favoured”.
27. In the case of Peter K Waweru v Republic [2006]eKLR, the court stated of discrimination thus:-
“Discrimination means affording different treatment to different persons attributable wholly or mainly to their
descriptions whereby persons of one such description are subjected to … restrictions to which persons of another
description are not made subject or have accorded privileges or advantages which are not accorded to persons of
another such description… Discrimination also means unfair treatment or denial of normal privileges to persons
because of their race, age sex … a failure to treat all persons equally where no reasonable distinction can be
found between those favoured and those not favoured.”(emphasis)
28. From the above definition, discrimination, simply put, is any distinction, exclusion or preference made on
the basis of differences to persons or group of persons based such considerations as race, colour, sex, religious
beliefs political persuasion or any such attributes that has real or potential effect of nullifying or impairing
equality of opportunity or treatment between two persons or groups. Article 27 of the Constitution prohibits any
form of discrimination stating that. (1) Every person is equal before the law and has the right to equal protection
and equal benefit of the law, and that (2) Equality includes the full and equal enjoyment of all rights and

fundamental freedoms.
29. The Constitution advocates for non-discrimination as a fundamental right which guarantees that people in
equal circumstances be treated or dealt with equally both in law and practice without unreasonable distinction
or differentiation. It must however be borne in mind that it is not every distinction or differentiation in treatment
that amounts to discrimination. Discrimination as seen from the definitions, will be deemed to arise where equal
classes of people are subjected to different treatment, without objective or reasonable justification or
proportionality between the aim sought and the means employed to achieve that aim.
30. In this regard, the Court stated in the case of Nyarangi & 3 Others V Attorney General [2008] KLR 688
referring to the repealed constitution; “discrimination that is forbidden by the constitution involves an element
of unfavourable bias. Thus, firstly unfavourable bias must be shown by the complainant; and secondly, the bias
must be based on the grounds set in the constitutional definition of the word “discriminatory” in section 82 of
the Constitution.”
984. It is thus recognised that it is lawful to accord different treatment to different categories of persons if the
circumstances so dictate. Such differentiation, however, does not amount to the discrimination that is prohibited by
the Constitution. In John Harun Mwau v. Independent Electoral and Boundaries Commission & Another
(supra), the court observed that:
“[i]t must be clear that a person alleging a violation of Article 27 of the Constitution must establish that because
of the distinction made between the claimant and others, the claimant has been denied equal protection or
benefit of the law. It does not necessarily mean that different treatment or inequality will per se amount to
discrimination and a violation of the constitution.”
985. When faced with a contention that there is a differentiation in legislation and that such differentiation is
discriminatory, what the court has to consider is whether the law does indeed differentiate between different
persons; if it does, whether such differentiation amounts to discrimination, and whether such discrimination is
unfair. In EG & 7 others v Attorney General; DKM & 9 others (Interested Parties); Katiba Institute &
Another: Petition 150 & 234 of 2016 (Consolidated) the court held that:
“[288]. 288. From the above definition, it is safe to state that the Constitution only prohibits unfair
discrimination. In our view, unfair discrimination is differential treatment that is demeaning. This happens
when a law or conduct, for no good reason, treats some people as inferior or less deserving of respect than
others. It also occurs when a law or conduct perpetuates or does nothing to remedy existing disadvantages and
marginalization.”
986. In Harksen v Lane NO and Others (supra) the Court observed that the test for determining whether a claim
based on unfair discrimination should succeed was as follows:
(a) Does the provision differentiate between people or categories of people" If so, does the differentiation bear a
rational connection to a legitimate purpose" If it does not, then there is a violation of the constitution. Even if it
does bear a rational connection, it might nevertheless amount to discrimination.
(b) Does the differentiation amount to unfair discrimination" This requires a two-stage analysis: -
(i)Firstly, does the differentiation amount to ‘discrimination’" If it is on a specified ground, then

discrimination will have been established. If it is not on a specified ground, then whether or not there is
discrimination will depend upon whether, objectively, the ground is based on attributes and characteristics
which have the potential to impair the fundamental human dignity of persons as human beings or to affect them

