Institution Mapping Consultancy
September 18, 2023Traditional Weather Forecasting Policy Brief
November 9, 2023SUBJECT: PUBLIC PARTICIPATION ON DIGITAL IDENTITY.
TITLE: MEMORANDUM ON IMPLEMENTATION OF DIGITAL I.D.
TO: PRINCIPAL SECRETARY,STATE DEPARTMENT FOR IMMIGRATION AND CITIZEN SERVICES, MINISTRY OF INTERIOR AND NATIONAL ADMINISTRATION.
FROM: COALITION OF CIVIL SOCIETY ORGANIZATIONS DATE: 25/09/2023
Dear Sir,
We the undersigned civil society coalition partners present this memorandum with regard to the planned rollout and implementation of digital identity systems in Kenya as directed by H.E William Samoei Ruto and the National Digital Identity Technical Committee (NDTIC) on the 30th of June, 2023. We first address our concerns about the government’s failure to engage citizens and allow for meaningful public participation. We then restate our position that a revised national ID can be of significant benefit if it is designed in a way that is responsive to public concerns, protects privacy, and helps eliminate (not replicate) the discrimination and inequity inherent in the existing system. We then place our concerns in context by addressing previous attempts to develop a digital ID and the unaddressed flaws in the existing legislation relating to national IDs. Finally, we once again present our recommendations for ensuring a successful, rights-promoting, and anti-discriminatory digital ID system. As noted below, we do not believe the government intends to substantively address these comments in the four days between our submission and the rollout of the new system, termed “Maisha Namba”, but we remain committed to advocating for these essential, minimum requirements.
Insufficient Public Participation and Citizen Engagement
At the outset, it is important to note that this memorandum can only provide a broad-based comment about the planned rollout. Although the NDTIC has indicated that it has developed draft proposals and white papers, it has not shared these with the public. Without substantive information about this new iteration of the digital ID, now termed ‘Maisha Namba’, we are not able to provide meaningful public participation, other than to restate our consistent position regarding the minimum requirements for a digital ID system, the potential risks and recommendations for avoiding those risks, and the need for meaningful public participation throughout the process. This most recent request — to provide comments on a digital ID system for which we have limited substantive information — is a sign that, in fact, the government is not committed to meaningful public participation and, accordingly, has not taken seriously those concerns that have been raised by the undersigned since the last, failed attempt to create a digital ID.
The undersigned considered not responding to this last-minute request. Given that the government has not published or publicised new, substantive information to respond to, requested that a response be submitted in less than a week, and plans to roll out the Maisha Namba four days after this memorandum is submitted, we realise that the government has no intention to substantively consider our comments. Moreover, we remain concerned that the government will improperly attempt to turn our efforts to address the fundamental failings in the process as evidence of meaningful public participation. Yet, we remain focused on our goal of ensuring the adoption of a national ID that is inclusive. We take this opportunity to remind the NDITC of our consistent position and the government’s prior commitments. This memorandum, however, is not — and could not be — a response to the NDTIC’s call for comments on the new Maisha Namba, since the details of that new system have not been shared with the public.
The government still has an opportunity to allow meaningful public participation, if it is committed to doing so. It needs only publish and publicise the information on which it seeks comments, actively engage the public, provide sufficient time for people to raise their concerns, and then substantively address those concerns. Any rollout that has not first followed this process is not consistent with the national values and principles of good governance and will inevitably fail to fully anticipate or prevent the harms that a digital ID presents. It will also fail to garner the public support and understanding that are essential for the project’s success. Sharing information and meaningful public participation are not unnecessary burdens; they are essential to the ongoing success of the Maisha Namba. Investing the time and resources now will save time and resources later and, most importantly, ensure that the Maisha Namba is not another false start, but rather a program that improves lives, protects privacy, and eliminates long-standing discrimination.
Our Position on the Importance of a Revised and Improved Identification System
We have consistently maintained that it is important for the government to make changes that better the lives of its citizens. Digitizing government services may be an important change for the better; yet it has an equally likely risk of harming Kenyans, entrenching discrimination, and excluding large swaths of the population from services they need and deserve. If the Maisha Namba is going to better lives, the government must understand the lives of those it will affect and the possible risks to human rights and day to day lives of the people these systems seek to govern.
We learned from the similar, largely flawed, and poorly rolled out Huduma Namba, that the digital identity system in Kenya must be inclusive, human rights-centered, and designed in a manner that anticipates the risks a digital ID creates. We hope that the government has learned these lessons, as well and incorporates past learning in a transparent manner. The question remains; will these digital identity systems be inclusive or merely a replication of the mistakes made in the implementation of the Huduma Namba project? Because the NDTIC has not shared its proposal for the Maisha Namba, the prospects for an inclusive system that is responsive to the public’s needs remain dim.
