18. 19. 20. 21. 22. 23. been prudent, if not for anything else, for good order, for the State to ensure that the legal framework for protection of the right to privacy was in place before taking action likely to infringe the individual’s right under article 31 of the Constitution. Considering the object and purpose of the Data Protection Act, and more importantly, considering that the Act was intended to give eect to article 31(c) and (d) of the Constitution, it would have been reasonable to have the Act in place before the purported amendment to section 9 of the Registration of Persons Act and before the collection and processing of personal data. Since the State chose to put the cart before the horse, so to speak, it had to live with the reality that there existed legislation against which its actions had to be weighed irrespective of when they were taken as long as those actions touched on the individual’s right under article 31 of the Constitution. There was no other scale upon which to weigh the actions of the State to collect and process personal data except that provided by the Data Protection Act, at least to the extent that it was an Act meant to put into eect the constitutional right to privacy under article 31 of the Constitution. There was always a duty on the part of the State to ensure that the Bill of Rights under Chapter IV of the Constitution, including the right to privacy under article 31 of the Constitution was respected and protected. Section 31 of the Data Protection Act did not impose any more obligation or duty on the State than that which the State hitherto had to bear. It was the individual’s constitutional rights and which, for all intents and purposes, were vested rights, that were under threat by the excesses of the State in collecting and processing data without an existing legal framework to ensure that even as the State embraced a new system of identication, the right to privacy was protected. That was why section 31 was retrospective in its application. It was more of a bulwark against the excesses of the State than a tool imposing new obligations or duties on the State. Fairness would be answered in respect of a particular statute depended on the interaction of several factors, each of them capable of varying from case to case. The degree to which the statute had retrospective eect was not a constant. Nor was the value of the rights which the statute aected, or the extent to which that value was diminished or extinguished by the retrospective eect of the statute. The unfairness of adversely aecting the rights, and hence the degree of unlikelihood that that was what Parliament intended, would vary from case to case. So also, would the clarity of the language used by Parliament, and the light shed on it by consideration of the circumstances in which the legislation was enacted. All those factors had to be weighed together to provide a direct answer to the question whether the consequences of reading the statute with the suggested degree of retrospectivity were so unfair that the words used by Parliament could not have been intended to mean what they could appear to say. Fairness was in interpreting section 31of the Data Protection Act as being retrospective in its application. In the Nubian Rights Forum case the court held that while the Data Protection Act had included most of the applicable data protection principles, the Registration of Persons Act was not one of the Acts to which the Data Protection Act applied as part of the consequential amendments. That notwithstanding, since one of the objectives of the Data Protection Act was the regulation of the processing of personal data, whose denition included biometric data collected by NIIMS, it also applied to the data collected pursuant to the impugned amendments. The Nubian Rights Forum case judgment had been overturned or challenged. The nding that the collection and processing of personal data in March 2019 was subject to the Data Protection Act stood and the interested party and the respondents were estopped from denying that they were bound by that judgment, being judgment in rem. The 1st applicant had made out a case against the respondents for the judicial review orders of certiorari and mandamus mainly on the ground of illegality. The respondents had not appreciated the import and the extent of the application of the Data Protection Act, with respect to collection and processing of data collected under the NIIMS. If they did, they would have given eect to section 31 of the Data kenyalaw.org/caselaw/cases/view/220495/ 6