adversely in a comparably serious manner.
(ii) If the differentiation amounts to ‘discrimination,’ does it amount to ‘unfair discrimination’" If it has been
found to have been on a specified ground, then the unfairness will be presumed. If on an unspecified ground,
unfairness will have to be established by the complainant. The test of unfairness focuses primarily on the impact
of the discrimination on the complainant and others in his or her situation. If, at the end of this stage of the
enquiry, the differentiation is found not to be unfair, then there will be no violation…
(c) If the discrimination is found to be unfair then a determination will have to be made as to whether the
provision can be justified under the limitations clause.
987. With respect to the burden of proof on a claim that an action or law is discriminatory, it has been held that the
burden lies on a person alleging unfair discrimination to establish his claim. In Mohammed Abduba Dida v
Debate Media Limited & another [2017] eKLR, the court (Mativo J) stated as follows:
“I must add that if the discrimination is based on any of the listed grounds in Article 27 (4) of the Constitution,
it is presumed to be unfair. It must be noted, however, that once an allegation of unfair discrimination based on
any of the listed grounds in article 27 (4) of the constitution is made and established, the burden lies on the
Respondent to prove that such discrimination did not take place or that it is justified.
On the other hand, where discrimination is alleged on an arbitrary ground, the burden is on the complainant to
prove that the conduct complained of is not rational, that it amounts to discrimination and that the
discrimination is unfair.”
988. It must also be noted, as observed by Mativo J in Mohammed Abduba Dida v Debate Media Limited &
another (supra) that:
“It is not every differentiation that amounts to discrimination. Consequently, it is always necessary to identify
the criteria that separate legitimate differentiation from constitutionally impermissible differentiation. Put
differently, differentiation is permissible if it does not constitute unfair discrimination.”
989. Turning to the facts of the present matter, we pose the questions: does the impugned amendment differentiate
between members of the Nubian community and other marginalised groups and other Kenyans" If it does, does it
have a rational basis and is it therefore constitutionally permissible"
990. Section 9A(1) of the impugned Act established the “National Integrated Identity Management System” whose
function is “to create, manage, maintain and operate a national population register as a single source of personal
information of all Kenyan citizens and registered foreigners resident in Kenya”. The impugned law thus applies to
all persons resident in Kenya, whether nationals or citizens of other states. To that extent, the law as enacted does
not differentiate between nationals or foreigners, and thus everyone, including members of the Nubian community
and other groups such as members of the Shona community who are citizens of or resident in Kenya, are entitled to
register. Indeed, the 1st Petitioner and its witnesses acknowledge that they are entitled to register for the Huduma
Namba.
991. Their challenge to the system is that they encounter challenges and hardships in acquiring identity documents
under the existing system, particularly the vetting process mandated under section 8(1A) of the Act. They assert
that the Act grants registration officers broad authority to demand additional evidence from persons from
marginalized areas, and they are faced with an onerous process of establishing their Kenyan nationality in order to
obtain identity cards. The gist of their grievance, as we understand it, is that the vetting process that they are
subjected to under section 8(1A) of the Act is discriminatory and therefore a violation of their rights under Article

27.
992. We have set out above the responses of the Respondents to these contentions, and we are constrained to agree
with them that the Petitioners have not established a violation of the right to equality and non-discrimination. First,
the law that established NIIMS, as submitted by the Respondents, does not establish or require that one undergoes a
vetting process. As we understand the law to be, one has to present themselves with an identity document issued
under a different piece of legislation in order to be registered under NIIMS.
993. In the case of foreign nationals, refugees and stateless persons, the legislation under which identity documents
will continue to be issued are the Kenya Citizenship and Immigration Act and the Refugee Act. Whatever the
conditions for issuance of identity documents are under these Acts must be met before one is issued with an
appropriate identity document, subsequent to which one may present the said document in order to register with
NIIMS. In the case of Kenyan nationals, as we understand it, the issuance of identity documents will continue
under the existing system of law: certificates of birth under the Births and Deaths Registration Act, and for national
identity cards, the Registration of Persons Act.
994. It was deposed and submitted by the 2nd and 3rd Respondents, and not controverted by the Petitioners, that the
requirement for vetting of persons from border communities was introduced to section 8(1A) of the Act by the
Security Laws (Amendment) Act, No 19 of 2014. This section provides as follows:
“1A) The Director may establish identification committees or appoint persons as identification agents to assist in
the authentication of information furnished by a parent or guardian.
995. As submitted by the Respondents, this provision of the Act was not introduced by the impugned law, nor is it
under challenge in the Consolidated Petitions before us. Indeed, it was not one of the provisions that was
challenged in the consolidated petitions that impugned the process and substance of the Security Laws
(Amendment) Act of 2014 that was the subject of determination in Coalition for Reform and Democracy
(CORD) & 2 others v Republic of Kenya & 10 others (Supra). We do not, therefore, have before us legislation
that contains a differentiation between members of the Nubian community and other marginalised groups as
compared with other Kenyans. What we have is an amendment to an existing statute that introduces a system of
registration into the population register that requires that one should be in possession of identification documents
issued under other statutory provisions. It seems to us that should there be challenges with those other statutes or
specific statutory provisions and the conditions for issuance of identity documents under the said statutes, then such
challenges and conditions cannot properly be challenged in the present proceedings in which the statutory
provisions in contention are entirely different.
996. Even had we found that there is legislation that contains differentiation between members of the Nubian and
other communities and other groups in Kenya, there is yet another hurdle that the Petitioners would need to
surmount. This is the question whether the Petitioners have laid a factual basis for the allegation that there is
violation of the right to equality and non-discrimination of the Nubians and other marginalised communities. As
held in the Anarita Karimi Njeru Case and Trusted Society for Human Rights Case (supra), the Petitioners
have an obligation to show how the right to equality and non-discrimination has been violated by the State. This
would require, as submitted by the 1st Respondent, that there should be evidence from members of the communities
alleged to be discriminated against that demonstrates how the NIIMS process, or indeed the vetting process under
section 8(1)(A) of the Registration of Persons Act is conducted in a manner that is violative of their rights. What is
the evidence presented before us"
997. PW3, Ahmed Khalil Kafe, is a Kenyan citizen of Nubian descent born on 18th March 1946. He served as a
police officer from 1965 to 1972. At around the time he retired from the Police Force in 1972, he lost his
identification card, a driving licence and police card. He obtained a police abstract, but the abstract in time became

