Data Protection Act Amendment in the Finance Bill is classic “big brother”, illegal and must be rejected by the National Assembly and Kenyans


Nairobi, 23 May 2024: Amnesty International Kenya and ARTICLE 19 Eastern Africa express deep concern with Clause 63 of the Finance Bill (2024), which seeks to exempt the Kenya Revenue Authority from the provisions of the Data Protection Act. We strongly urge the National Assembly to reject this proposed amendment of the Data Protection Act, informed by the several considerations below.

While we acknowledge that it is international practice for a law to contemplate exemptions to data protection laws, these limitations must meet the criteria laid down under Article 24 of the Constitution of Kenya. The proposal to exempt disclosures necessary for tax assessment, enforcement, or collection from the provisions of the Data Protection Act 2019 must be viewed as a limitation of the right to privacy.

Article 24 provides for the limitation of rights and fundamental freedoms in Kenya. It requires that any limitation to fundamental rights and freedoms be reasonable and justifiable in an open and democratic society based on human dignity, equality, and freedom, considering all relevant factors. Simply, for the right to privacy to be limited, it still must satisfy the criteria laid down in the Constitution.

A blanket exemption for disclosures necessary for assessment, enforcement, and tax collection will undermine our growing data privacy culture in Kenya. If the current ambiguous wording is retained, blanket exemption from data protection will be prone to abuse by the current administration and future administrations.

This ambiguity does not satisfy the principle of legality. The courts have severally determined that laws, especially those that limit fundamental rights and freedoms, must be clear enough to be understood and precise enough to cover only the activities connected to the law’s purpose. Moreover, the extent of disclosures is not well defined, which risks invalidity as the amendment does not specifically express the intention to limit Article 31 as required by Article 24 of the Constitution.

Consequently, Amnesty International Kenya and ARTICLE 19 Eastern Africa reiterate the current legal position under the Data Protection Act (2019) that all State agencies, including those responsible for tax administration, are bound by the general rules of data protection, such as security of data, data collection, purpose limitation, data retention among other rules. The nature and extent of data that may be collected for the purposes of national security and public order must be clearly provided in law. This Clause provides an opportunity for the State to circumvent the Data Protection Act by enacting laws that allow for disclosures. This clause simultaneously does not meet the criteria set under Article 24.

Assessment of taxes involves the collection of massive amounts of personal, business, and financial data. The amendment proposes to exempt KRA from any accountability in handling vast sums of data or any obligation to keep taxpayers informed about why their data is being collected, what data is being processed and to what end. Simply, the exemption of Kenya Revenue Authority from the Data Protection Act removes any obligation or duty to ensure KRA’s data collection is lawful, fair, transparent and limited to necessity.

It should be noted that data processing for tax purposes involves data sharing with other State agencies or tax authorities in other countries for tax enforcement purposes. Amending the clause removes any obligation on KRA to implement data protection safeguards and data transfer mechanisms that guarantee adequate levels of protection for sharing or transferring data with third parties. The proposed amendment would deny taxpayers their rights as data subjects to know who else is accessing their data and for what purpose, as the law requires.

Kenya’s data protection law places a duty on all data controllers to ensure that all data that is collected is accurate and reasonable steps are taken to ensure that inaccurate data is erased or rectified without delay. Like all data controllers, KRA bears an obligation to maintain clear guidelines and policies on data retention and deletion of data collected. KRA is required to regularly delete unnecessary and outdated data to minimize privacy risks to taxpayers. The proposed amendment to the Data Protection Act would waive KRA’s obligation to comply with this important duty.

The Kenya Revenue Authority relies on massive amounts of data provided by taxpayers and other third parties and requires advanced IT systems to collect, process and utilize these data sets. The use of advanced IT systems creates uncertainty as to the level of automation by these systems and the privacy risks associated with automated decisions.

The nation can anticipate that KRA and other State agencies will accelerate the automated profiling of taxpayers, leading to the automation of decisions which could create adverse and unintended legal consequences for taxpayers. This is patently illegal under Kenyan law. The Data Protection Act (2019) provides that data subjects have the right not to be subject to a decision based solely on automated processing, including profiling. This amendment will exclude KRA from the obligation to ensure that taxpayers are not subject to automated decision-making when making tax assessments.

We close by reiterating that the proposed amendment violates the right to privacy as provided under Article 31 of the Constitution. The proposed limitation of the right to privacy does not meet the requirements for limitation of rights as provided in Article 24 of the Constitution. The proposed limitation far exceeds what is necessary to accomplish the objectives of tax collection. There are less intrusive “Big Brother” means of achieving what the proposed amendment seeks to achieve that are currently in use by the State. The proposed amendment is already creating anxiety among Kenyan and international investors and will hurt Kenya’s already fragile economic environment and investor confidence. Amnesty International Kenya and ARTICLE 19 Eastern Africa call on the National Assembly to reject the proposed amendment in Clause 63 of the Finance Bill 2024.

Irungu Houghton

Amnesty International Kenya Section Director

Mugambi Kiai

ARTICLE 19 Eastern Africa Regional Director