Rights groups reject proposal seeking to give KRA access to sensitive personal data

Amnesty International Kenya and ARTICLE 19 Eastern Africa have raised serious concerns over Clause 63 of the Finance Bill 2024, which proposes to exempt the Kenya Revenue Authority (KRA) from the provisions of the Data Protection Act.

The two organisations are calling on the National Assembly to reject this proposed amendment, which seeks to allow KRA to access sensitive personal data like details of properties owned and bank accounts operated by taxpayers without a court warrant, in efforts to curb tax cheats.

"While we acknowledge that it is international practice for a law to contemplate exemptions to data protection laws, these limitations must meet the criteria laid down under Article 24 of the Constitution of Kenya," Amnesty International Kenya stated. The clause in question would exempt disclosures necessary for tax assessment, enforcement, or collection from the Data Protection Act 2019, effectively limiting the right to privacy.

Article 24 of the Kenyan Constitution requires that any limitation to fundamental rights and freedoms be reasonable and justifiable in a democratic society based on human dignity, equality, and freedom. Amnesty International Kenya and ARTICLE 19 argue that the proposed blanket exemption would undermine Kenya's developing data privacy culture and could be prone to abuse by current and future administrations.

"This ambiguity does not satisfy the principle of legality," the statement continues. "The courts have repeatedly determined that laws limiting fundamental rights must be clear and precise, covering only the activities connected to the law's purpose." The organisations argue that the amendment's lack of a clear definition of the extent of disclosures risks invalidity and does not explicitly express the intention to limit Article 31 as required by Article 24.

Amnesty International Kenya and ARTICLE 19 reiterate that under the current Data Protection Act (2019), all state agencies, including those responsible for tax administration, are bound by data protection rules such as data security, purpose limitation, and data retention. They stress that any data collection for national security and public order must be clearly defined by law.

"The amendment proposes to exempt KRA from any accountability in handling vast sums of data or any obligation to keep taxpayers informed about why their data is being collected, what data is being processed, and to what end," the statement notes. It also highlights concerns about data sharing with other state agencies or international tax authorities without adequate safeguards, which could deny taxpayers their rights to know who is accessing their data and for what purpose.

Furthermore, the organisations point out that the Data Protection Act requires all data controllers to ensure the accuracy of collected data and to delete or rectify inaccurate data promptly. They argue that KRA should not be exempt from these obligations, as failing to comply increases privacy risks for taxpayers.

"The use of advanced IT systems by KRA creates uncertainty regarding the level of automation and the privacy risks associated with automated decisions," they warn. The Data Protection Act (2019) provides that data subjects have the right not to be subjected to decisions based solely on automated processing, including profiling. The proposed amendment would exclude KRA from this obligation, potentially leading to adverse legal consequences for taxpayers.

Amnesty International Kenya and ARTICLE 19 conclude by asserting that the proposed amendment violates the right to privacy under Article 31 of the Constitution and does not meet the requirements for limiting rights as outlined in Article 24. They argue that the proposed limitation exceeds what is necessary for tax collection and that there are less intrusive means to achieve the same objectives.

"The proposed amendment is already creating anxiety among Kenyan and international investors and will hurt Kenya's already fragile economic environment and investor confidence," they state.