Biometric data collection in Kenya risky

An edited version of this article was published in the  Daily Nation on February 21, 2018.

I was buying a sim card when the customer care agent asked me to pose for a photo. I asked why they wanted a photo of me as they had all my personal information including a scanned copy of my national identity card. He mumbled back that government required SIM Card agents to take subscriber’s photos. Not convinced, I probed further on this new law but he could not elucidate the reasons. I later on discovered after reading the Kenya Information and Communications (Registration of SlM-cards) Regulations, 2015 that such a requirement doesn’t exist. The customer care agent either didn’t know the requirements, or lied to me about them.

 

This was not an isolated incident. Every day people give out their biometric data to both state and non-state agencies such as professional bodies, banks and even schools. Despite this mass data collection taking place for a while now, parts of the Kenyan citizenry have always expressed their reservations with the collection of biometric data.

 

During the first biometric voter registration in 2012, rumours were rife in western Kenya region on how fingerprint scans would make it easy for chiefs to arrest petty village offenders. Joseph Kamaru’s rendition of Mau Mau’s song Uhoro Uria Mwaiguire tells of a community mourning the incarceration of their war heros who refused to have their fingerprints taken. This reservation and fear played out recently in 2017 when some Mau Mau veterans raised concerns around biometric voter registration for fear of arrest over crimes they did while fighting for independence. All these show a lingering historical concern on the use of technology that communicates how some feel about the collection and use of biometric data.

In addition, there is currently no data protection law stipulating how personal information like biometric data should be handled and processed by both private and state actors. In fact, the only place where biometrics have been mentioned in Kenyan law is in the Elections Act. According to this legislation, biometrics are unique identifiers or attributes including fingerprints, hand geometry, earlobe geometry, retina and iris patterns, voice waves, DNA, and signatures. Even the abandoned Data Protection Bill of 2013 only contained a mention of fingerprints and blood type which were to be categorised as personal information.

 

Motivation behind collection of data

Data collection is part of know your customer logic, both for efficiency, trust and security. But increasingly, data collection has in itself become the business model of most companies. The value of personal aggregated personal thoughts, habits, and social networks are as valuable as any other high end market activities, witfully branded surveillance capitalism.

 

However, the collection and centralized storage of this highly sensitive and valuable data exposes these corporations to the risk of the data being misused at best and being stolen at worst. There are many reported cases of deliberate targeting of secure systems that hold sensitive data. These sensitive data is later sold to third parties in the black market who have illegal ways to monetize it such as by sale of data to fraudsters and identity theft.

 

In jurisdictions with data protection laws, the general privacy principle for corporations handling consumer data is that data obtained for one purpose shall not be used for any other purpose. This rule has general exceptions such as when the information is public, the data subject has given consent and public interest. However, Kenya has no data protection law which leaves personal information such as biometric data at the mercy of corporations that collect it. Security breaches and data loses are reported regularly in the US and Europe, but in Kenya there is no requirement for public or private sector entities to disclose such occurrences. Thus we don’t even know the risks that we face.

 

For example, during the 2017 general elections, many voters received targeted campaign texts messages that were rather too intrusive. The texts had the name of the voter and the exact constituency where they were registered as a voter. How politicians received access to the voter register and the voters cell-phone numbers remains a mystery to date. But it also shows us how vulnerable we are after subscribing for services where personal information is required, and could be shared with others without our knowledge.

 

One way we can push for accountability is by asking our newly elected parliamentarians to breathe life to Article 31 of the Constitution by legislating a data protection law. We are in dire need of a data protection law that give us, the data subjects, more say on how our personal information is collected and used by data processors. Daniel J Solove argued in his book ‘Conceptualizing Privacy’ that privacy ‘involves more than avoiding disclosure; it also involves the individual’s ability to ensure that personal information is used for the purposes she desires’.

