The Huduma Namba draft bill (“the Bill”) was introduced in July 2019 against the backdrop of a petition that challenged the recent amendments to the Registration of Persons Act found in the Statute Miscellaneous (Amendment) Act. The impugned amendments created the National Integrated Identity Management System (NIIMS) by adding section 9A to the Registration of Persons Act, and extend the data that can be collected during the registration of persons to include personally identifying data such as Deoxyribonucleic acid (DNA) data and global positioning system (GPS) coordinates.

The grounds for the petition were: that the registration process lacked legal basis, the registration process infringes on the right to privacy, Kenya lacks a comprehensive data protection law, and the process would further marginalise persons who have not acquired the primary documents required to register for Huduma Namba.

This blog will give a general overview of the draft bill, highlight the issues, and give recommendations. (In another posting, we will explore the Huduma Namba process in more depth.) It is important to emphasise that the bill released by the Ministry of the Interior was merely a draft and may change prior to introduction in Parliament.

Overview of the Draft Bill

The long title of the bill gives the purposes of the bill. The Bill: establishes the National Integrated Identity Management System (NIIMS), promotes efficient delivery of services, consolidates and harmonises registration of persons, assigns the Huduma Namba and issuance of identity documents, and governs the registration of births and deaths.

The bill has nine parts; part I is the preliminaries, part II is the National Integrated Identity Management System, part III is the Enrolment into NIIMS, part IV is the issuance of passports, part V contains the data protection safeguards, part VI contains the offences and penalties, part VII contains provisions on administration, part VIII contains provisions on delegated powers and part IX contains general provisions of the bill.

From an analysis of the Bill, CIPIT found that the draft Bill severely limits the right to privacy enshrined in Article 31 of the Constitution. In particular the Bill limits Article 31(c) which protects everyone from having their personal and family affairs unnecessarily disclosed.

The draft Bill is a paradigm shift in the registration of persons process, firstly because of the universality of registration and secondly because of the centralisation of all registration systems. Groups advocating for reform to the registration of persons process have pinpointed the exclusion of marginalised groups as a major problem of registration of persons. The Bill recognises this fact in Section 60 and mandates the Cabinet Secretary to develop measure to mitigate on any legal, procedural and social barriers that may limit enrolment, with special attention being paid to any group or persons at risk of exclusion. However, despite the provisions in section 60, the Bill does not sufficiently address the challenges faced by marginalised communities during the registration of persons. This is one of the main arguments made by the petitioners in the lawsuit currently pending against the NIIMS system.

The draft Bill does not explain the rationale behind some of its drastic measures for example, the enrolment of minors through biometrics. The Constitution and laws relating to children seek to protect children and limit their engagement in decisions that have legal consequences. Existing law envisages that children gain access to services through their parents or guardians, but the draft Bill mandates that children are registered (including with biometrics) from the age of 6.

The draft Bill takes the approach of centralising civil registration systems with a new national I.D. (the Huduma Namba), but there is no policy statement explaining the rationale for this shift. The Bill also does not explain the benefits and protections that will be put in place in the civil registries in this new system of registration. These benefits and protections were not explained in the public participation session that was held after release of the Bill.

CIPIT also notes that, according to the memorandum of reasons and objects found at the end of the Bill, it is stated that the Bill does not deal with any matters concerning the County Government and it does not contain any matters affecting the functions of county government. This means that the Bill envisages the registration of persons as a function of the national government exclusively. This view ignores the socio-economic aspects of the registration process, county governments are closer to the people and they offer essential registration services for example notification of births, childhood vaccinations, issuance of burial permits etc. It is also not consistent with other aspects of the Bill of that will certainly involve the counties. For example, the Huduma Namba under the Bill will replace the NHIF number and will become the gateway for receiving health services. 

The Bill also imposes duties on citizens with regard to compliance with the Bill. For example, section 16 provides that every person who is enrolled has a duty to notify the NIIMS registration officer to update the particulars of that individual whenever there is any change in any particular. (Imagine the burden of having to notify the national government every time your phone number changes, or you begin farming a different sized plot of land!)

The draft Bill imposes harsh sanctions for failure to register or for procuring services without a Huduma Namba (part VI of the Bill). Essentially any transaction with the government becomes a crime if done without the Huduma Namba. The Second Schedule states that any person who commits an enrolment offence is liable to face a period of imprisonment not exceeding 5 years or a monetary fine not exceeding 5 million. A legal framework in the spirit of the 2010 Constitution which acknowledges the sovereignty of the people should make a case for the law and convince the citizens to prescribe to it rather than threaten compliance by imposition of sanctions.

