KRA's data clean-up drive now sparks privacy concerns

KRA iTax support officers serve customers at Nairobi Railways Club on August 15, 2014. [Jonah Onyango, Standard]

Questions have now emerged over Kenya Revenue Authority (KRA) decision to conduct a data clean-up exercise that will require all registered taxpayers to verify and update their personal information.

In the clean exercise of the taxpayers’ Personal Identification Number (PIN) registration details, KRA wants taxpayers to input their mobile phone numbers, which the taxman will then use to send them a one-time password (OTP) that can then be used to access the iTax system. 

This initiative is, however, being viewed with suspicion, coming hot on the heels of the contentious Finance Bill, 2024, igniting debate over data privacy and the timing of the authority's actions. 

The Bill had initially proposed to give KRA powers to access taxpayers’ personal details from institutions such as banks and telecommunication companies for tax assessment purposes but this was dropped after public outcry.

The KRA maintains that the exercise aims to "ensure the integrity of the taxpayer’s register" and enhance service delivery. Taxpayers are required to log into iTax, verify their registered mobile numbers, and update any incorrect contact details. The authority has also implemented a one-time password (OTP) system for updating taxpayer contacts in the iTax system.

“We urge all registered taxpayers to update or correct their registration details as appropriate, on iTax, including their phone number, physical address, email address, physical local of businesses, residency status, directorships or partnerships held,” said KRA in a public notice on the data clean up exercise.

However, many Kenyans view this exercise with skepticism. Critics argue that this move could potentially infringe on citizens' constitutional right to privacy. Concerns have been raised about the KRA's ability to track mobile numbers and access mobile transactions, particularly M-Pesa accounts.

"This will enable them to monitor our financial activities indirectly," said one concerned citizen who wished to remain anonymous. "Data privacy will be non-existent if we comply with these demands."

The timing of the KRA's initiative has also come under scrutiny. Some believe it to be a deliberate distraction from the ongoing "Reject the Finance Bill" campaign. "KRA's timing with the reject finance bill is suspicious," noted a social media user.