We’re Not Ready to Sell eCitizen Data. Here’s Why.
Kenya’s Ministry of ICT has announced plans to commercialize citizen data through a national marketplace. They promise it’s “anonymized” and heavily regulated. Before Kenya lets this happen, the country needs to fix what’s already broken.
Here are three reasons this policy needs to return to the drawing board, along with what must happen first.
— —
## 1. We Can’t Even Protect Data We’re Already Collecting
Start with what’s documented in court.
Four months ago, a Safaricom employee admitted under oath that he shared a university student’s personal data, including call records, with police investigators without any judicial authorization. The student, David Mokaya, was arrested based on this illegally obtained data, tried at Milimani Law Courts, and eventually acquitted when the prosecution failed to prove its case.
He’s now suing for KES 200m.
A DCI officer testified that he had received the data via a police letter, not a court order. When defense lawyers asked directly, “Are you aware that subscriber details can only be released with a court order?” — the officer admitted he wasn’t. The entire criminal case collapsed because its foundation was data obtained outside the law.
This wasn’t a one-off failure.
The Law Society of Kenya filed a constitutional petition seeking a court-supervised audit of all requests for subscriber data made by security agencies, accusing them of operating what it describes as “an unlawful surveillance pipeline.” Senators have formally demanded answers about Safaricom’s data practices, alleging the telco has breached subscriber privacy and enabled state surveillance.
The pattern is systemic: At this stage, Kenya’s institutions don’t have the capacity, or the will, to protect data once it’s collected.
Now they intend to commercialize more of it.
— —
## 2. The SHA Exposé Proves What Happens When Government Controls Data
The Africa Uncensored expose into Kenya’s SHA (Error by Design) revealed a chilling pattern: when government collects data on citizens, the poorest pay the price.
SHA patients reportedly profiled based on their socio-economic data. The poor subsidize healthcare for the rich. The system funnels patients toward specific hospitals while public facilities remain underfunded.
This is a deeper fraction on governance playing out through data. It isn’t just a privacy failure in isolation.
Get Arnold Mwangi’s stories in your inbox
Join Medium for free to get updates from this writer.
Now imagine that same institutional capacity, or lack thereof, but with access to business registrations, vehicle data, passport applications, and mobility patterns from Safaricom. Imagine that data for sale to the highest bidder.
The system that broke SHA will break this too.
— —
## 3. We Need Three Things Before Any of This Moves Forward
**Liability with teeth.** Not policies. Actual precedence.
When data is misused, who pays? How much? What triggers accountability? Right now, the answer is: nobody. The system absorbs the failure and moves on. Safaricom allegdedly shared data without court orders. Consequences are still pending. The government (via SHA) is operating in the same way.
Before commercializing citizen data, Kenya must establish data breach liability law with real penalties — fines large enough to matter, convictions that send a message, consequences that actually deter abuse.
**Public breach reporting.** Every unauthorized access. Every data sale. Published in a national registry.
Not internal audits. Not “we’re investigating.” Not opaque processes that never see daylight. Every incident that involves a breach or misuse of citizen data should be publicly reported, timestamped, and archived.
Transparency is the only mechanism that works when institutional trust is broken.
**A public-sector-only pilot.** Audit everything. Report all breaches publicly. Prove the safeguards work before commercial access opens.
Not a press release pilot. Not a six-month trial with predetermined success metrics. A real, audited, public test with an independent review before the marketplace expands beyond government.
— —
## The Real Question
If the government won’t commit to these three things *before launch*, they’ve already answered the question: they’re not serious about privacy.
The policy itself isn’t inherently wrong. Quality data does improve policy. A national data marketplace could drive better understanding of economies, better targeting of public services, higher productivity, and prioritization of capital.
But not yet. Not with the current state of our institutions. Not without guardrails.
Kenya’s public participation process is coming. This will face scrutiny. When it does, the ask is simple: pause, go back to the drawing board, and build this right. Because once commercial data access opens, it won’t close. The precedent will be set. The infrastructure will be in place. And the poorest will pay the price, just like they did with SHA.
— —