worn out and eventually all the writings on it disappeared. He applied for replacement of his national identification
card on 19th November 2018.
998. During the verification process for replacement of his identification card, he was informed that his fingerprints
were not available in the records at the National Registration Bureau and was asked to swear an affidavit to
facilitate the replacement of the national identification card. His testimony was that it has been four years since he
lost his documents and his efforts to replace them were fruitless. He had applied for a Huduma Namba on 10th April
2019 but the officials had sent him away without attending to him. He stated, however, that he had a waiting card
issued to him on 5th September 2019. He stated that his problem in this case is that without an identity card he
cannot get a Huduma Namba.
999. The affidavit and oral evidence of Mr. Shafi Ali Hussein, in so far as it relates to the alleged discrimination
against members of the Nubian community and other marginalised groups, was primarily directed at the vetting
process and the composition of the vetting committees established under section 8(1A) of the Act. He contended
that while vetting is intended to counteract fraudulent acquisition of documents, it was not applied to other ethnic
groups. Mr. Hussein conceded, somewhat reluctantly, that he had written the letter of appreciation dated 8th April
2017 to the National Registration Bureau. The letter had been written on behalf of the 1st Petitioner which was
partnering with the Registrar of Persons in mobilising residents in the issuance of identity cards and birth
certificates.
1000. Ms. Fatuma Abdirahman’s testimony traces the challenges faced by Nubians to the 1990s, their quest for the
Kibra land, and the 1998 bombing of the American embassy. Prior to 1990, the Nubian community had accessed
identity documents like other Kenyans, but since then the community was subjected to differential treatment with
regard to accessing birth certificates, national identity cards, and passports. The security vetting had intensified
after the process was legalised by the Security Laws (Amendment) Act of 2014.
1001. Ms. Abdirahman narrated the steps taken by the 1st Petitioner to improve access to government
documentation for members of the Nubian community, testifying that over 3,200 people had been assisted to apply
for birth certificates, identity cards, passports, and death certificates. She was aggrieved that Nubians in Kibra are
only able to apply for identity cards on Tuesdays or Thursdays, the days on which the vetting committees sit.
1002. Taken together, and with the greatest respect to the 1st Petitioner, we are unable to discern violation of the
right to equality and non-discrimination from the evidence presented before us. What we have is the evidence of
one witness who had obtained identification documents issued as far back as 1961, lost them in 1972, obtained a
police abstract but did not follow up on it and the writings on it faded; and only applied for a replacement
identification card in November 2018, 46 years after he lost the documents. His evidence, we must observe, was
quite inconsistent and not quite reliable, and is not demonstrative of the alleged challenges and discrimination.
1003. The other evidence indicates that the 1st Petitioner has been able to enter into partnerships with State agencies
such as the National Registration Bureau and mobilised residents to get identification cards as well as births and
deaths certificates. Contrary to the assertions of Mr. Hussein, the letter of 8th April 2017 is more suggestive of a
community that is happy with the manner in which the issuance of documents was progressing. All in all, we are
unable to find a basis for faulting the impugned amendments on the basis that they had resulted in violation of the
right to equality and non-discrimination.
On Exclusion
1004. The Petitioners have contended that the impugned amendments make it mandatory to register under NIIMS
and to obtain the unique identification number. They are aggrieved that under section 9A(2)(d), NIIMS shall,
among other things, support the printing and distribution of all identification documents in the country. They are

