Digital Identity in Kenya: Balancing Progress with Constitutional Rights
Allan Mwangi Kiarie
Introduction
Identification systems have served as cornerstones of individual identification for centuries. Kenya, relying on physical ID cards prone to forgery and fraud, aims to introduce a digital ID system, Maisha Namba, utilizing biometric data for enhanced security and service delivery. Digital ID is a unique representation of an individual, organization, or device in digital form.(Digital ID) Maisha Namba utilizes a unique personal identifier (UPI) for each citizen, which serves multiple purposes throughout a person's life. ( An Overview of the Digital ID system and the Unique Personal Identifier)It works by:
1. Registration: Maisha Namba is assigned to each Kenyan citizen upon registration, typically at the time of birth. (New ID Applicants to Get Maisha Namba As Pilot Phase Takes Off- Techweez) This number will serve as a lifelong personal identity.
2. Verification: The Maisha Namba enables citizens to verify their identity online using biometric features. This includes fingerprints or facial recognition such as the iris.( Maisha Namba: Date Set For Official Rollout of Digital Personal)
3. Usage: The UPI number available on Maisha Namba card will be used for services like school registration, tax payment, etc. It is important to note that the Maisha Card is for those under 18yrs and over 18yrs will be different.
4. Data Management: Data processing will be managed by the National Digital Identity Management System.
The goal of this initiative is to streamline access to government and commercial services, reduce administrative burdens associated with identity verification, and improve access to critical services for individuals who may have difficulty accessing physical offices. ( Kenya to introduce digital IDs for citizens by year-end- Cointelegraph) ) However, the implementation of this system has raised several concerns, including data privacy, security, mandatory participation, and transparency.( Maisha Namba Kenya: What is it, Benefits, Role of UNDP And How to Apply) While digital ID offers potential benefits, it comes with its fair share of troubles.
Obstacles
The history of Kenya's digital ID initiative reveals complexities and public unease. Huduma Namba, the first iteration launched in 2019, was a digital identity system introduced in Kenya in 2019, aiming to create a single source of personal information for all Kenyan citizens and registered foreigners. The initiative faced legal challenges citing privacy concerns and was eventually discontinued. The reason for discontinuing being:
1. Data Protection Concerns: Huduma Namba involved the collection and storage of sensitive personal and biometric data. Concerns were raised about the potential for unauthorized access, misuse, and profiling of this data. The absence of a comprehensive data protection law in Kenya at the time further fueled these anxieties.( Data Protection Impact Assessments and ID systems: the 2021 Kenyan)
2. Legal Challenges : Huduma Namba faced legal challenges in court. In October 2021, the High Court of Kenya ruled that the government had failed to conduct a data impact assessment before rolling out the Huduma Namba, thereby contravening the Constitution. Nubian Rights Forum & 2 others v Attorney General & 6 others [2020] eKLR
3. Public Perception and Trust: There were calls for an audit into the Huduma Namba before rolling out new identity systems like the Maisha cards. The public needed to know what went wrong with the Huduma Namba before being made to enroll for another system.
Maisha Namba emerged in 2023, aiming to address previous concerns. It appeared as a second iteration to the attempted introduction of the Digital ID programme. The Maisha Namba Program, also known as the National Integrated Identity Management System (NIIMS), is a digital identification initiative launched by the Government of Kenya. The program aims at creating a centralized database of all Kenyan citizens and residents, assigning each individual a unique identification number known as the Huduma Namba or "life number" (Maisha Namba in Swahili). The program seeks to streamline identification processes, enhance service delivery, and combat identity fraud by consolidating various personal data into a single, secure database.
Under the Maisha Namba Program, individuals are required to provide biometric data, including fingerprints and facial images, alongside personal information such as names, date of birth, gender, and contact details. This information is stored in a central database managed by the government, facilitating efficient access to services across various sectors, including healthcare, education, social welfare, and financial services. However, several obstacles remain:
Data Protection
Biometric Data Concerns: Collecting and storing sensitive biometric data (fingerprints, iris scans) carries inherent risks of unauthorized access, profiling, and potential misuse. The absence of strong safeguards increases public anxiety.
Mandatory Participation
Initial proposals provided for mandatory enrollment, potentially clashing with the issue of informed consent regarding information collection. This raised concerns about discrimination and exclusion for individuals lacking access to technology or facing privacy concerns.
Transparency and Public Trust
Lack of Clear Communication: Concerns exist about the lack of clear and accessible information regarding data usage, retention policies, and potential consequences of non-participation. This lack of transparency undermines public trust and understanding, hindering acceptance of the system.
Public Resistance: Public anxieties surrounding data privacy, mandatory enrollment and potential misuse fuel resistance towards the initiative. Building trust and addressing concerns are crucial for successful implementation.
