Banks resist KRA’s push for system integration over personal data privacy concerns
The Kenya Revenue Authority (KRA) has encountered an obstacle in its attempt to integrate its data systems with those of 38 banks, with the lenders resisting the move due to concerns about customer privacy and the legal framework surrounding data sharing.
The tax agency’s move follows a discreet change to the law in December, granting it powers to compel taxpayers to integrate their systems with the KRA’s in a renewed effort to curb tax evasion and boost revenue collection.
More To Read
However, banks have resisted, citing fears that the integration could give the KRA unauthorised access to sensitive financial information, potentially exposing them to lawsuits and regulatory penalties.
“The process [of integrating] stalled due to the absence of an appropriate legal framework to support banks to share customer personal information,” said Raimond Molenje, CEO of the Kenya Bankers Association, which represents the industry’s interests.
President William Ruto’s administration has intensified its crackdown on tax cheats, a move that has gained urgency following the withdrawal of last year’s Finance Bill after violent protests that left over 50 people dead. The government is under pressure to fill a Sh345 billion budget deficit and has turned to stricter tax enforcement as a key strategy.
Right to privacy
Under Kenya’s Data Protection Act of 2019, individuals have a right to privacy regarding their personal data, including financial details. Section 51(2) permits banks and other data controllers to share such information with third parties only with the individual’s consent or under specific legal exemptions, such as national security or public interest.
Legal experts warn that the changes introduced in the Tax Procedures (Amendment) Act, 2024, could push the limits of these protections. The law states that KRA may require a person to integrate their electronic tax system with the authority’s platform for submitting transactional data. However, banks argue that additional legal safeguards are needed to ensure compliance with existing privacy laws.
Industry insiders indicate that the KRA is seeking a system similar to the integration banks have with the Central Bank of Kenya (CBK). However, lenders argue that the CBK model is regulatory in nature and does not grant the financial regulator visibility into customers’ identities or account balances.
The push for tighter tax compliance was initially part of the Finance Bill, 2024, which proposed amendments to the Data Protection Act. These changes would have granted KRA broad access to sensitive financial and personal information from data controllers such as banks, telecom operators, schools, and government agencies.
Following intense public backlash, the Bill was withdrawn, but the government has since intensified efforts to crack down on tax evaders through other means.
KRA has been leveraging data from various sources, including bank statements, property ownership records, vehicle registrations, and Kenya Power meter registrations, to identify individuals and businesses suspected of underreporting their earnings.
Top Stories Today
