Huduma Namba Season 2? assessing the adequacy of Kenya’s legal framework in protecting children’s privacy in the Maisha Card digital identity system

Abstract

This study examines the implications of Kenya’s digital identity systems, particularly the Maisha Card or Unique Personal Identifier (UPI), on children’s right to privacy. It highlights the inadequacy of Kenya’s legal framework in addressing risks such as identity theft, profiling, and mission creep. Key research questions include the potential consequences of failing to protect children’s privacy, the adequacy of Kenya’s legal protections, and lessons from the EU’s GDPR. Using a qualitative approach, this study analysed Kenyan laws, including the Constitution, the Data Protection Act, and the Children’s Act, alongside case law and GDPR provisions. The findings reveal that while Kenya’s legal framework provides foundational protections, it lacks critical child-specific safeguards, such as Children’s Rights Impact Assessments (CRIAs) and detailed provisions for protecting children’s biometric data. The study also highlights gaps in institutional coordination between the Office of the Data Protection Commissioner and child protection bodies, which hinder a unified approach to safeguarding children’s privacy. The study recommends legal reforms to align Kenya’s framework with international best practices, including child-specific data protection measures and promoting data literacy. These reforms are critical to ensuring digital identity systems uphold children’s privacy rights and mitigate risks associated with datafication.

Keywords: Digital identity, children’s privacy, data protection, GDPR, Kenya.