Since my comment is quite long, I'm putting the most important point right at the beginning. If anyone from Kenya or with interests in Kenya is reading this comment, please immediately take this law to court (since the article says this law is unconstitutional). Start mass campaigns and get people to understand and talk about it. It may probably take time to be heard, and it may probably seem impossible to win. But learn from the grotesque blunders that India has done with Aadhaar, and use that to fuel your fight. It would be terrible to give up so much for hardly any gain (only the companies that take your money to implement the system would gain, and some people in power). India is the shameful poster child here, and there's lots to learn. Also follow the money and see who's pushing for this (likely to be large multinational companies that are in cahoots with those in power).<p>This is just a bit worse than Aadhaar, the biometric based "unique ID" that's been bulldozed on to people in India. The Aadhaar program ran as an executive mandate (with no legislative backing) for several years, then a poorly drafted law was brought in and passed through subterfuge by the current ruling party (BJP). Aadhaar is based on fingerprints and iris scan, but there are provisions in the backing law to include DNA or other information as and when the authority pleases.<p>Like this Kenyan ID, India's Aadhaar has no opt-out (the Supreme Court gave a vague ruling last year that children should be able to opt out, but that hasn't been implemented).<p>It seems like this Kenyan ID uses biometrics directly, which is how Aadhaar also works. If your biometrics are leaked or compromised (I'm highly amused to even write these words), then you cannot revoke the ID or get a new ID. The concept of cancelable biometrics was not considered (Nandan Nilekani, one of the founders of the famous/infamous Indian company Infosys, headed this ID program, and suffice it to say that it's been a disaster in so many ways).<p>Like Kenya, India still does not have a data privacy law (the one drafted by a government commission has many issues, but will become the law in the future), but the government coerced many people to get Aadhaar through lies, deceitful marketing and causing general panic.<p>Hundreds of thousands (or even millions, by now) have lost money because of the way Aadhaar was linked to almost everything (bank accounts, phone numbers and many more), and the government's constant coercion and panic creation for people to get it and link it was the opportunity of a lifetime for people to phish, scam and defraud people. The majority of the affected were/are not digitally literate (even many educated people aren't generally digitally literate) and are poorer and/or elderly.<p>Since Aadhaar was, and is continuing to be, used for government subsidies, the failure of the poorly designed, centralized system in a country with poor network infrastructure and a lot of inherent corruption resulted in many deaths, including starvation deaths of small children, and disabled and/or elderly people.<p>India is a place where the executive branch of the government can get away with saying that these didn't happen (denial) or that it's collateral damage ("nothing in this world is flawless, so why bother?" is the mindset). The courts won't intervene on their own even for such grave matters.<p>Over the years, people have pointed out several security flaws in the system, but the authority in charge of Aadhaar, UIDAI, has always been in denial mode (and still is). The reaction of UIDAI has always been to file criminal complaints against those who show the weaknesses, instead of encouraging responsible disclosure or acknowledging the efforts of such people.<p>Since the Indian judicial system is also very slow (it took more than three years to even start hearing the cases filed by many people against this ID), the government had it quite easy. That's why I keep using the term "bulldozed".<p>Those who wanted to show the security flaws many a times refrained from doing it themselves because of the repercussions. And that's why the biggest opponent examining and talking about the security issues in the Aadhaar system is a French national who goes by the name Elliot Anderson on Twitter. [1]<p>Even Troy Hunt pointed out many basic flaws [2], but UIDAI's response was, as usual, denial.<p>Mozilla, EFF and many others have written about, and against, the Aadhaar program.<p>I can go on and on, but this would then become a book (see my profile for a little more).<p>[1]: <a href="https://twitter.com/fs0c131y" rel="nofollow">https://twitter.com/fs0c131y</a><p>[2]: <a href="https://www.troyhunt.com/is-indias-aadhaar-system-really-hack-proof-assessing-a-publicly-observable-security-posture/" rel="nofollow">https://www.troyhunt.com/is-indias-aadhaar-system-really-hac...</a>