Katiba Institute & Yash Pal Ghai challenge to the Huduma Namba digital-ID rollout before the Kenyan High Court (2019–2021)

On 18 November 2020 the Kenyan Cabinet Secretary for Information, Communications and Technology, Joe Mucheru, announced the rollout of Huduma cards — the physical instantiation of Huduma Namba, the unique national identification number assigned by the National Integrated Identity Management System (NIIMS) on the basis of mass biometric and demographic data collected from Kenyan residents during a 2019 enrolment exercise. Within days Katiba Institute and its co-founder, the constitutional scholar Yash Pal Ghai, filed an application for judicial review before the Constitutional and Human Rights Division of the High Court at Milimani, Nairobi, seeking orders to quash the rollout decision and compel the government to conduct a prior data-protection impact assessment under section 31 of the Kenya Data Protection Act 2019. The case was registered as Judicial Review Application E1138 of 2020, with the title Republic v Joe Mucheru, Cabinet Secretary Ministry of Information Communication and Technology & 2 others; Katiba Institute & another (Exparte); Immaculate Kasait, Data Commissioner (Interested party). The application sat inside a broader civil-society litigation register against the Huduma Namba programme — a register that had begun in early 2019 with separate petitions filed by the Nubian Rights Forum and other groups against the underlying NIIMS data-collection exercise — but pivoted the legal centre of gravity from the constitutional Article 31 privacy claim that the earlier petitions pressed onto the statutory section 31 DPIA-requirement claim that Katiba Institute pressed.

The section 31 argument and the retrospectivity question

Section 31 of the Kenya Data Protection Act 2019 requires that, where a processing operation is likely to result in a high risk to the rights and freedoms of a data subject, a data-protection impact assessment must be carried out before the processing begins. Katiba Institute's central submission was that the issuance of Huduma cards — each tied to the biometric and demographic record held about its holder in the NIIMS database — constituted exactly such a high-risk processing operation, and that no DPIA had been conducted before either the underlying NIIMS data collection in 2019 or the Cabinet's November 2020 rollout decision. The respondents — the Cabinet Secretary, the Principal Secretary for Immigration and Citizen Services, and the Attorney General — argued that the Data Protection Act could not be applied to NIIMS because the mass-enrolment exercise that populated NIIMS had been conducted in early 2019, before the Act came into force on 25 November 2019, and that the Act could not be applied retrospectively to a data-processing operation already in being.

It was on this retrospectivity question that the case turned, and on which it set the precedent that has anchored its standing as a digital-rights ruling beyond Kenya. The Office of the Data Protection Commissioner, Immaculate Kasait, was admitted as an interested party, supporting the applicants on the statutory construction of section 31. Katiba Institute's reply argued — and the Court accepted — that the Act gives effect to the constitutional right to privacy under Article 31 of the Kenyan Constitution, which had existed since the Constitution's adoption in 2010 and which continued to bind the state irrespective of when the legislation operationalising it had been enacted. The state could not, the argument ran, evade the section 31 requirement by the temporal accident of having begun a data-processing operation that would otherwise trigger the requirement in advance of the requirement's statutory commencement.

The 14 October 2021 ruling

On 14 October 2021 Hon. Justice Jairus Ngaah delivered the High Court's judgment ([2021] KEHC 122 (KLR)) in favour of the applicants. The Court issued two of the three orders sought: an order of certiorari quashing the Cabinet Secretary's 18 November 2020 decision to roll out Huduma cards on the ground that the decision was ultra vires section 31 of the Data Protection Act 2019, and an order of mandamus compelling the respondents to conduct a data-protection impact assessment under section 31 of the Act before any further processing of NIIMS data or further issuance of Huduma cards. On the retrospectivity point, Justice Ngaah held that "since the state chose to put the cart before the horse, so to speak, it has to live with the reality there now exists legislation against which its actions must be weighed irrespective of when they were taken" — the formulation that has, in the academic legal commentary on the ruling, anchored its title and its travel beyond Kenya as a precedent on the retrospective reach of post-hoc data-protection statutes against pre-existing state data-processing operations.