further aggrieved that public services connected to these identification documents will only be offered to those who
surrender their personal biometric information and are issued with the Huduma Namba. This contention requires
that we address ourselves to the question whether obtaining the Huduma Namba is mandatory, a condition
precedent to obtaining government services, and therefore likely to result in exclusion and violation of the right to
non-discrimination.
1005. The parties to this matter have not addressed themselves to this issue in their submissions. However, it
emerges as a core grievance of the Petitioners in the affidavit evidence of Ms. Munyua and Mr. Kegoro, and the
oral testimony of Mr. Hussein. Ms. Munyua averred that the NIIMS process should not be used for exclusion.
While noting that possessing an identity is increasingly a precondition to accessing basic services, and since vital
government services will require a Huduma Namba, she averred that there was the potential for excluding from the
system those who may not have registered for various reasons.
1006. The position taken by the Petitioners is that care should be taken not to exclude anyone from the
identification system because of their physical, social, demographic, or economic characteristics. Ms. Munyua
noted in particular the potential to exclude marginalized communities since officials will be using existing
documents to verify who is a citizen, thus locking out people who do not have these identification documents such
as the Makonde, the Shona and pastoral communities.
1007. George Kegoro makes similar averments with regard to the potential for NIIMS to result in exclusion and
consequent denial of government services if such services are pegged on registration in NIIMS and possession of
the Huduma Namba, a result that would be inconsistent with Article 12(2) which relates to citizenship rights, and
1008. The Respondents counter that registration under NIIMS is meant to be an ongoing exercise. Dr. Kibicho
averred that it will not be discontinued at the lapse of 45 days of mass registration. Their contention is that there is
no danger of exclusion as deserving persons who do not currently have the requisite identification documents can
obtain them within the parameters set by the law and thereafter register for the Huduma Namba.
1009. On his part, Jerome Ochieng sees advantages in the NIIMS system over the current registration system. He
avers that the current registration system has some shortcomings, including access to documents or access to the
registration system. He illustrates this by noting that under the current system, applicants for national identity cards
are required to produce their birth certificates and their parents’ national identity cards, among others. In the
Respondents’ view, with registration in NIIMS, all this information shall be captured and there will thus be no
need for such documentation. The argument from the Respondents thus posits that NIIMS will reduce the
duplication of processes common in accessing government services as it will serve as a one-stop shop for
identification information, thus rendering access to government more efficient.
1010. We have two scenarios presented to us by the parties with respect to the consequences of the implementation
of NIIMS. The first is the gloomy scenario that the Petitioners fear will lead to the exclusion of significant portions
of the population from accessing government services on account of a failure to register under NIIMS. Such a
failure may result from a choice, an election, not to surrender vital personal data to the system, or from the inability
to register due to the lack of personal identification documents as may happen, according to the Petitioners, with
respect to marginalised communities.
1011. Then there is the optimistic scenario painted by the Respondents in which access to government services will
be easy and efficient as all the personal data will be available within the NIIMS system and accessible at the click
of a mouse. A consideration of the issue of exclusion requires that we try to find a balance and arrive at an
approximation of where the truth between these two divergent scenarios lies, and to arrive at a determination that
will advance the rights of citizens and all others resident within the borders of Kenya who require government

services.
1012. We note that all the parties are agreed that the use of digital data is the way of the future. The challenge is to
ensure, among other things, that no one is excluded from the NIIMS and the attendant services. This may occur due
to lack of identity documents, or lack of or poor biometric data, such as fingerprints. In our view, there may be a
segment of the population who run the risk of exclusion for the reasons already identified in this judgment. There is
thus a need for a clear regulatory framework that addresses the possibility of exclusion in NIIMS. Such a
framework will need to regulate the manner in which those without access to identity documents or with poor
biometrics will be enrolled in NIIMS. Suffice to say that while we recognize the possibility of this exclusion, we
find that it is in itself not a sufficient reason to find NIIMS unconstitutional
Whether the 1st Petitioner’s Petition is barred by the Principles of Sub Judice Res Judicata
1013. A final, corollary issue raised against the 1st Petitioner’s case is that its Petition offends the principles of
sub-judice and res judicata. The 2nd and 3rd Respondents submit that the 1st Petitioner is precluded from reviving
the Nubian community cases in the present Petition by the doctrine of sub judice. They submit that the issues raised
by the 1st Petitioner in this matter were previously litigated before the High Court. It is their contention that in the
Nubian Community case before the African Commission, the Nubian Community, which was the complainant,
noted that it had instructed the Center for Minority Rights Development to institute a suit against the government of
Kenya for denial of citizenship and for discrimination in the issuance of identity documents.
1014. While noting that the 1st Petitioner has not proved to the court whether that petition, which was filed on 17th
March 2003 and referred to in the Nubian Community case, was decided, it is their submission that the 1st
Petitioner is nonetheless barred by the doctrine of sub judice from litigating on issues which had been previously
raised in a petition before this Court. The 2nd and 3rd Respondents rely on section 6 of the Civil Procedure Act and
the decision in Edward R. Ouko v Speaker of the National Assembly & 4 others [2017] eKLR in which the
High Court set out the principles to be considered in order to find that the doctrine was applicable. These
principles, according to the 2nd and 3rd Respondents, are first, that there must exist two or more suits filed
consecutively; that the matter in issue in the suits or proceedings must be directly and substantially the same; that
the parties in the suits or proceedings must be the same or must be parties under whom they or any of them claim,
litigating under the same title; and the suits must be pending in the same or any other court having jurisdiction in
Kenya to grant the relief claimed.
1015. It is their submission that the above principles apply with respect to the present petition by the 1st Petitioner.
They assert that both petitions filed by the Nubian Community seek to enforce their right to citizenship and non-
discrimination under the Constitution; that both claims are directed against the government and the Ministry of
Interior and Co-ordination of the National Government and Security through the Attorney General; and that both
petitions were instituted either by the 1st Petitioner acting in its own capacity or through a non-governmental
organization as in the first petition.
1016. It is also the 2nd and 3rd Respondents’ submission, in the alternative, that the 1st Petitioner’s claim in the
present petition is barred by the doctrine of res judicata. They submit that in the event that it is proved that the
earlier petition filed in the High Court was determined, then the 1st Petitioner is barred from re-litigating the same
issue on the basis of the doctrine of res judicata set out in section 7 of the Civil Procedure Act and explanation 3
thereof. They rely in support of this submission on the decision in Independent Electoral and Boundaries
Commission v Maina Kiai & 5 others, Nairobi ([2017] eKLR) in which the Court of Appeal noted that:
“……for the bar of res judicata to be effectively raised and upheld on account of a former suit, the following
elements must be satisfied, as they are rendered not in disjunctive but conjunctive terms;