Security Concerns:
Cyber security Risks: Doubts linger about the system's vulnerability to cyber-attacks and data breaches, potentially exposing sensitive information to malicious actors.
Technology Infrastructure: Questions remain about the ability to ensure secure and reliable access for all citizens, particularly in rural areas with limited technological infrastructure. Addressing these inequalities is essential for inclusive implementation.
Cost of Implementation: The financial resources required for development, rollout, and maintenance of the system raise concerns about its affordability and potential for diverting resources from other priorities.
Legal Challenges: The High Court's temporary suspension due to the lack of a data protection impact assessment highlights the potential for further legal challenges based on constitutional concerns.
Government's Goals
The Kenyan government aims to leverage digital IDs for various purposes, including:
1. Enhancing security by combating fraud and improving identification accuracy.
2. Streamlining service delivery by providing easier access to government services through a centralized platform.
3. Financial inclusion: Facilitating cashless transactions and promoting financial access.
4. Improved efficiency by simplifying the administrative processes and enhancing governance.
The Kenyan government in its attempt to bring the services closer to the citizens fails to consider maisha namba its compatibility with the Constitution and other relevant statutes.
Right to Privacy under Article 31 of the Constitution of Kenya (CoK) 2010: Collecting and storing sensitive biometric data raises concerns about violating the right to privacy. The absence of a robust data protection law further amplifies these concerns, as individuals lack clear safeguards against data misuse or unauthorized access.
Right to equality and freedom from discrimination under Article 27 of the CoK 2010: Mandatory participation could disproportionately impact marginalized groups without access to technology or facing economic or social barriers, potentially violating their right to equality and freedom from discrimination.
Access to information under Article 35 of the CoK 2020: Lack of clarity regarding data usage, retention policies, and potential consequences of non-participation creates concerns about transparency and hinders individuals' ability to exercise their right to access information.
National Cohesion and Integration Act 2008: The NCIC Act empowers the National Cohesion and Integration Commission (NCIC) to collect personal data for specific purposes. However, its compatibility with data protection principles for a program like Maisha Namba remains debatable.
Data Protection Act 2019: While this Act exists, its regulations governing biometric data and specific requirements for government data collection are yet to be finalized, creating a legal grey area surrounding data protection safeguards.
Nubian Rights Forum & 2 others v Attorney General & 6 others(2020 eKLR): This case, challenging the Huduma Namba (predecessor to Maisha Namba), highlighted the lack of a data protection impact assessment and potential privacy violations, leading to the program's suspension.
Rwanda's SDID vis-a-vis Kenya's Maisha Namba
Rwandan Single Digital ID system (SDID)
The SDID is a unique digital identity initiative that secures citizens' identities through biometric features. The system is part of the government’s efforts to simplify access to public services, drive the digital economy, and ease the living conditions of citizens. The World Bank funds the Rwanda digital ID scheme with $40 million. ( Rwanda Plans Biometric Digital ID Program With $40M Backing From World Bank)The proposed digital ID will use more biometrical data, ranging from traditional fingerprints to iris scans. The system observes data privacy and security measures.
Reasons for Rwanda’s success in the Digital ID initiative;
1.Strong Government Commitment and Leadership: Rwanda's government has shown strong commitment and leadership in driving the digital ID program forward. The government's vision for a modernized and efficient public service delivery system has been instrumental in the success of the program. Clear political will and support from top leadership have ensured effective implementation and coordination across government agencies.
2.Comprehensive Legal and Regulatory Framework: Rwanda has developed a comprehensive legal and regulatory framework to govern its digital ID program. The country has enacted laws and regulations that address data protection, privacy rights, and the use of biometric information. This robust legal framework provides clarity and assurance to citizens regarding the protection of their personal data, contributing to trust and acceptance of the program.
3. Interoperability and Integration: Rwanda's digital ID system is designed to be interoperable and integrated across various government agencies and service providers. This interoperability allows for seamless access to services and facilitates data sharing among different sectors, leading to improved efficiency and effectiveness in service delivery. The integration of the digital ID system with other government initiatives, such as e-government platforms, further enhances its utility and impact.
4. Inclusive Governance and Stakeholder Engagement: Rwanda has adopted an inclusive approach to governance and stakeholder engagement in the development and implementation of its digital ID program. The government has actively involved various stakeholders, including civil society organizations, the private sector, and international partners, in the design and rollout of the program. This participatory approach has ensured that the program meets the needs of all citizens and addresses concerns raised by different stakeholders.
