Data protection remains a pressing concern for Kenyans, especially as authorities increasingly demonstrate the ability to track individuals’ precise location using triangulation technology. Triangulation is a method used to track individuals by determining the location of their mobile phones based on signals from nearby cell towers.
As a phone moves, it constantly connects to the closest towers to maintain a strong signal. By measuring the phone’s distance from at least three different towers based on signal strength or the time it takes for the signal to travel, the phone’s exact position can be calculated. This process allows for precise tracking, especially in urban areas which have many towers.
While triangulation is useful for services such as emergency response and navigation, it raises serious privacy concerns when used without an individual’s knowledge or consent. In Kenya, where surveillance capabilities are increasing, triangulation is frequently exploited by both state and non-state actors to monitor citizens, activists or journalists without proper legal procedures.
This undermines the right to privacy guaranteed by Article 31 of the Kenyan Constitution and the Data Protection Act of 2019.Triangulation typically relies on the cooperation of the telecommunication companies, which by law should only release sensitive data with a valid court order or the explicit consent of the individual.
Electricity token systems
There are claims that authorities are using electricity token systems to track individuals. Each electricity meter number is geo-fenced and registered with ownership and location details. Even if a person does not own the property, regularly paying electricity bills for a specific meter using their mobile number can create a digital association between them and that address.
This allows authorities to figure out someone’s residence. Data is shared among various actors and are combined to determine an individual’s residence, a process that typically occurs without the target’s knowledge.
While this method is less precise than triangulation, it still raises privacy concerns. Both approaches rely on access to personal data held by companies, meaning their cooperation is key and should, by law, require a court order or informed consent.
Safeguarding personal data
While Kenya has taken important steps toward safeguarding personal data most notably through the establishment of the Office of the, Data Protection Commissioner (ODPC) and the enactment of the Data Protection Act, 2019, questions remain about the effectiveness of enforcement and the practicality of the current legal framework.
Due to the State’s failure to enforce strong data privacy protections, the personal information of citizens is widely exposed and vulnerable to misuse. This negligence extends beyond government institutions to the private sector where data handling practices remain weak and largely unregulated, sometimes leading to breaches and eroding public trust.
It is now routine for individuals to receive unsolicited calls from scammers impersonating companies or claiming to be wealthy foreign benefactors. These breaches have not only exposed sensitive personal information but have also led to loss of money through fraud and identity theft. The issue is equally concerning in the political space, where bodies, such as the election boards, have faced accusations of data leaks and unauthorised access to voter information.
To enhance accountability, public-private partnerships must be restructured to prevent unauthorised access and exchange of personal data. Only through clear, enforceable boundaries and stronger oversight can Kenyans be protected from dangers that arise from data misuse.