 

Other than just the law, there is need for a legal obligation on data processors to be transparent about what data they are collecting, how will be used and who it will be shared with. This obligation can be based on the tort and crime of misuse of personal information. It will force data processors, such as public and private entities, to take data protection more seriously while protecting the data subject’s right to privacy. While many argue that they have nothing to hide, they should always remember that they have something to protect. Next time you think of buying a SIM Card, remember that you will probably be asked for more personal information than is required and that there is no law governing the use of that information.

Fake news: The battle for clicks

fake news

It is no secret that technology has disrupted the media industry. In the past few years, media houses have downscaled operations, leading to many loss of jobs and have also changed their approach and joined the muddy battle for clicks. Every media house now has an online news blog even though the quality of news that they post leaves a lot to be desired.

In this new age, media houses do not just compete amongst themselves but also against blogs for traffic. As they say, all is fair in love and war. In this war, a huge number of blogs have resorted to posting sensational news so as to get views. This is because higher site views equals to higher ad revenue from online advertisers.

But fake news hasn’t been an issue until the recent US Presidential election when its impact was seen. Whether it has the potential to destroy a candidate or make him, politicians are now keen on social media now than before. One may say that maybe because of their knack for finances (adverts) over news that main media is now losing their credibility. This has created an opportunity for random blogs who rushed to update readers with the latest unbiased news. Unfortunately, this news is usually biased. Social media is set such that the algorithms feed a user with ‘more of what they want’. Hence denying them a chance to access divergent opinions and material posted on the network.

Suggestions have been made world over on the ideal remedy for this menace but in democracies, it is hard because it goes against the principles of free speech. The Canadian Supreme Court has held in a case to strike down a false news provision of law that the provision was contrary to the constitutional freedom of expression.

“The reality is that when the matter is one on which the majority of the public has settled views, opinions may, for all practical purposes, be treated as an expression of a ‘false fact,” the Learned Justices of the Court said.

In Kenya, the law limits the right to freedom of expression to the extent that one is not allowed to spread propaganda for war, incite people to violence, hate speech and advocate for ethnic hate. These limitations also apply to the media according to Article 34. The same constitutional provision also provides for the establishment of the Media Council of Kenya.

One of the roles the drafters of the Constitution envisioned this body to play is setting media standards while regulating and monitoring their compliance. It is with this powers that are expounded on in the Media Act that the Council accredits journalists while requiring them to follow the Code of Conduct for the Practice of Journalism. While the standards on accuracy, integrity and accountability apply to journalists; these standards do not apply to bloggers.

Hence they cannot be held to have breached the Code when they post fake news online. From the angle of defamation laws, some of these stories are not defamatory. Neither do they constitute a breach of Article 33(2). For example the many speeches attributed to Presidents Robert Mugabe and Donald Trump about Kenyans and corruption. If they were to be counter checked against the elements of defamation, they will fail. The statement might be false but not damaging per se, hence not warranting a suit for damages.

Some of the sites are not even within the Kenyan jurisdiction and no claim of damage may be sustained against them

Keeping in mind that this year is an election year in Kenya, the impact of sensational stories laced with ethnic chauvinism is a major concern to all. The Communications Authority of Kenya is already threatening an Internet shut down in the event people spew hate online. Recently, an ‘international’ propaganda website full of fake news on a Kenyan politician was exposed. The writer who hid under the name David Field was discovered to be a Kenyan techie. Even though it did not contain hate, the rising of such sites is a genuine cause for alarm.

Solutions that have been fronted include presentation of scientific evidence and engaging in reasoned arguments. However, the society as a whole finds academics unpalatable overrated. Evgeny Morozov’s solution however is the most reasonable. In his article, Moral panic over fake news hides the real enemy – the digital giants, he writes that the only way we can deal with click baiting fake news is by making online advertising less in our lives, especially at work and in communication.

While people may shun traditional media because of its links to politicians and corporations, they forget that the Internet companies they run to still act the same way. Perhaps the day we finally deny social media and search engines the clout they have in problem solving in all sectors including our politics is the day we will be free from the hazards of fake news online.