(a) The suit or issue was directly and substantially in issue in the former suit.
(b) That former suit was between the same parties or parties under whom they or any of them claim.
(c) Those parties were litigating under the same title.
(d) The issue was heard and finally determined in the former suit.
(e) The court that formerly heard and determined the issue was competent to try the subsequent suit or the suit
in which the issue is raised.”
1017. They further cite the words of the Court in the said decision in which it stated that:
(f) “The rule or doctrine of res judicata serves the salutary aim of bringing finality to litigation and affords
parties closure and respite from the spectra of being vexed, haunted and hounded by issues and suits that have
already been determined by a competent court. It is designed as a pragmatic and commonsensical protection
against wastage of time and resources in an endless round of litigation at the behest of intrepid pleaders hoping,
by a multiplicity of suits and fora, to obtain at last, outcomes favorable to themselves. Without it, there would be
no end to litigation, and the judicial process would be rendered a noisome nuisance and brought to disrepute or
calumny. The foundations of res judicata thus rest in the public interest for swift, sure and certain
justice.” (Emphasis added)
1018. The 2nd and 3rd Respondents allege bad faith on the part of the 1st Petitioner and urge the Court to note the
bad faith it exhibits in instituting two similar suits before this Court and other suits outside the jurisdiction, actions
which they term abuse of process. The 1st Petitioner did not respond to these arguments.
1019. We have considered this issue and the submissions made by the 2nd and 3rd Respondents, which have not
been countered by the 1st Petitioner. There is no material before us to indicate whether or not the suit filed in the
High Court alleging violation of the rights of the Nubians has been determined, and if so, what the outcome thereof
was. It would appear, however, that as argued by the 2nd and 3rd Respondents, the issue of alleged violation of the
rights of members of the Nubian community has been under consideration by a court of concurrent jurisdiction and
has been determined or is pending determination.
1020. We also have before us the decision in Institute for Human Rights & Development in Africa & Open
Society Justice Initiative on behalf of Children of Nubian descent in Kenya v Kenya, Communication no.
Comm/002/2009 of March 2011 in which the African Committee of Experts on the Rights and Welfare of the
Child (ACERWC) found that the Republic of Kenya had violated the rights of children of Nubian descent under the
African Charter on the Rights and Welfare of the child, which explicitly recognizes the right to a nationality. It
would appear to us, therefore, that the 1st Petitioner is indeed raising issues that have been the subject of judicial
interpretation or are pending interpretation in our courts.
1021. However, the issues before us arise in the context of the constitutionality of the amendments to the
Registration of Persons Act. As was held by the Court of Appeal in the case of John Florence Maritime Services
Limited & Another vs Cabinet Secretary for Transport and Infrastructure and 3 Others, (2015) eKLR the
doctrine of res judicata must be sparingly invoked with regard to constitutional petitions, for the reason that rights
keep on evolving, mutating and assuming multifaceted dimensions. We therefore decline to find that the 1st
Petitioner’s Petition is res-judicata.
Summary of Findings

