Digital surveillance and big data: Balancing the rights to privacy and security in Kenya

Abstract

Education, personal identity and democracy fl ourish in private. Generalised surveillance of disenchanted groups stifl es them. Although the African Charter on Human and Peoples’ Rights is silent on the right to privacy, Kenya’s Constitution expressly protects against surveillance abuse. Informed consent is required from data subjects prior to collecting or sharing their personal information. Yet, Kenyan courts have upheld laws and policies introducing generalised surveillance. Th e conundrum confronting Kenya’s judiciary regarding surveillance of mobile telephone data is: If counter-terrorism relies on mass surveillance, such policies necessarily violate privacy rights, in the guise of enhancing security. Nonetheless, enhancing the state’s surveillance capacity to intercept digital communications was accepted by the Court as a justifi able violation of privacy rights. Conversely, in Communication Authority of Kenya v Okiya Omtatah Okoiti, the Court of Appeal observed that globally, the theft of mobile phones and proliferating counterfeit devices have become major regulatory concerns. Problematically, it reversed the High Court’s prohibition on generalised surveillance. Subsequently, in Katiba Institute v Attorney General, the High Court directed the state to conduct a data protection impact assessment as the Data Protection Act requires. In April 2023, the Supreme Court dismissed the Law Society of Kenya’s appeal seeking to stop the CAK embarking on a device management system, which threatens to surveil subscribers. Three conclusions emerge. First, Kenya’s DPA accords absolute governmental power to gather personal data unrelated to national security or suspicion of crime. Second, the Court of Appeal’s Mobile Telephone determination is oblivious to the chilling effect that any generalised surveillance created even on groups that value confidentiality. Third, neither the National Intelligence Services Act nor the Prevention of Terrorism Act protect citizens’ communications from limited interception. It is preferable to introduce similar provisions authorising interception of specific communications in other legislations to facilitate investigation of serious organised crimes.