84 • • • • information was actually extracted or used by the authorities through DNA profiling and that no immediate detriment was caused in a particular case would not change that conclusion. DNA profiles contain a more limited amount of personal information extracted from cellular samples in a coded form. The limitations observed on the use of DNA equally applied, to the Kenyan situation, given the concession by the respondents of their inability to process DNA information for the entire population. The necessity of GPS monitors in identification was even less evident, given the risk they posed to the right to privacy. The privacy implications and risks arising from the use of GPS monitors was that the devices could be used to track and monitor people without their knowledge. GPS monitoring generated a precise, comprehensive record of a person’s public movements that reflected a wealth of detail about their familial, political, professional, religious, and sexual associations. Disclosed in GPS data would be trips the indisputably private nature of which took little imagination to conjure. The Government could store such records and efficiently mine them for information years into the future. And because GPS monitoring was cheap in comparison to conventional surveillance techniques and, by design, proceeds surreptitiously, it would evade the ordinary checks that constrain abusive law enforcement practices. Other than the DNA and GPS coordinates, information to be collected by NIIMS pursuant to the impugned amendments was necessary and was therefore not unconstitutional. On whether the roll out of NIIMS violated data protection laws; the court took judicial notice of the fact that the Data Protection Act 24 of 2019 was enacted and the law contained therein was taken. The protection of personal data depended largely on a legal, regulatory and institutional framework that provided for adequate safeguards, including effective oversight mechanisms. That was especially the case with NIIMS, whereby a vast amount of personal data was accessible to the state, and data subjects at the time had limited insight into and control over how information about them and their lives was being used. The Data Protection Act had included most of the applicable data protection principle, however, the Registration of Persons Act was not one of the Acts to which the Data Protections Act applied as part of the consequential amendments. That notwithstanding, since one of the objectives of the Act was the regulation of the processing of personal data, whose definition included biometric data collected by NIIMS, it also applied to the data collected pursuant to the impugned Act. There were a number of areas in the Data Protection Act that required to be operationalised by way of regulations, including circumstances when the Data Commissioner may exempt the operation of the Act, and may issue data sharing codes on the exchange of personal data between government departments. Those regulations were necessary, as they would have implications on the protection and security of personal data. Once in force, data protection legislation had to be accompanied by effective implementation and enforcement. The implementation of the Data Protection Act 24 of 2019 required an implementation framework to be in place, including the CITIZENSHIP AND NATIONALITY RIGHTS CASE DIGEST