We laud the government’s attempt to fill the gaps that prevent Kenyans from accessing vital government services. However, as Huduma Namba taught us, the process taken to fill those gaps is essential to the Maisha Namba’s success. Although it takes time and resources, consistent civic engagement and meaningful responses to citizen and civil society concerns will ensure that the attempt is a success, not just the Huduma Namba debacle under a different name.
Although, as noted, we cannot provide meaningful comments on the substance of the Maisha Namba because substantive information has not been publicly shared, we can highlight the history that explains why previous attempts have failed, the gaps in the existing legislation that must be addressed, and the minimum design requirements necessary for a digital ID system. For these comments to be meaningful, however, the government must put a pause on the intended roll out and invest in the collective knowledge of its citizenry. It must take the time to gather their lived expertise to design a system that both responds to their needs and protects and promotes their fundamental rights and freedoms.
Background on attempts to create a digital ID in Kenya.
1. In 2018, Kenya introduced the National Integrated Information Management System
(NIIMS). Termed “single source of truth”, due to its intention to consolidate Kenyans’ data. NIIMS was introduced through changes made to the Registration of Persons Act through Statute Law (Miscellaneous Amendments) Act No. 18 of 2018.
2 The initial implementation of NIIMS required individuals to provide extensive personal information, including biometrics, to generate a unique identifier, known as the Huduma Namba. If implemented as planned, the Huduma Namba was intended to serve as an individual’s primary identifier and be required to access Kenyan government services and other aspects of Kenyan society. It is mainly for these reasons that any exclusion from the system risked wide-ranging consequences.
3 NIIMS and the Huduma Namba were marred by flaws, including a lack of civic engagement, a failure to fundamentally understand the risks inherent in a digital identification system, and, ultimately, by court judgments halting its implementation. The rushed roll out, the failure to engage citizens, and the failure to anticipate the potential harms of the system resulted in a waste of time, money, and resources without affecting a single policy change.
4 On the 30th of June, 2023, H.E William Ruto took up the issue of a digital ID. He gave two of his Ministries — Interior and National Administration and Information, Communication and Digital Economy — 90 days to revive and roll out a digital identity card in Kenya.
5 Following the directive, the two ministries, in consultation with the relevant government agencies, established the National Digital Identity Technical Committee (NDITC) to develop an implementation framework and a roadmap for the realization of a Digital ID and a supporting ecosystem.
6 The NDITC subsequently came up with draft proposals on the name and features of the proposed Digital ID and the key enablers for its implementation. Although those draft proposals have never been shared with the public, a Notice issued on 19/09/2023 summarised them as including:
- A Unique Personal Identifier (UPI), which is assigned to each individual that will serve as the personal identity number from birth to death.
- A ‘3rd Generation’ ID card that will include the UPI replaces the existing ID. The card will feature a digital encryption chip and other enhanced security features.
- Digital ID: This will be a tamper-proof virtual means of identifying registered persons through their smart mobile phones or other digital-enabled gadgets.
- TheNational Master Population Register: This will consolidate existing registration databases into a single integrated register for all data on Kenyans and foreigners resident in the country.
7 On 14th August 2023, the government of Kenya and the United Nations Development Program (UNDP) signed a Memorandum of Understanding (MOU) that effectively set the stage for the rollout of digital identity in Kenya dubbed “MAISHA NAMBA”. The substance of this MOU has not been disclosed to the public and we are unable to comment on what assistance the UNDP will provide.
Background on existing litigation.
8 The government is aware of the challenges posed by the Huduma Namba, which are clearly set out in court decisions and pending litigation.
9 In a decision delivered on 30 January 2020 on the implications of the amendments to The Registration of Persons Act to introduce NIIMS, the High Court required that the Huduma Namba process be halted. It noted failures in ensuring that the Huduma Namba protected the right to privacy, found that certain information collected by the NIIMS system, namely DNA and GPS coordinates, was superfluous, and held that additional security and data protection frameworks needed to be implemented before the Huduma Namba could go into effect.
10 The Court also found “a segment of population” was at risk of exclusion and ordered the government to establish a comprehensive regulatory framework that addresses this risk, focusing on how Kenyans without access to identity documents and people with poor biometrics (e.g., unreadable fingerprints) would be enrolled.
11 A later attempt to roll out NIIMS without first addressing the concerns raised by the High Court led to additional litigation. Once again, the courts stopped the process, finding that the government had failed to meaningfully respond to the flaws that had been identified in the previous judgment and reiterating that the process could not continue unless those flaws were addressed.
12 Because the government has not shared any substantive information about the Maisha Namba, it is not clear whether the flaws twice-identified by the courts have been addressed in this latest iteration.
13 It is not clear whether the NDTIC has completed a digital impact assessment, as required by the court judgments and the Data Protection Act. What is clear, however, is that if a data protection impact assessment has been done, the NDTIC has yet to share it with the public, even though such information is critically important to all citizens.