Let them cry not in the Range Rover

This article was first published on Nairobi Business Monthly November 2016

Many apply foundation to hide black eyes. Others don shades to hide red eyes. Others fell on the stairs while others just ignore the whole vibe when it is brought up. Author Yvonne Adhiambo Owuor wrote in her book Dust (2013) about the four languages of Kenya: English, Kiswahili, Memory and Silence. We have embraced the former too quick. We refuse to talk about the ghosts that roam in our midst. The words accept and move on are engraved in our hearts. More will die and it will go unreported because of our selective outrage.

Gory images of chopped hands were all over digital media. The outrage was as instant as the middle class knack for tweeting and we saw some action being taken. Same script when musician Koffi Olomide kicked a dancer at the airport. The chap was arrested and deported without being tried, but the message was sent. You cannot assault a woman in public in our world of digital media.

But what about the world where people don’t really care about taking videos? What about that part of Kenya where the chief and pastors have to quell fires amongst couples day in day out? Should official action be a result of digital outrage? Can’t we just develop norms where women, primary victims in gender-based violence, are respected?

Kenya has really good laws that address this vice. The Constitution, Article 28 recognizes a person’s right to dignity and Article 29, recognizes the right not to be subjected to any form of violence from either public or private sources. The Penal Code’s Chapter 26 is on assault, which is basically used in charging perpetrators of gender-based violence.

However, these laws don’t seem to do much in terms of addressing gender based violence. There are two scenarios of this vice: Domestic violence and gender based violence at the work place. The latter is almost never reported because of fear of victimization and unemployment. So a lot of abuse goes unreported and even where there are out in the open, the victims are in too much fear that they apologise for provoking the boss. We saw this play out well when Koffi Olomide’s dancer recorded a video together with the singer to defend his action.

Few years ago, Alassane BA of Shelta Afrique was accused of assaulting staff, Karen Kandie. Upon his arrest, he invoked diplomatic immunity and the court held that he could not be tried in Kenya. This was among the few cases of gender-based violence at the work place that got reported. Unfortunately, Ms Kandie did not get justice.

When it comes to domestic violence, the challenge is that they are majorly crimes of passion.  A common scenario during trial processes of perpetrators is where the complainant withdraws charges so as to secure the release of the accused due to various reasons. In some cases, the perpetrator might be the sole breadwinner and their stay in remand is not doing the family any good. Or maybe the victim has been coerced by the perpetrators relatives to forgive him.  Or in cases where the accused was able to secure their release after paying cash bail, the complainant and accused who most likely still live together will attend court then go back to the same house, or even bed.

In 2015, the Protection against Domestic Violence Act was enacted to provide for the protection and relief of victims of domestic violence. The drafters of law seem to have understood the challenge of prosecuting domestic violence from the protection clauses the Act contains. The act seems to have picked the geist of the Criminal Procedure Code Section 176, which promotes reconciliation in cases of common assault.

The Act is elaborate in its definition of violence and a relationship, which is meant to clear all ambiguities during interpretation. It also obligates the Police Service to have protection mechanisms for victims of the violence. Hence there is no shortage of laws to address this vice.

The silver bullet seems to be in society developing norms where women are respected and protected, where women are viewed and treated as human beings with dignity and not property. Norms where reconciliation between parties in a case of domestic violence is done with the best interests of the victim and not family image.

To get a lasting solution to this vice, religious and community leaders must come together so as to avoid creating conflicting norms. In the recent case of Jackline Mwende, the lady who lost both hands, she narrated how her religious leader encouraged her to stay in the marriage. The vow ‘Till death do us apart’ does not include death induced by one of the partners in the marriage. Hence in their teachings, religious leaders must come out strongly against this vice while working together with security agencies in creating effective protection mechanisms.

We should strongly condemn gender-based violence and unite to eradicate an environment where the vice thrives. While silence is golden, in this case it is a poison that is killing us slowly. Creating an environment where people can speak out should be our priority.
“Of pain you could wish only one thing: that it should stop. Nothing in the world was so bad as physical pain. In the face of pain there are no heroes.” – George Orwell