When the Independent Electoral and Boundaries Commission (IEBC) launched its Continuous Voter Registration (CVR) exercise, it was meant to mark a technological leap forward. For the first time, the commission incorporated iris recognition into its biometric voter registration system — a move it said would strengthen electoral integrity by reducing instances of duplicate registration and impersonation.
Yet, what was envisioned as an upgrade has quickly ignited a national debate. The Elections Observation Group (ELOG) and members of the public have raised alarms about the privacy and data protection risks tied to the use of iris biometrics. Their concerns are not unfounded — especially in the wake of Kenya’s recent experience with Worldcoin, whose data collection activities exposed deep gaps in biometric governance.
Why Iris Data Is Not “Just Another Biometric”
Unlike fingerprints, which can sometimes be re-captured or changed, iris data is immutable. Once compromised, it cannot be replaced. The iris carries highly unique information that can enable cross-system identification across databases, creating the potential for mass surveillance or unauthorized profiling if improperly secured or shared.
Moreover, iris recognition systems typically require high-resolution imaging and specialized storage protocols — increasing the stakes for secure infrastructure and data handling practices. Without airtight controls, Kenya risks not only technical breaches but also erosion of public trust in its electoral systems.
Echoes of the Worldcoin Controversy
The Worldcoin saga offers a timely cautionary tale. In 2023, Kenya suspended Worldcoin’s activities over concerns that the company was collecting and processing sensitive biometric data (specifically iris scans) from citizens without sufficient transparency, consent clarity, or data protection safeguards.
The Office of the Data Protection Commissioner (ODPC) launched investigations into the legality of those operations, leading to enforcement action and broader public debate on biometric data sovereignty.
The parallels with IEBC’s current rollout are striking:
- Both involve mass biometric capture at scale.
- Both raise questions about informed consent and data minimization.
- And both operate within a legal environment still maturing in biometric governance.
The difference, however, is that IEBC’s mandate is constitutional and public. That makes the expectation of accountability and compliance even higher.
Legal and Governance Gaps
Under the Kenyan Data Protection Act (2019), biometric data — including iris scans — is classified as sensitive personal data. Processing such data requires a lawful basis, adherence to data minimization principles, and robust security safeguards.
Key questions remain:
- Has IEBC conducted a Data Protection Impact Assessment (DPIA), as required for high-risk processing activities?
- What retention policies govern the biometric data collected during voter registration?
- How will the commission ensure separation of electoral identity data from other national databases to prevent function creep?
Without clear answers, the risk of data misuse — intentional or accidental — remains a real concern.
Charting a Way Forward: Governance Before Gadgets
The introduction of advanced biometric systems in governance contexts should not outpace the maturity of regulatory oversight. Kenya has an opportunity to model responsible biometric governance, but that requires deliberate steps:
- Transparency and Public Communication:
IEBC must proactively explain the purpose, scope, and safeguards of the iris data collection. Public trust is earned through openness, not afterthoughts. - Mandatory DPIA and ODPC Oversight:
A DPIA should be published (at least in summary) and reviewed by the ODPC before full-scale deployment. This provides both legal cover and technical assurance. - Data Localization and Sovereignty:
All voter biometric data should be securely stored within Kenya’s jurisdiction, with no cross-border transfer unless explicitly authorized by law and subject to equivalent safeguards. - Independent Audit of Biometric Systems:
Independent technical experts and civil society (like ELOG) should be part of oversight processes to evaluate data handling, encryption standards, and vendor compliance. - Redress and Accountability Mechanisms:
Citizens must know where and how to lodge complaints or request redress in case of misuse or breach. The ODPC’s enforcement powers and IEBC’s internal grievance procedures should work in tandem.
Conclusion
Kenya stands at a critical crossroads between technological efficiency and rights-based governance. The promise of clean elections cannot come at the cost of citizens’ biometric privacy.
If the lessons from Worldcoin taught us anything, it is that innovation without governance breeds mistrust. As Kenya modernizes its electoral systems, the principle must remain clear: democracy should never demand citizens to trade their privacy for participation.