Key issues.
Discrimination and exclusion.
14 It is not in dispute that certain groups and ethnicities have faced discrimination and challenges in access to identity documents. NIIMS failed to address this historical and ongoing discrimination and, as a result, threatened to replicate it in digitized form. Although the discrimination and exclusion of millions of Kenyans from access to national identifications and the rights and resources the provided has a long history and many causes, the failings listed below must be addressed by any national identification system:
15 Kenya has not sufficiently invested in registering minorities or members of marginalized communities, particularly in Northern Kenya, Coastal Kenya, and other rural areas. This is evident in the scarcity of registration centres with citizens having to travel long distances in order to access them. The resultant effects are a large population of unregistered individuals. The systemic exclusion of these individuals has meant that they have never been registered, been provided with a national identity, or given full access to government services. The decades-long discrimination has created multi-generational disenfranchisement and ensured that millions have been unable to fully participate in the integrated social and economic life of Kenya as a whole.
16 Of course, the 2010 Constitution requires that any government policies protect marginalised communities and attempt to rectify such historical injustices and discrimination. The Maisha Namba is no exception. Any digital identity will have to openly acknowledge the historical discrimination and its consequences. It must provide a clear policy framework for protecting marginalised communities and actively incorporating them into the registration process. And it must provide information on how this policy will be funded and implemented. And, consistent with the government’s constitutional
mandate, it must work closely with the communities that have historically been excluded to develop an equitable and inclusive system. The process must take into account the breadth and depth of the historical marginalisation, including the lack of critical infrastructure, inadequate health care, government mistrust, and endemic poverty. A failure to comprehensively and inclusively address these historical injustices will only ensure that the Maisha Namba replicates and exacerbates the existing inequity.
17 The current process for acquiring a national ID includes “secondary vetting” for some applicants based on ethnicity or religion. This burdensome and discriminatory vetting process delays or prevents people from acquiring their rightful documentation. Vetting has left room for arbitrary and discriminatory practices in the issuance of identity documents. The vetting is applied to certain groups regardless of the strength of an applicant’s supporting documentation, such as the submission of the applicant’s birth certificate and parents’ identity cards which could easily be verified as genuine by the government department that issued the documents. Many Kenyans have spent 5, 10 or even 20 years applying for documentation without a resolution. Whether by design or by result, secondary vetting has, for decades, prevented people of certain ethnic and religious backgrounds from obtaining identifications and . Adopting the Unique Personal Identifier/Maisha Namba without first addressing the discrimination inherent in the registration system poses risks to Kenyan communities who struggle to obtain identification. Kenyan citizens including the Nubians, Kenyan Somalis, Swahilis, Borana, Kenyan Arabs and Asians, and many others experience widespread and systemic discrimination in applying for and obtaining national IDs. As a result of this systemic discrimination, many Kenyans are unable to acquire identification or acquire identification on a severely delayed basis. These difficulties hamper the right to work, the right to education, the right to own property, and the right to movement, and affect access to government services such as subsidies for food, access to the Courts, and healthcare. It is imperative that prior to the implementation of a digital identity system, the ‘secondary vetting’ systemic and any policies or practices that have a discriminatory impact are abandoned and affirmative steps are taken to actively include those who have been disenfranchised by the discriminatory processes.
18 One of the major concerns raised by these communities is that when applying for an ID card they are subjected to vetting.The fact that ID registration is continuous does not address exclusion. The proposal that the Master Population Register will be based on existing registration databases means anyone who has not been able to acquire
documentation will similarly be excluded from the proposed digital ID system. Measures must include an end to the vetting process as well as affirmative action to issue documents to Kenyans who have been unable to obtain the same due to the historical existence of vetting over the past several decades and the extension of exclusion from one generation to the next. These measures will ensure that any transition to digital identity is more accessible and inclusive.
19 There are groups of persons that due to systemic challenges with access to identity are at the constant risk of statelessness and exclusion from a variety of rights and services. This situation is bound to be exacerbated by the introduction of a digital identity system without addressing the issues at hand in the current identification system.
20 The Unique Personal Identifier/Maisha Namba, as proposed, risks excluding victims of double registration, violating their right to nationality and further restricting their access to critical State services. The phenomenon of double registration in Kenya stems largely from the early 2000s, when the United Nations High Commissioner for Refugees (UNHCR) registered the biometric data of approximately 40,000 individuals that had entered refugee camps in North-eastern Kenya. Registered individuals included Kenyan nationals, who entered the camps for a variety of reasons, including access to basic needs unavailable to host communities, such as food and medical assistance, or to support relatives in the camp. Individuals born in the refugee camp to a Kenyan parent were also registered in the refugee database. Because these individuals were already registered in the refugee database, many of these individuals were subsequently rejected when they applied for Kenyan national IDs at age 18. Without access to the Kenyan nationality to which they are entitled or access to nationality elsewhere, double registered individuals are at the risk of statelessness.
21 It is therefore imperative that prior to the implementation of a digital identity system, the Government ensures that the system is reflective of the aim to rectify past injustices in the accessing of identity documents by ensuring the consideration and inclusion of marginalized groups.
System design.
22 In the previously attempted rollout of the Huduma Namba the government had proposed to build a centralized database that was to be a “single source of truth”. It is however important to acknowledge the risks associated with a centralized digital identity system and the implications of the same on citizens’ privacy.
23 The recommended best practice for digital identity systems are siloed data sets to mitigate the impacts on citizens privacy in case of data breaches.
24 Article 31 of the Constitution of Kenya provides for the right to privacy. A centralized data system threatens to infringe on this right.
25 The centralized nature of NIIMS raised questions as to the safety of citizens’ data. This was particularly pertaining to the risks of a system that sought to centralize citizens’ data and create what the government termed as “the single source of truth” .
26 The centralization of data coupled with the fact that there were no regulations set in place to govern the said digital identity system left a gap for arbitrary access to a centralized system.
Recommendations.
27 A ruling of the court made on January, 30, 2020 shed light on the nature of the data collection process for the implementation of NIIMS. It highlighted that the process was flawed due to the lack of an adequate data protection impact assessment. It would therefore be a prudent gesture for the government to ensure that it seeks out citizens’ consent prior to the use of the data in future or the deletion of said data.
28 The government should conduct a comprehensive data protection impact assessment prior to the implementation of a digital identity system as set out in the Data Protection Act, 2019.
29 Acknowledging the gravity of a change in registration of persons, it is important that a robust regulatory framework be set in place to govern the proposed digital identity systems. Such a framework should be created through robust, nationwide and meaningful public participation. This will ensure that there are proper guidelines that speak to; access to citizens’ data, governing bodies, procurement processes and steps taken to ensure that data protection principles are upheld.
30 To ensure inclusion, prior to the implementation of a digital identity system, the government must end the vetting process for national identity cards and implement affirmative action measures to issue documents to all Kenyans who have been unable to
obtain the same due to the historical existence of vetting and underinvestment in registration services in many areas of Kenya over the past several decades. The identification acquisition process must also be grounded in legislation and shall not provide for discretionary powers to trigger ad hoc investigations or committees.
31 Privacy by design will play a huge part in ensuring that technology adopted for governance is at its core centered around protection of citizens’ data. This can only be attained by ensuring that the system is decentralized.
32 Bearing in mind the historical injustices of past and current identification systems and the far-reaching nature of identification systems and processes, the government carries out a comprehensive Human Rights Impact Assessment to identify potential violations of people’s human rights and reflect on remedies and mitigations to these issues, including instituting measures to address historical challenges in access to identification.
33 Human rights impact assessments (HRIA) are a systematic review of a proposed legislation or project’s impact on human rights and compliance with international human rights obligations prior to implementation. An effective HRIA would allow the Kenyan government to ensure compliance with its international legal obligations, improve the efficacy of digital ID systems, and minimize the risks of litigation that plagued the Huduma Namba and digital ID systems in other jurisdictions
34 Given the impact of digital ID on all aspects of Kenyan lives, an effective HRIA would allow for the initial provision of information to the public, time for comment, subsequent revisions, and additional comments.
35 Inclusion of civil society and members of the public, including minorities and marginalized communities in line with Article 56 of the Constitution of Kenya, 2010, in any relevant working groups or committees, including the National Digital Identity Technical Committee and National Steering Committee for Digital Identity is vital.
36 Transparency in the procurement of technology behind the digital identity system will be vital to ensure the protection of citizens’ data and trust in the system. There is a need for the publication of contracts in relation to the digital identity system. It is to be noted that one of the main concerns around NIIMS was the nature of regulatory compliance foreign companies handling vital citizens’ data would be subjected to.
Conclusion.
Whilst the government has expressed a willingness to take input through engagement with Civil Society and the admissions on the faults of NIIMS, it is imperative that a reflection is made on the implications of a digital identity system that is not Human rights – centred in design.
Transparency and due process from the government in the rollout of Unique Personal Identifier/ Maisha Namba will therefore play a key role in gaining citizens’ trust and enabling inclusive digital public infrastructure.
SINCERELY,
HAKI NA SHERIA INITIATIVE
NUBIAN RIGHTS FORUM
ACCESS NOW
NAMATI KENYA
KATIBA INSTITUTE
PASTORALIST RIGHTS AND ADVOCACY NETWORK (PARANET)
CENTRE FOR MINORITY RIGHTS DEVELOPMENT (CEMIRIDE)
