Fears of misuse of DNA profiles for criminal purposes, manipulation of paternity tests and unlawful access by insurance firms to inform decisions on medical cover are fuelling resistance to a Government plan.

The Government’s plan to collect personal information of all Kenyans, including their DNA profiles and the GPS locations of their places of residence is facing opposition from various quarters concerned about possible breaches of privacy.

President Uhuru Kenyatta has signed the Statute Law (Miscellaneous Amendments) Bill, 2018, which the State could use to collect the wide range of personal information.

Through amendments to the Registration of Persons Act, Kenyans will be required to provide their DNA samples to be used for precise identification of persons in the wake of increasing terrorist attacks and the changing face of the menace.

Kenyans are further required to provide place of residence, postal address, and GPS coordinates to uniquely identify a person’s precise geographic location.

“To enhance the progress made by the Integrated Population Registration System (IPRS), my administration will complete a central master population database, which will be the authentic ‘single source of truth’ on personal identity in Kenya. The database will contain information on all Kenyan citizens as well as foreign nationals residing in Kenya,” Uhuru told a meeting of security chiefs last week. 

But a cross-section of stakeholders, including human rights groups, lawyers, MPs and medics, have warned that the proposal, without sufficient safeguards, was prone to abuse and violation of the right to privacy.

Although most of them did not oppose the move, they argued that Kenya did not have a clear legal regime to guide the process, warning that it could infringe on the rights of Kenyans.

Makueni Senator Mutula Kilonzo Jr, the Kenya National Commission on Human Rights (KNCHR), the Law Society of Kenya (LSK) and the Government Pathologist are among those who have cautioned on the policy.

There were fears that data could be used for criminal activities, manipulated in cases such as paternity disputes, infringe on right to privacy, mistaken identity and for commercial use without the owners' consent.

Mr Kilonzo Jr cited the case of Facebook International, which is under investigation in the US and UK for allowing access of personal data to unauthorised persons. He also mentioned situations where agencies such as NTSA sent Kenyans SMSs yet one had never given their contacts.  

The senator warned that the Facebook case should be a cue that data was not safe, that police could lose DNA samples, the same way exhibits disappear, and that information such as DNA could be misused in paternity cases.

Chief Government Pathologist Johansen Oduor said the plan, though noble, faced serious questions which, if not addressed, could make the collection impossible.

Dr Oduor explained that information such as DNA carried specifics genetic information, which if obtained by insurance firms, could influence decisions on whether to insure a person or not.

“It (law) needs more stakeholder consultations. It has worked in some countries such as South Africa on convicted criminals but with specific timelines and protocols. Your genes carry a lot of information and if such information lands on the hands of insurance firms, they may refuse to cover an individual."

LSK President Allen Gichuhi said lawyers have already expressed their concerns about the law and had appointed a team to study the provisions and come up with a recommendation on the way forward.

The lawyers’ body said the new law might have infringed on the right to privacy and without a proper legal regime on data protection, the collection of DNA may be inappropriate.

“Our ICT committee is studying that to see if the law infringes on right of privacy under Article 31,” Mr Gichuhi said.  

KNCHR Vice Chairman George Morara said the commission had a meeting with MPs and senators to discuss the plan to move to digital identification without a proper legal framework.

He said for any information collected from Kenyans, there must be protocols to ensure the right to privacy was not infringed.

“Since 2008, Parliament has made three attempts to come up with a data protection Bill. We want to urge MPs to move with speed and pass the law. What the Government is planning to do may be a double edged sword where the State may use the information to target certain individuals groups,” Mr Morara said.

Data protection

George Kegoro, executive director of the Kenya Human Rights Commission, said: “Without a data protection law, collecting information is like gathering water into a dam without safeguards if the water escapes.”

Citing Article 19, he said that although the Government was entitled to ensure proper service delivery, it must do so within the confines of the law. He argued that there was mischief in how such a crucial Bill was taken to Parliament as Miscellaneous Amendments 2018, and passed like a small thing.