1022. Arising from our findings in the foregoing sections, it is our view that the Petitions partially succeed to the
extent already stated in the judgment. We set out below a summary of our findings.
On Whether the Legislative Process was Constitutional
1023. In addressing this issue we considered whether the impugned amendments were subjected to public
participation in accordance with the Constitution, whether the enactment by way of an omnibus Statute Law
(Miscellaneous Amendment) Act was procedural or appropriate in the circumstances, and finally, whether the
impugned law was a Bill concerning counties and should therefore have been subjected to approval of the Senate.
1024. All the parties were agreed that public participation is a key element in the achievement of democratic
governance and is a constitutional imperative. Our view is that the time that was available for public participation
must be considered in light of all the processes of the legislative process. In the present Petition, the evidence
before us suggests that the public was aware of the Bill from 10th April 2018, when it was published, and could
have participated from that date until the committee hearings on 14th, 19th and 20th June 2018. The evidence from
the Respondent demonstrated that this opportunity was given to the public, and that indeed there was participation
by the 3rd Petitioner even after expiry of the time stated in the advertisement. It was thus our finding that sufficient
time was afforded for public participation on the enactment of Statute Law (Miscellaneous Amendments) Act 2018.
1025. We also took the view that whenever the issue of the use of an omnibus Bill arises, the question to be posed
is whether the procedure has, in the circumstances of the particular case, limited the right of the public to
participate in the legislature’s business. However, if there is evidence placed before the court by the legislature to
demonstrate that the principle of public participation was complied with in the process of the amendments, then the
court should not be quick to hold such amendments invalid simply because an omnibus Bill was used to make the
amendments.
1026. We noted that it is not in the place of the courts to dictate the procedures to be used by the two houses of
Parliament in executing their legislative mandate. The business of the court is to confirm that the legislative bodies
have complied with the Constitution and the law in delivering on their mandates. In this respect, as we had already
found that there was evidence of sufficient time for public participation, and the procedure employed by the 6th
Respondent in the stakeholder engagement of the Omnibus Bill during the Committee Stage by various Committee
did facilitate public participation, we did not find the use of the omnibus Bill in the enactment of Statute Law
(Miscellaneous Amendments) Act 2018 unconstitutional.
1027. On whether the Bill was a Bill concerning counties, we were of the view that the jurisdiction of the Senate
does not extend to each and every legislation passed by the National Assembly, and that to hold so would render
Article 110 of the Constitution redundant. In addition, while the Fourth Schedule of the Constitution does indeed
give a wide array of functions to the counties, in our view, these functions do not include creation and maintenance
of a national population register. It was therefore our finding and holding that the enactment of the impugned
amendments did not require the involvement of the Senate.
Whether there is Violation and/or Threatened Violation of the Right to Privacy.
(a) Whether the personal information collected is excessive, intrusive, and disproportionate.
1028. There were two limbs of arguments raised as regards this issue. The first limb was that the provisions for
collection of biometric data by the impugned amendments was intrusive and unnecessary. Closely related to the
first limb of the issue at hand is the second limb that the data collected pursuant to the impugned amendments is not
supported by the stated purposes of NIIMS and is purpose free.

1029. We considered in this regard the scope and content of the right to privacy including information, and found
that biometric data and GPS coordinates required by the impugned amendments are personal, sensitive and
intrusive data that requires protection. Even though there was no evidence brought by the Petitioners of any
violations of rights to privacy in this respect, we also found that the impugned amendments impose an obligations
on the relevant Respondents to put in place measures to protect the personal data.
1030. It was also our holding that the biometric data collected is necessary to the stated purposes of NIIMS in
section 9A of the Registration of Persons Act, and the functionalities of NIIMS as an identification and verification
system in our view, also justified the utility of NIIMS and the other existing identification and registration
databases. It was thus our finding that NIIMS is not superfluous from an identification and verification point of
view, as the biometric data collected therein is necessary for identification, and will be used for verification
purposes in relation to other existing databases. Lastly, we found the stated benefits of NIIMS given by the
Respondents in their evidence to be in the public interest and not unconstitutional.
(b) Whether there is a Violation of Children’s Right to Privacy
1031. It was evident that the provisions of section 9A of the Registration of Persons Act on the purposes of NIIMS
contradict section 2, and the two provisions cannot operate at the same time with regard to the application of
NIIMS to children. After applying the rules of statutory interpretation on implied amendment and repeal detailed
out in the judgment, it is our finding that section 9A, being a later amendment, is deemed to have amended section
2 with respect to its application to NIIMS, and to this extent the inconsistency was thereby resolved. We therefore
found that section 9A of the Registration of Persons Act and NIIMS applies to children.
1032. We were also of the view and found that the general principles and protections that apply with regard to the
right to informational privacy, and our findings in this regard with respect to the biometric data collected under
NIIMS are also applicable to children, as much as they apply to adults, and even more. This is because unlike
adults, children’s ability to make reasonable choices about what information to share is limited, as a result of their
limited capacities, development and education. The additional issue which we therefore considered was whether the
impugned amendments and NIIMS provide specific protection with regard to children’s personal data.
1033. In this regard we noted some gaps in the Data Protection Act, namely that there is no definition of a child in
the Act, and the rights of the child in relation to the data so collected during minority and majority stages are also
not specified, particularly in light of their evolving capacities and best interests. In addition, despite NIIMS being
applicable to children, there are no special provisions in the impugned amendments, and no regulations that govern
how the data relating to children is to be collected, processed and stored in NIIMS. It was our conclusion therefore
that the legislative framework on the protection of children’s biometric data collected in NIIMS is inadequate.
(c) Whether there are Sufficient Legal Safeguards and Data Protection Frameworks
1034. We noted that the protection of personal data depends largely on a legal, regulatory and institutional
framework that provides for adequate safeguards, including effective oversight mechanisms. This is especially the
case with NIIMS, whereby a vast amount of personal data is accessible to The State, and data subjects currently
have limited insight into and control over how information about them and their lives is being used.
1035. While we found that the Data Protection Act No 24 of 2019 has included most of the applicable data
protection principles, we noted that there are a number of areas in the Act that require to be operationalised by way
of regulations, including circumstances when the Data Commissioner may exempt the operation of the Act, and
may issue data sharing codes on the exchange of personal data between government departments. It is our view that
these regulations are necessary, as they will have implications on the protection and security of personal data.

