The Kenyan government is using technology to improve governance, service delivery and national security. The progress, while welcome, has brought with it concerns about state surveillance, data protection, and violations of fundamental rights and freedoms.
Following anti-government protests in Kenya that began in June 2024, for instance, there were several reports of state-led abductions and arbitrary arrests.
With Kenyans’ personal data being collected at an unprecedented scale, the balance between ensuring security and safeguarding individual privacy has come under scrutiny. Mugambi Laibuta, who’s studied state surveillance and data protection in Kenya, explores the issue.
What are the legal safeguards for privacy in Kenya?
The Constitution says the limitation of any right or freedom ought to be justifiable and fair. The instances under which these limitations may be breached include:
To prevent and investigate crimes During times of natural disasters In response to health emergencies.
Three laws spell out the process state agencies must comply with before they can carry out surveillance. The agencies in question are the National Intelligence, National Police Service and Prevention of Terrorism acts.
The processes include getting authorisation from the courts. But such authorisation isn’t always obtained.
What’s the current state of government surveillance in Kenya?
Illegal arrests, abductions and enforced disappearances fuel suspicion that the Kenyan government has been engaged in illegal surveillance.
Telecommunications companies and government agencies have been accused of violating Kenyans’ privacy through unregulated surveillance.
For example, in 2017, Privacy International, an organisation that promotes the right to privacy across the world, detailed how Kenyan government agents carried out communications surveillance in contravention of the country’s laws.
And Citizen Lab, a research unit at the University of Toronto that studies state surveillance, cited two examples.
In 2018 it published a report about Pegasus Spyware, a mobile phone spyware developed by an Israeli cyber-arms company. The report found that the spyware was conducting surveillance operations in Kenya.
Another Citizen Lab report in 2020 covered “Circles”, a surveillance firm that reportedly snoops on calls, texts and the location of phones around the globe. The report named the Kenyan government among the firm’s likely customers.
The Nairobi surveillance system, for instance, has seen thousands of cameras installed across the city since 2014. The cameras have facial and licence plate recognition capabilities. They are managed by the government in collaboration with telecommunications companies Safaricom and Huawei.
The urban surveillance system has helped identify criminal activities. However, there are concerns about whether it adheres to privacy standards.
The government also has access to data about Kenyans from the mandatory registration of mobile phone sim cards. This collects personal identification details, including full names and physical addresses. Additionally, digital payments made for essential services, including electricity, water, education, health and transport, provide a rich source of data.
What are the risks of unregulated surveillance?
Surveillance by the government without oversight by the courts, parliament, or independent offices or constitutional commissions carries risks. This is also true if there isn’t any accountability to Kenyans or compliance with laid out procedures.
First, this makes surveillance susceptible to abuse. Second, the government could easily target journalists, activists and political opponents. This shrinks Kenya’s status as a free and democratic society.
Third, unregulated surveillance violates provisions of the Data Protection Act and the right to privacy. The Data Protection Act provides guidelines on handling personal data and the rights of individuals regarding their data. It also sets out limitations on handling personal information.
Fourth, without sufficient safeguards, the data available to the government could be accessed by criminals and rogue elements, exposing Kenyan citizens to harm.
What steps can Kenyans take to address privacy violations?
Two, they can file complaints with the Office of the Data Protection Commissioner. The commissioner has made determinations about violations on the handling of personal data, issuing penalties and awarding damages.
Three, Kenyans can file constitutional petitions at the high court to challenge any surveillance action undertaken against them. The court may apply the proportionality test. This determines whether the need for surveillance outweighs an individual’s fundamental rights and freedoms. It also assesses if there are other less intrusive means to achieve proposed surveillance objectives. As this is an emerging area of litigation, no one has been reported to have successfully sued the government for its surveillance actions on individuals.
There is also a need for Kenya to revise laws that allow for government surveillance and ensure that they comply with constitutional principles. This could include a revision of the police service, national intelligence and anti-terror laws. They grant powers to security agents to undertake surveillance.
Essentially, the problem with state surveillance in Kenya is that there aren’t adequate safeguards to protect citizens’ privacy and rights. Surveillance can enhance security and service delivery. But its misuse poses significant threats to democracy, human rights and public trust.
To address these issues, Kenya must:
Strengthen its legal frameworks by revising certain laws Enhance transparency Ensure that surveillance technologies are used ethically and responsibly.
Balancing security needs with privacy rights is not just a legal obligation. It is a cornerstone of sustainable governance and a constitutional democracy.
Mugambi Laibuta is a Fellow at Strathmore University and a member of the Law Society of Kenya and the Data Privacy and Governance Society of Kenya.
