{"id":207021,"date":"2021-11-01T23:21:07","date_gmt":"2021-11-01T21:21:07","guid":{"rendered":"https:\/\/www.myza.co.za\/why-kenyas-digital-id-roll-out-must-face-up-to-data-protection-risks\/"},"modified":"2021-11-01T23:21:07","modified_gmt":"2021-11-01T21:21:07","slug":"why-kenyas-digital-id-roll-out-must-face-up-to-data-protection-risks","status":"publish","type":"post","link":"https:\/\/www.myza.co.za\/press\/why-kenyas-digital-id-roll-out-must-face-up-to-data-protection-risks\/","title":{"rendered":"Why Kenya’s digital ID roll-out must face up to data protection risks"},"content":{"rendered":"
<\/div>\n

Controversy has dogged Kenya\u2019s pursuit of a digital identity database for all children, citizens and residents, intended to replace the physical identity card issued only to citizens over 18 years old. Concerns include lack of public participation in drawing up the digital ID law, potential to exclude vulnerable groups and the lack of a clear plan to protect the massive amounts of data collected. Grace Mutung’u, a researcher who specialises in digital rights, governance and development, explains what\u2019s behind the Kenya high court\u2019s decision<\/a> to temporarily stop the digital ID roll-out.<\/em><\/p>\n

What is a digital identity and how does it work?<\/h2>\n

Digital ID is the use of digital technologies to identify a person. Identification is usually through something one has, something one knows, or something one is. In a country like Kenya, people have long carried national identity cards with which they are identified. Banks also issue ATM cards which come with secret codes with which customers identify themselves. It\u2019s the same with mobile money services. These are examples of things people know. Biometrics is an example of identification through who one is. During elections, voters may use their fingerprints on biometric identification machines to verify identify. All these are forms of digital ID.<\/p>\n

Authentication is key to proving one\u2019s identity. Many view biometrics as the most unique identifiers and these are increasingly relied on for authentication. Under Kenyan law, biometrics include fingerprints, hand geometry, earlobe geometry, retina and iris patterns, as well as voice waves. For this reason, it is becoming normal to find biometric scanners at airports. With digital ID programmes, biometrics will increasingly be used for access to day-to-day government services.<\/p>\n

How is Kenya \u2013 among other countries \u2013 implementing its digital ID system?<\/h2>\n

Kenya\u2019s digital ID system will replace the existing national ID card. The card has been in place since before independence<\/a>. It\u2019s widely used to identify people when they use government and private services and apply for jobs, driving licences, bank accounts and mobile phone SIM cards. The national ID card is a citizenship document that is normally taken out when a person turns 18.<\/p>\n

The new digital ID programme, popularised as \u201cHuduma Namba\u201d (Kiswahili for \u201cservice number\u201d) has several aims. It includes everyone in the system \u2013 children, citizens and residents. It integrates all existing identity systems and makes them interoperable. And it centralises design and issuance of identity documents. The system will also integrate biometrics, shifting Kenya from the practice of validating identity documents to authenticating people.<\/p>\n

To get a digital ID, one needs a primary identification document, for example a national ID, a passport for foreigners and a birth certificate for children. This has been problematic as there is a significant number of people without identity documents or who face barriers when acquiring these documents. They fear that once the new system is in place, they will become legally invisible to the state and be unable to access services, since services will only be available through digital ID. In a case challenging<\/a> Huduma Namba, one of these groups, the Nubians, expressed fear that if Kenya migrated to digital ID, they would be legally invisible and therefore unable to access government and private services.<\/p>\n

The high court has stopped its implementation, citing data security risks. What are they?<\/h2>\n

On 14 October 2021, the High Court<\/a> declared that the roll-out of Huduma Namba was illegal for want of a Data Protection Impact Assessment. This is a process of identifying the impact of data processing on the rights and freedoms of the people to whom the data relates, and mitigating those risks. Huduma Namba data processing poses high risks, since very personal data such as one\u2019s address, family relations and more importantly, biometrics, are collected.<\/p>\n

One way to think about risk is to imagine who would be affected were such data to be leaked. With biometrics, the greatest risk is that they are so unique that once leaked, the risk cannot easily be mitigated by resetting. It\u2019s not like resetting a password or secret code. <\/p>\n

Another risk with data in the custody of government is state surveillance. The government can listen in to private conversations and track people<\/a>. We have seen governments using data for political campaigning, in ways that threaten democracy<\/a>.<\/p>\n

The High Court in Kenya therefore ordered the government to stop further processing of Huduma Namba or giving out of Huduma cards until the system\u2019s impact had been assessed. This means the government should systematically assess all the risks associated with Huduma Namba data and think about how to minimise those risks so that if data leaked, it wouldn\u2019t have a big impact on the people whose data it is.<\/p>\n

What are the other challenges?<\/h2>\n

One can view the challenges from two main perspectives \u2013 inclusion and protection from harm. With Kenya\u2019s history of inequitable development across regions<\/a>, there are those who risk being left out of digital ID and therefore missing out on government and private services. Digital ID can therefore worsen existing inequalities among communities, genders and people with different incomes.<\/p>\n

In the previous judgement<\/a> on Huduma Namba, issues like the privacy of children were discussed. Their data should be protected from practices such as surveillance.<\/p>\n

With digital ID data, governments can also make unfair decisions on various groups, intentionally or unintentionally. So it\u2019s important for people to be able to participate in designing the system. Kenya\u2019s digital ID law was developed without much participation, denying experts the opportunity to give input on issues such as data governance.<\/p>\n

Source: The Conversation<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Controversy has dogged Kenya\u2019s pursuit of a digital identity database for all children, citizens and residents, intended to replace the physical identity card issued only to citizens over 18 years old. Concerns include lack of public participation in drawing up the digital ID law, potential to exclude vulnerable groups and the lack of a clear […]<\/p>\n","protected":false},"author":1,"featured_media":207022,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","ngg_post_thumbnail":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4584],"tags":[3257],"class_list":{"0":"post-207021","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-africa-news-2","8":"tag-mypr","9":"entry"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/www.myza.co.za\/press\/wp-content\/uploads\/2021\/11\/why-kenyas-digital-id-roll-out-must-face-up-to-data-protection-risks.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts\/207021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/comments?post=207021"}],"version-history":[{"count":0,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts\/207021\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/media\/207022"}],"wp:attachment":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/media?parent=207021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/categories?post=207021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/tags?post=207021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}