5. Investment in Infrastructure and Technology: Rwanda has made significant investments in infrastructure and technology to support its digital ID program. The country has developed a reliable and secure digital infrastructure, including biometric data capture systems, data centers, and connectivity networks, to support the collection, storage, and processing of biometric information. These investments have enabled the seamless operation of the digital ID system and ensured its reliability and scalability.
6. Emphasis on Public Awareness and Education: Rwanda has placed a strong emphasis on public awareness and education regarding its digital ID program. The government has conducted extensive outreach and communication campaigns to educate citizens about the benefits of the program, their rights regarding the use of their personal data, and the safeguards in place to protect their privacy. This proactive approach has helped build trust and acceptance of the program among the population.
Kenyan Maisha Namba Program
The Maisha Namba project aims at providing Kenyan citizens with a secure and efficient method to verify their identity for various purposes. The project has interconnected elements of Maisha Namba, Maisha Card replacing the second generation IDs, Digital ID linked to the Maisha Card, and a National Population Register that amalgamates government databases into a single register. The government’s renewed plan to roll out a digital ID, after a failed first attempt (Huduma Namba), was met with some opposition from some quarters who were suspicious of the digital ID. The initiative was not participatory before its planned launch, thus leading to suspicion of the real dangers of discrimination, exclusion, and inequities. There also needed to be more transparency on the system design of the digital ID as well as the nature of support that the technical assistance the United Nations Development Programme would provide to Kenya in the roll-out and implementation of the project.
In summary, while both programs aim to provide a secure and efficient method for citizens to verify their identity, the Rwandan SDID seems to have been more successful due to its comprehensive approach to data privacy and security and significant funding from the World Bank. On the other hand, the Kenyan Maisha Namba program has faced challenges due to a lack of transparency and participation in its implementation and lingering concerns from the previous Huduma Namba initiative.
Recommendations for Kenya:
1.Data Protection and Privacy:
Conduct Data Protection Impact Assessments: Regularly assess the program's impact on data privacy and individual rights, addressing potential risks before implementation.
Establish an Independent Data Protection Authority: Create an independent body to oversee data protection compliance and investigate potential violations.
2. Transparency and Public Trust:
Open Communication and Dialogue: Regularly engage with the public through clear and accessible communication about the program's objectives, data usage policies, and individual rights.
Address Public Concerns: Proactively address public anxieties surrounding data privacy, security, and mandatory participation through open dialogue and addressing specific concerns.
Publish Detailed Information: Publish easily accessible information about the program, including technical specifications, privacy policies, and grievance redress mechanisms.
3. Voluntary Participation and Inclusion:
Opt-in System: Promote a voluntary enrollment system instead of mandatory participation, respecting individual choice and autonomy.
Address Digital Divide: Invest in infrastructure and digital literacy programs to ensure equitable access for all citizens, including marginalized groups.
Offer Alternative Means of Identification: Provide alternative identification options for individuals lacking access to technology or facing privacy concerns.
4.Security and Technology:
Implement Robust Security Measures: Utilize strong encryption, secure storage solutions, and regular security audits to mitigate risks of data breaches and cyber-attacks.
Regular System Updates: Ensure regular updates to the system's software and security protocols to address vulnerabilities and emerging threats.
Seek Technical Expertise: Leverage international expertise and best practices in cyber security and digital ID implementation.
5. Governance and Sustainability:
Clearly Define Roles and Responsibilities: Clearly establish the roles and responsibilities of different stakeholders involved in the program's implementation and oversight.
Regular Monitoring and Evaluation: Conduct regular monitoring and evaluation of the program to assess its effectiveness, identify challenges, and ensure adherence to legal and ethical principles.
Independent Oversight: Establish independent oversight mechanisms to ensure transparency, accountability, and compliance with legal frameworks.
By implementing these practical recommendations and learning from successful stories like Rwanda's SDID program, Kenya can strive towards a digital ID program that balances progress with the protection of fundamental rights and fosters public trust.
Conclusion
Kenya's journey towards a successful digital ID program requires navigating complex legal, ethical, and social considerations. While the potential benefits of increased efficiency and service delivery are undeniable, prioritizing data privacy, individual choice, and transparency is paramount. By drawing insights from the successes and challenges of other nations like Rwanda, and implementing the practical recommendations outlined above, Kenya can pave the way for a responsible and constitutional digital ID system.
This process necessitates commitment from the government, open dialogue with the public, and ongoing collaboration with legal experts and technology professionals. Ultimately, the success of Kenya's digital ID program hinges on its ability to balance progress with the protection of fundamental rights, earning the trust and acceptance of its citizens. The path forward requires vigilance, adaptability, and an unwavering commitment to ethical and constitutional principles. Only then can Kenya reap the true benefits of digital identification while safeguarding the rights and privacy of its people.
Insightful!
ReplyDelete