The government's appeal and the DPIA compliance

The government filed a notice of appeal and, on 27 October 2021, applied to the Court of Appeal for a stay of execution of the High Court's orders pending the substantive appeal — Civil Application E373 of 2021, Mucheru & 2 others v Katiba Institute & 2 others. While the stay application was pending, the Ministry conducted the data-protection impact assessment that the High Court's mandamus had compelled, and confirmed completion of the DPIA in a letter dated 12 January 2022 placed before the Court of Appeal. On 4 March 2022 the Court of Appeal ruled ([2022] KECA 386 (KLR)) that the mandamus had been complied with and that the stay application was, on the mandamus limb, moot. The certiorari quashing the 18 November 2020 rollout decision stood. The DPIA itself was conducted but, as Kenyan digital-rights commentators noted, the assessment document was not published.

Aftermath: the abandonment of Huduma Namba and the transition to Maisha Namba

The legal victory effectively prevented any large-scale recommencement of Huduma-card issuance under the Jubilee government of Uhuru Kenyatta during the remainder of its term. After the August 2022 general election the incoming Kenya Kwanza administration of William Ruto abandoned the Huduma Namba programme — which had been launched at a reported cost of approximately Sh10 billion (USD 95 million) — and announced the Maisha Namba digital-ID system as its replacement at a further reported cost of Sh1 billion. Kenyan digital-rights organisations have continued to press data-protection and inclusion-policy concerns against the Maisha Namba programme — and Katiba Institute itself returned to the same constitutional ground in the later judicial review of the Maisha Namba pilot, Republic v Kithure Kindiki, Cabinet Secretary Interior & Coordination of National Government & another; Katiba Institute (Exparte); Office of Data Protection Commissioner & 3 others (Interested Parties) — but the substantive precedent of the Huduma Namba ruling has held: the Act's section 31 DPIA requirement is now an established threshold for any Kenyan state automated-data-processing system, and the constitutional retrospectivity reasoning has held against the state's structural temptation to characterise pre-existing systems as outside the Act's reach.

Significance for the broader AI-good movement

The Huduma Namba campaign is the corpus's first Kenyan civil-society strategic-litigation campaign against a state biometric automated-decision-making system, and the case lineage from which Katiba Institute's subsequent algorithmic-accountability interventions — its role as the third named petitioner in the Tigray Facebook hate-speech petition (Petition E541 of 2022, on which Foxglove describes Katiba as "Kenya's preeminent legal organisation set up to defend the Kenyan Constitution") and its admission as an interested party in the consolidated Motaung and 185-moderators Meta content-moderation petitions — descend. The case sits in the corpus alongside the continental-European public-administration algorithmic-litigation register — the La Quadrature du Net coalition challenge to the CAF / CNAF risk-scoring algorithm before the Conseil d'État — and the Anglosphere welfare-algorithm strategic-litigation register — Foxglove and GMCDP's DWP General Matching Service file, Foxglove and JCWI's visa-streaming case, and Foxglove and Ofqual on the A-level standardisation algorithm — as the corpus's African anchor for the same broader strategic-litigation register: civil-society public-interest claimants pressing constitutional and statutory data-protection arguments to subject state-deployed large-scale automated-decision-making systems to court scrutiny.

Its distinct features within that register are three. First, on the underlying technology: the system at issue is a biometric national-identification database rather than a risk-scoring or fraud-detection algorithm, broadening the strategic-litigation register beyond welfare-and-benefits administration into the foundational digital-identity layer on which downstream public-administration automated-decision-making systems are built. Second, on the legal vehicle: the application turned on a statutory DPIA requirement — section 31 of a 2019 data-protection statute — rather than on judicial-review and equality-act arguments, opening a statutory-data-protection register that the UK welfare-algorithm cases (operating under judicial review and the Equality Act 2010) could not. Third, on the retrospectivity precedent: the ruling's reasoning that a post-hoc data-protection statute can be applied to pre-existing state data-processing systems, on the ground that the statute gives effect to a pre-existing constitutional right, is the corpus's load-bearing African-jurisprudential anchor for the broader strategic-litigation argument that the gradual passage of national data-protection legislation should be brought to bear on the legacy automated-decision-making systems that pre-date it, rather than allowed to take effect only prospectively against new systems.