General Concerns

Having given an overview of the Bill, it is important to highlight a few additional concerns that CIPIT has with the draft Huduma Namba Bill. The first concern is that the implementation of this registration process is focused too much on technology. The Bill lacks adequate provisions for public education on how the technology that will be the primary anchor for the registration process operates. The Bill also does not provide for enhancing of informed consent with particular reference to the digital demands of the proposed system.

Another concern is the emphasis on the use of fingerprints to enrol or identify an enrolled person. The primary concern here is that biometric information cannot be changed by an individual. If (when?) data is stolen or lost from NIIMS, it will become a nightmare for enrolled citizens, since it is impossible for a person to change their fingerprints. This approach can also prove disadvantageous to persons who, due to the nature of their work, do not have fingerprints. This may limit access to government services because such individuals cannot be enrolled into the system and thus cannot access services highlighted under section 8 of the Bill as a result of them not having a Huduma Namba. For at least these reasons, a PIN-based system would be much more practical and less risky to the average citizen. If a collection of PINs are stolen or lost from NIIMS, it is a relatively simple matter for a citizen to change their PIN and the integrity of their account is restored.

The role that the Principal Secretary (PS) for Interior and Coordination plays in the Bill is of great concern. The Bill grants the Principal Secretary too much power to run and administer the database, for example; the Bill in section 45 grants the Principal Secretary the ability to appoint a data protection officer, section 37 mandates the Principal Secretary with facilitating technologically efficient means to ensure proactive access to personal data, section 25 allows the Principal Secretary to cancel enrolment of any individual into the NIIMS database, section 28 allows the Principal Secretary to designate and facilitate other persons to serve as agents for notification of death or presumed death etc. These raise concerns on accountability and responsibility and therefore there is a need for an independent authority to run and administer the NIIMS database, or at least for greater oversight of the parent ministry in operation of the database.

Another concern is that the Bill does not have explicit and adequate provisions that deal with the protection of the master standard. The master standard is the biometric information which is collected and stored in the database. The importance of the master standard is mentioned above and cannot be overemphasized; where a search is done to identify or authenticate data the search is meant to find the master standard therefore, any compromise on the master standard may lead to the non-recognition of persons enrolled in the database which may result in the denial of essential government services. Also, loss or theft of such biometric identification data can result in fraudulent claims and activities, and it would be very difficult for a citizen to deny such activity. In this matter, we note recent news in which over one million fingerprint records were stolen from a government database in the UK. Centralizing government data and linking ID data to services only increases the value of the biometric data, making such data a bigger target for thieves.

Finally, the Huduma Namba process is occurring at a time when a draft Data Protection Bill is still in Parliament. Numerous attempts have been made to pass such legislation over the past decade, and there is no guarantee that it will be successful in this instance. Although there are provisions in the draft Huduma Namba Bill for data protection, it would be far more ideal to overhaul the national ID system in the context of an operational national Data Protection framework.

Recommendations

Therefore, it is CIPIT’s recommendation that the Huduma Namba Bill should be paused in order to allow for an inclusive lawmaking process which addresses the perennial problems with registration of persons, defines the use cases for digital I.D. and facilitates the achievement of human rights.

Additionally, it is CIPIT’s recommendation that the Bill be paused until Kenya has comprehensive data protection laws in place. As has been pointed out part V of the Bill contains data protection safeguards which are intended to help protect the data that is collected during the registration process. CIPIT commends this effort, however it notes that the provisions of part V are not comprehensive enough to ensure that the data collected will be protected and therefore, there is need to wait for comprehensive data protection laws to be passed before the Huduma Namba Bill is passed. 

CIPIT also recommends that the following seven features be considered before a registration of persons bill is passed;

1. properly define the proposed digital ID system and prioritise issuance of legal identity to those without primary identification documents for registration,
2. properly define the use cases for digital ID and address issues such as access by non-state actors,
3. share information on the design of the system, including vendors and their roles as well as technologies being employed,
4. allow contestations against a centralised database and consider roles for devolved government in achieving birth and death registration,
5. create an independent authority for registration of persons with mandate to resolve non-registration for marginalised groups, protect and promote the privacy of individuals in the database, address grievances and resolve complaints from individuals and public etc,
6. openly discuss the existing registration systems including integrated population registry services (IPRS) to create public understanding of the workings and shortcomings of the system and, 
7. openly discuss all available technology for digital ID (apart from biometrics) to make a case for technologies that best protect and promote human rights.