that could be deemed to affect the right to privacy – whether the collection and processing of personal data under the National Integrated Identity Management System were subject to the Data Protection Act - Constitution of Kenya, 2010, article 31(c) and (d); Data Protection Act, No. 24 of 2019, section 3. Statutes – interpretation of statutes – interpretation of section 31 of the Data Protection Act – provision that provided for retrospective application of a data protection impact assessment on data collected and stored on the National Integrated Identity Management System (NIIMS) – rules of interpretation – presumption against retrospective application of legislation - whether there was a presumption against retrospective legislation in that ousted vested rights and imposed new obligations and duties - whether retrospective application of section 31 of the Data Protection Act that imposed a new duty to carry out a data protection impact assessment that was not there before and during the collection of personal data under NIIMS was unfair. Constitutional Law – fundamental rights and freedoms – right to privacy – provision that that provided for retrospective application of a data protection impact assessment on data collected and stored on the National Integrated Identity Management System (NIIMS) - whether retrospective application of section 31 of the Data Protection Act imposed a new duty to carry out a data protection impact assessment that was a violation of the right to privacy – Constitution of Kenya, 2010 article 31; Data Protection Act (Act No. 24 of 2019) section 31; Registration of Persons Act (cap 107) section 9. Constitutional Law – fundamental rights and freedoms – right to privacy – enforcement of fundamental rights and freedoms – lodging of complaints to the Data Commissioner - whether a constitutional research, policy and litigation institute established to further the implementation of the Constitution could lodge a complaint to the Data Commissioner – Constitution of Kenya, 2010, article 31; Data Protection Act, No. 24 of 2019, section 56; Registration of Persons Act (CAP. 107) section 9 Civil Practice and Procedure – doctrine of exhaustion of remedies – disputes under the Data Protection Act, 2019 – where a party had approached the High Court for Judicial Review orders before exhausting the remedies of making complaints to the Data Commissioner - whether a judicial review court could entertain such an application - Fair Administrative Action Act, 2015, section 9; Data Protection Act (Act No. 24 of 2019) sections 56 and 57. Brief facts The Statute Law (Miscellaneous Amendments) Act, No. 18 of 2018 (Miscellaneous Amendments Act) amended several Acts of Parliament including the , cap. 107. The amendment introduced the National Integrated Identity Management System (NIIMS) which was a new system of identication for both citizens of Kenya and foreigners registered as residing in Kenya. Following the amendment, the 1st and 2nd respondents embarked on a nationwide exercise of collection of personal and biometric data. The amendment and its implementation were, however, challenged before the court in Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR (Nubian Rights Forum case). The court declared that the collection of DNA and GPS co-ordinates for purposes of identication was intrusive and unnecessary, and to the extent that it was not authorised and specically anchored in the empowering legislation, it was unconstitutional and a violation of article 31 of the Constitution of Kenya, 2010 (Constitution). While the Nubian Rights Forum case was pending determination, Parliament enacted the , No. 24 of 2019 whose date of commencement was November 25, 2019. The court in the Nubian Rights Forum case took judicial notice of that development and directed that the processing of data collected pursuant to the amendment of the Registration of Persons Act should not be undertaken before the Data Protection Act was operationalised and a regulatory framework put in place. In a press statement made on November 18, 2020, the 2nd respondent announced the rollout of the identity card, commonly referred to as Huduma Card, that was issued to a data subject apparently after the collection and processing of personal data of the data subject. The applicants were aggrieved by the rollout or the launch kenyalaw.org/caselaw/cases/view/220495/ 2