1036. We also observed that once in force, data protection legislation must also be accompanied by effective
implementation and enforcement. The implementation of the Data Protection Act 24 of 2019 requires an
implementation framework to be in place, including the appointment of the Data Commissioner, and registration of
the data controllers and processors, as well as enactment of operational regulations. It was our finding therefore that
while there is in existence a legal framework on the collection and processing of personal data, adequate protection
of the data requires the operationalisation of the said legal framework.
1037. On the safety and security concerns raised related to the design of NIIMS, it was our conclusion that all
biometric systems, whether centralised or decentralised, and whether using closed or open source technology,
require a strong security policy and detailed procedures on its protection and security which comply with
international standards. For our purposes, what was relevant is that the said principles and standards should be
provided and actualized in regulations that will govern the operation of NIIMS. In addition, it was our view that the
biometric data and personal data in NIIMS should only be processed if there is an appropriate legal framework in
which sufficient safeguards are built in to protect fundamental rights.
1038. In this respect, while the Respondents explained the measures they have put in place to ensure the safety of
the data collected by NIIMS and the security of the system, including the encryption of the data and restricted
access, it was not disputed by the Respondents that there is no specific regulatory framework that governs the
operations and security of NIIMS. The Respondents also did not provide any cogent reason for this obvious gap. To
this extent we found that the legal framework on the operations of NIIMS is inadequate, and poses a risk to the
security of data that will be collected in the system.
(d) Whether the Impugned Amendments are an Unnecessary, Unreasonable and Unjustifiable Limitation.
1039. It was our finding that because of the speci"city of the information that DNA may disclose and the harm
disclosure may cause not just to the data subject but other family members in terms of both identi"cation and
genetic information, DNA information requires and justi"es a particular and specific legal protection. Likewise, we
found that specific authorization anchored in law is required for the use of GPS coordinates in light of the privacy
risks we identified in terms of their possible use to track and identify a person’s location. Accordingly, we found
that the provision for collection of DNA and GPS coordinates in the impugned amendments, without specific
legislation detailing out the appropriate safeguards and procedures in the said collection, and the manner and extent
that the right to privacy will be limited in this regard, is not justifiable.
1040. We also noted that an inadequate legislative framework for the protection and security of the data is clearly a
limitation to the right to privacy in light of the risks it invites for unauthorized access and other data breaches. To
this extent we found the lack of a comprehensive legislative framework when collecting personal data under the
impugned amendments, is contrary to the principles of democratic governance and the rule of law, and thereby
unjustifiable.
Whether there was a Violation of the Right to Equality and Non-Discrimination
1041. There were two facets of the alleged denial of the right to equality and non-discrimination disclosed. The first
relates to the argument that the impugned amendments and the implementation of NIIMS will perpetuate
discrimination against members of the Nubian community and other marginalised groups. The second relates to the
contention that the impugned law makes it mandatory for everyone to obtain a Huduma Namba, failing which one
will be denied government services.
(a) On Discrimination against the Nubian Community
1042. We found that the impugned legislation did not contain a differentiation between members of the Nubian

community and other marginalised groups as compared with other Kenyans. What we found is an amendment to an
existing statute that introduces a system of registration into the population register that requires that one should be
in possession of identification documents issued under other statutes or statutory provisions. It was our view that
should there be challenges with those other statutes or provisions, then such challenges cannot properly be raised in
the present proceedings in which the legislation or provision in contention is entirely different.
1043. We also considered the question whether the Petitioners had laid a factual basis for the allegation that there is
violation of the right to equality and non-discrimination against the Nubians and other marginalised communities.
We were unable to discern violation of the right to equality and non-discrimination from the evidence presented
before us.
(b) On Exclusion
1044. We addressed ourselves to the question whether obtaining the Huduma Namba is mandatory, a condition
precedent to obtaining government services, and therefore likely to result in violation of the right to non-
discrimination. We noted that all the parties were agreed that the use of digital data is the way of the future. The
challenge is to ensure among other things, that no one is excluded from the NIIMS and the attendant services. This
may occur due to lack of identity documents, or lack of or poor biometric data, such as fingerprints. In our view
there may be a segment of the population who run the risk of exclusion.
1045. We therefore found that there is thus a need for a clear regulatory framework that addresses the possibility of
exclusion in NIIMS. Such a framework will need to regulate the manner in which those without access to identity
documents or with poor biometrics will be enrolled in NIIMS. While we recognize the possibility of this exclusion,
however, we did not find that it is in itself a sufficient reason to find NIIMS unconstitutional.
Cost
1046. The final issue to consider is who should bear the costs of the consolidated Petitions. The applicable
principles are that costs follow the event. However, the award of the costs is also at the discretion of the Court. As
this is a matter which clearly raises public interest concerns, it is our view that each party shall bear its own costs.
Disposition
1047. In light of our findings above, we hereby grant, the following orders:
I. A declaration that the collection of DNA and GPS co-ordinates for purposes of identification is intrusive and
unnecessary, and to the extent that it is not authorised and specifically anchored in empowering legislation, it is
unconstitutional and a violation of Article 31 of the Constitution.
II. Consequently, in so far as section 5(1)(g) and 5(1)(ha) of the Registration of Persons Act requires the
collection of GPS coordinates and DNA, the said subsections are in conflict with Article 31 of the Constitution
and are to that extent unconstitutional, null and void.
III. The Respondents are at liberty to proceed with the implementation of the National Integrated Identity
Management System (NIIMS) and to process and utilize the data collected in NIIMS, only on condition that an
appropriate and comprehensive regulatory framework on the implementation of NIIMS that is compliant with
the applicable constitutional requirements identified in this judgment is first enacted.
IV. Each party shall bear its own costs of the Consolidated Petitions

