The Kenyan government is using technology to improve governance, service delivery and national security. The progress, while welcome, has brought with it concerns about state surveillance, data protection, and violations of fundamental rights and freedoms. Following anti-government protests in Kenya that began in June 2024, for instance, there were several reports of state-led abductions and arbitrary arrests. With Kenyans’ personal data being collected at an unprecedented scale, the balance between ensuring security and safeguarding individual privacy has come under scrutiny. Mugambi Laibuta, who’s studied state surveillance and data protection in Kenya, explores the issue.
What are the legal safeguards for privacy in Kenya?
Kenya’s constitution provides for the right to privacy under Article 31. Its provisions include the right not to have information relating to their family or private affairs unnecessarily required or revealed; or the privacy of their communications infringed.
The constitution says the limitation of any right or freedom ought to be justifiable and fair. The instances under which these limitations may be breached include:
- to prevent and investigate crimes
- during times of natural disasters
- in response to health emergencies.
Three laws spell out the process state agencies must comply with before they can carry out surveillance. The agencies in question are the National Intelligence, National Police Service, and Prevention of Terrorism Acts. The processes include getting authorization from the courts. But such authorization isn’t always obtained.
What’s the current state of government surveillance in Kenya?
Illegal arrests, abductions, and enforced disappearances fuel suspicion that the Kenyan government has been engaged in illegal surveillance.
Telecommunications companies and government agencies have been accused of violating Kenyans’ privacy through unregulated surveillance. Evidence has been provided by international agencies that keep track of state surveillance. For example, in 2017, Privacy International, an organization that promotes the right to privacy worldwide, detailed how Kenyan government agents carried out communications surveillance in contravention of the country’s laws. And Citizen Lab, a research unit at the University of Toronto that studies state surveillance, cited two examples.
In 2018 it published a report about Pegasus Spyware, a mobile phone spyware developed by an Israeli cyber-arms company. The report found that the spyware was conducting surveillance operations in Kenya. Pegasus has the capacity to snoop on all operations and information on a mobile phone.
Another Citizen Lab report in 2020 covered “Circles,” a surveillance firm that reportedly snoops on calls, texts, and phone locations worldwide. The report named the Kenyan government among the firm’s likely customers. Kenya has systems that make it easy to trace individuals.
The Nairobi surveillance system, for instance, has seen thousands of cameras installed across the city since 2014. The cameras have facial and licence plate recognition capabilities. They are managed by the government in collaboration with telecommunications companies Safaricom and Huawei.
The urban surveillance system has helped identify criminal activities. However, there are concerns about whether it adheres to privacy standards.
The government also has access to data about Kenyans from the mandatory registration of mobile phone sim cards. This collects personal identification details, including full names and physical addresses. Additionally, digital payments made for essential services, including electricity, water, education, health, and transport, provide a rich source of data.
What are the risks of unregulated surveillance?
Surveillance by the government without oversight by the courts, parliament, independent offices, or constitutional commissions carries risks. This is also true if there isn’t any accountability to Kenyans or compliance with laid-out procedures.
This makes surveillance susceptible to abuse. Second, the government could easily target journalists, activists, and political opponents, shrinking Kenya’s status as a free and democratic society.
Third, unregulated surveillance violates provisions of the Data Protection Act and the right to privacy. The Data Protection Act provides guidelines on handling personal data and the rights of individuals regarding their data. It also sets out limitations on handling personal information.
Fourth, without sufficient safeguards, the data available to the government could be accessed by criminals and rogue elements, exposing Kenyan citizens to harm.
What steps can Kenyans take to address privacy violations?
There are several. One is to educate themselves on the limits of their privacy rights.
Two, they can file complaints with the Office of the Data Protection Commissioner. The commissioner has made determinations about violations in the handling of personal data, issuing penalties, and awarding damages.
Three, Kenyans can file constitutional petitions at the high court to challenge any surveillance action undertaken against them. The court may apply the proportionality test. This determines whether the need for surveillance outweighs an individual’s fundamental rights and freedoms. It also assesses if there are other less intrusive means to achieve proposed surveillance objectives. As this is an emerging area of litigation, no one has been reported to have successfully sued the government for its surveillance actions on individuals.
Kenya also needs to revise laws that allow for government surveillance and ensure that they comply with constitutional principles. This could include revising the police service, national intelligence, and anti-terror laws, which grant powers to security agents to undertake surveillance.
Essentially, the problem with state surveillance in Kenya is that there aren’t adequate safeguards to protect citizens’ privacy and rights. Surveillance can enhance security and service delivery, but its misuse poses significant threats to democracy, human rights, and public trust.
To address these issues, Kenya must:
- strengthen its legal frameworks by revising certain laws
- enhance transparency
- ensure that surveillance technologies are used ethically and responsibly.
Balancing security needs with privacy rights is not just a legal obligation. It is a cornerstone of sustainable governance and a constitutional democracy.
Dr Mugambi Laibuta is a fellow at Strathmore University. He is a privacy and data protection specialist, an advocate of the High Court of Kenya, a certified information privacy manager, a trained mediator, and a legislative counsel and policy analyst.
Article was first published in The Conversation.
Photo by Tobias Tullius via Unsplash.