On 30 September 2026, Kenya's Public Service Commission cut 152 applications for Data Protection Commissioner to a shortlist of 13, with interviews set for 5 October. Capital FM reports that Immaculate Kassait, the office's first holder, finishes a non-renewable six-year term by year's end. The shortlist coverage does not mention facial recognition. The link drawn here is our inference, not a reported fact. The inference rests on the timing: the next commissioner will take office just as the government tries to build a national face-matching system.
The system the new commissioner will face
In June 2026, Interior Cabinet Secretary Kipchumba Murkomen described a plan to link surveillance cameras to national identity databases, so police can identify people suspected of property destruction during protests. Capital FM reported a cost of Sh22 to 25 billion, six cities, and deployment within three to six months of procurement. Other outlets list the cities as Nairobi, Mombasa, Kisumu, Nakuru, Eldoret and Nyeri. That plan is more than 60 days old and is context here, not news. Capital FM's article mentions no data-protection safeguards and no role for the Office of the Data Protection Commissioner (ODPC).
The case for the state's position
The strongest argument for the system is that it fixes a real gap. Police cannot currently match a face on camera to an identity record, so serious crimes go unsolved and investigators fall back on slow manual work. A narrowly used tool could also reduce wrongful suspicion of innocent people. Governments that want these tools are not being frivolous, and a regulator that simply says no will lose that argument and be ignored.
What the law already says
Kenya does not need new legislation to start. The ODPC's Guidance Note on Biometric Data, issued under Kassait's signature in 2025, states that Regulation 49(1)(c) of the 2021 General Regulations classes biometric processing as high risk. Section 31(1) of the Data Protection Act 2019 then requires a Data Protection Impact Assessment (DPIA) before processing begins. The note adds that a DPIA must be submitted to the ODPC at least 60 days before biometric processing starts. It also says biometric data copies must be held in a Kenyan data centre. The ODPC's separate DPIA guidance note lists biometric data among sensitive personal data and ties the assessment to section 31(4) of the Act.
The guidance sits on court precedent. In Kenya Union of Journalists v Kenya Broadcasting Corporation (Judicial Review Misc. Application E355 of 2025, [2025] KEHC 17216), the High Court ruled on 25 November 2025 against a facial-biometric attendance system. According to a law-firm summary of the judgment, the court held that a DPIA is mandatory for such technology and that KBC's failure to run one was a violation. It declared the system unconstitutional and ordered the collected biometric data deleted under official supervision. We could not retrieve the judgment text itself, so we rely on that summary.
Where the gap is
The KBC case involved an employer and a union. A police network tied to the national ID database is a different kind of controller. It is state-run, it is the subject of a procurement the Interior Ministry controls, and it serves a purpose, policing protests, where the state has a strong interest in secrecy. The Data Protection Act contains exemptions for national security and crime prevention. We have not verified their exact wording here. How far they stretch is the key unresolved question, and we flag it as an open one rather than a finding.
This is where the commissioner's independence matters. A rule that requires a DPIA 60 days in advance is only as strong as the regulator's willingness to ask for one from a ministry. The KBC ruling shows that courts will enforce the requirement, but litigation after deployment is a slow and costly check. A commissioner who demands the assessment before procurement closes would be a faster one.
A proportionate position
We do not argue that Kenya should refuse facial recognition. We argue that proportionality has to be demonstrated, and Kenya's own regulator has already written the test:
- Publish the DPIA, or a redacted version of it, before any camera goes live.
- State which offences justify a face search, and bar bulk matching of crowds at lawful protests, which touches free-expression and assembly rights.
- Require logging and independent audit of every search against the ID database.
- Publish error rates, particularly false matches, because a misidentification means a police encounter.
- Keep biometric data in Kenya, as the ODPC already requires.
These steps cost little compared with a Sh25 billion programme, and they protect the system from the outcome the KBC case showed: a court order to switch it off and delete the data. A tool that survives legal challenge is also the better investment for the state.
What to watch on 5 October
The Public Service Commission has invited the public to submit information on candidates. The shortlist reportedly includes officials from media, telecom regulation and the ODPC itself. Whether the interviews probe candidates on state surveillance, and not only private-sector compliance, will say a lot about how seriously Kenya treats the question. Whoever takes the office will not be starting from a blank page. The law, the guidance and a recent High Court ruling already point one way, and the new commissioner's job is to apply them to the state as strictly as they have been applied to a broadcaster.