1048. Orders accordingly.
DATED, SIGNED AND DELIVERED AT NAIROBI THIS 30TH DAY OF JANUARY 2020.
P. NYAMWEYA MUMBI NGUGI W. KORIR
JUDGE JUDGE JUDGE
While the design, structure and metadata of the Case Search database are licensed by Kenya Law under a Creative Commons
Attribution-ShareAlike 4.0 International, the texts of the judicial opinions contained in it are in the public domain and are free from any copyright restrictions.
Read our Privacy Policy | Disclaimer
Powered by TCPDF (www.tcpdf.org)

Nubian Rights Forum & 2 Others V Attorney General

Uploaded by

Copyright:

Available Formats

Nubian Rights Forum & 2 Others V Attorney General

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Nubian Rights Forum & 2 Others V Attorney General

Uploaded by

Copyright:

Available Formats

Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested

Parties) [2020] eKLR

IN THE HIGH COURT OF KENYA AT NAIROBI

CONSTITUTIONAL & JUDICIAL REVIEW DIVISION

CONSOLIDATED PETITIONS NO. 56, 58 & 59 OF 2019

NUBIAN RIGHTS FORUM.................................................................1ST PETITIONER

KENYA HUMAN RIGHTS COMMISSION......................................2ND PETITIONER

KENYA NATIONAL COMMISSION ON HUMAN RIGHTS.........3RD PETITIONER

THE HON. ATTORNEY-GENERAL.................................................1ST RESPONDENT

THE CABINET SECRETARY, MINISTRY OF INTERIOR &

CO-ORDINATION OF NATIONAL GOVERNMENT...................2ND RESPONDENT

THE PRINCIPAL SECRETARY, MINISTRY OF INTERIOR &

CO-ORDINATION OF NATIONAL GOVERNMENT...................3RD RESPONDENT

THE DIRECTOR, NATIONAL REGISTRATION BUREAU........4TH RESPONDENT

THE CABINET SECRETARY, MINISTRY OF INFORMATION,

COMMUNICATION & TECHNOLOGY.........................................5TH RESPONDENT

THE SPEAKER, NATIONAL ASSEMBLY......................................6TH RESPONDENT

KENYA LAW REFORM COMMISSION.........................................7TH RESPONDENT

CHILD WELFARE SOCIETY..............................................1ST INTERESTED PARTY

AJIBIKA SOCIETY...............................................................2ND INTERESTED PARTY

http://www.kenyalaw.org - Page 1/174

MUSLIMS FOR HUMAN RIGHTS INITIATIVE.............3RD INTERESTED PARTY

HAKI CENTRE......................................................................4TH INTERESTED PARTY

LAW SOCIETY OF KENYA.................................................5TH INTERESTED PARTY

INFORM ACTION.................................................................6TH INTERESTED PARTY

BUNGE LA WANAINCHI.....................................................7TH INTERESTED PARTY

INTERNATIONAL POLICY GROUP.................................8TH INTERESTED PARTY

TERROR VICTIMS SUPPORT INITIATIVE....................9TH INTERESTED PARTY

“9A (1) There is established a National Integrated Identity Management System.

(2) The functions of the system are —

http://www.kenyalaw.org - Page 2/174

http://www.kenyalaw.org - Page 3/174

THE PETITIONERS’ CASES

The 1st Petitioner’s Case

http://www.kenyalaw.org - Page 4/174

http://www.kenyalaw.org - Page 5/174

f) Costs of this suit be provided for.

The 1st Petitioner’s Evidence

http://www.kenyalaw.org - Page 6/174

http://www.kenyalaw.org - Page 7/174

http://www.kenyalaw.org - Page 8/174

http://www.kenyalaw.org - Page 9/174

http://www.kenyalaw.org - Page 10/174

http://www.kenyalaw.org - Page 11/174

http://www.kenyalaw.org - Page 12/174

soundness of the design and open it to scrutiny.

http://www.kenyalaw.org - Page 13/174

http://www.kenyalaw.org - Page 14/174

http://www.kenyalaw.org - Page 15/174

http://www.kenyalaw.org - Page 16/174

http://www.kenyalaw.org - Page 17/174

http://www.kenyalaw.org - Page 18/174

http://www.kenyalaw.org - Page 19/174

database places his or her freedom at risk.

http://www.kenyalaw.org - Page 20/174

The 2nd Petitioner’s Case

http://www.kenyalaw.org - Page 21/174

http://www.kenyalaw.org - Page 22/174

152. The 2nd Petitioner therefore seeks the following orders: