Digital surveillance and big data: Balancing the rights to privacy and security in Kenya

Summary

Education, personal identity, and democracy flourish in private spaces. Generalized surveillance of disenchanted groups stifles these fundamental elements of a free society. Although the African Charter on Human and Peoples' Rights is silent on the right to privacy, Kenya's Constitution expressly protects against surveillance abuse. Informed consent is required from data subjects prior to collecting or sharing their personal information. Yet, Kenyan courts have upheld laws and policies introducing generalized surveillance. The conundrum confronting Kenya's judiciary regarding surveillance of mobile telephone data is this: if counter-terrorism relies on mass surveillance, such policies necessarily violate privacy rights, in the guise of enhancing security. Nonetheless, enhancing the state's surveillance capacity to intercept digital communications was accepted by the Court as a justifiable violation of privacy rights. Conversely, in Communication Authority of Kenya v Okiya Omtatah Okoiti, the Court of Appeal observed that globally, the theft of mobile phones and proliferating counterfeit devices have become major regulatory concerns. Problematically, it reversed the High Court's prohibition on generalized surveillance. Subsequently, in Katiba Institute v Attorney General, the High Court directed the state to conduct a data protection impact assessment as the Data Protection Act requires. In April 2023, the Supreme Court dismissed the Law Society of Kenya's appeal seeking to stop the CAK from embarking on a device management system, which threatens to surveil subscribers. Three conclusions emerge. First, Kenya's DPA accords absolute governmental power to gather personal data unrelated to national security or suspicion of crime. Second, the Court of Appeal's Mobile Telephones determination is oblivious to the chilling effect that any generalized surveillance creates, even on groups that value confidentiality. Third, neither the National Intelligence Services Act nor the Prevention of Terrorism Act protects citizens' communications from limited interception. It is preferable to introduce similar provisions authorizing interception of specific communications in other legislations to facilitate investigation of serious organized crimes.

Keywords

digital surveillance, big data, privacy rights, Kenya, Data Protection Act, chilling effect, group privacy

Preview