REPUBLIC OF KENYA INTHE HIGH COURT OF KENYA AT NAIROBI CONSTITUTIONAL AND HUMAN RIGHTS DIVISION CONSTITUTIONAL PETITION NO. _OF 2023 IN THE MATTER OF: THE CONSTITUTION OF THE REPUBLIC OF KENYA AND IN THE MATTER OF: ARTICLES 2, 3, 19, 20, 22, 23,24 and 31 OF THE CONSTITUTION OF THE REPUBLIC OF KENYA AND. IN THE MATTER OF DATA PROCTECTION ACT 2019 AND IN THE MATTER OF AFRICAN UNION CONVENTION ON CYBER SECURITY AND PERSONAL DATA PROTECTION CHAPTER 2&3 BETWEEN AFRICAN CENTRE FOR CORRECTIVE & PREVENTIVE ACTION. , I" PETITIONER, JAMES MWANGI MACHARIA. ...2© PETITIONER PETER KIHIKO KURIA.. 1--eoee3*® PETITIONER VINCENT MUHUNG! A™ PETITIONER, PATRICK MUIGAI.. S™ PETITIONER BRIDGET NKATHA. so PETITIONER PAUL MUTUA. .7™ PETITIONER MARYGORETTI KENDI 8™ PETITIONER SAMUEL KARIUKI. 9™ PETITIONER, JAMES KAMAU GACHAGO. }0™ PETITIONER, JULIUS GAITHO KARANJA. 1™ PETITIONER TIMOTHY MWANG! GIKONYO. wel2™ PETITIONER SIMON KAMAU. 3™ PETITIONER LUCAS NJOROGE. }4™ PETITIONER, DENIS GITONGA. 15™ PETITIONER EPHANTUS GICHUHI. 16" PETITIONER BILLY MAKINYA. 17™ PETITIONER PENNY MAINA. 18™ PETITIONER, JOSEPH NGOTHO. 20™ PETITIONER EPHRAIM KIRUBI.. 21 PETITIONER ERIC GITONGA. so 228° PETITIONER STANLEY IRUNGU MWANGI.. 23° PETITIONER, DAVID MWAURA...... : 24" PETITIONER JOHN MWANG........ .25™ PETITIONER EDWIN GATHAIYA.. 7" PETITIONER DENNIS GITONGA NYAGA.... soseseee-28™ PETITIONER 29" PETITIONER JOHN MAINA MUCHOKI.EDWIN GATHAIYA. DENNIS GITONGA NYAGA. JOHN MAINA MUCHOKI... .-30™ PETITIONER 317 PETITIONER, 32° PETITIONER, ~VERSUS~ GOOGLE KENYA LTD.. HON ATTORNEY GENERAL... CABINET SECRETARY MINISTRY OF ICT. DATA PROTECTION COMMISSIONER .. 17 RESPONDENT. 28 RESPONDENT 3° RESPONDENT 4" RESPONDENT COMMUNICATION AUTHORITY OF KENY, 5™ RESPONDENT PETITION. To The Deputy Registrar, High Court of Kenya, Constitutional & Human Rights Division, Milimani Law Courts, Nall THE HUMBLE PETITION of AFRICAN CENTRE OF CORRECTIVE & PREVENTIVE ACTION whose address of service for the purpose of this Petition is Muthaiga Square 3” Floor P.O BOX 2881-00621 Village Market showeth as follows: THE PARTIES 1, The First Petitioner is a non governmental organization (NGO) registered under the NGO Co-ordination Act (Cap 19) within the Republic of Kenya within the jurisdiction of the Honourable Court. ts address of service for purposes of this Petition is Muthaiga Square 3” Floor P.O BOX 2881-00621 Village Market . The 2% -29" Petitioners are Kenyan citizens, adults of sound mind living and working for gain within the Republic of Kenya. Their address of service for purposes of this petition is Muthaiga Square 3 Floor P.O BOX 2881-0062! Village Market. 3. The First Respondents subsidiary of Google Inc. Registered under the Company's ‘Act within the Republic of Kenya whose address is Purshottam Place, 7° Floor Chiromo Rd, P.O BOX 66217-00800 Westlands, Nairobi.4. The second Respondent is the Honourable Attorney General of the Republic of Kenya the constitutionally designated Principal Legal Adviser of the Government of Kenya and in that capacity vested with the legal authority to defend any suit against the National Government. The Attorney General's address of service is c/o Attorney General's Chambers, State Law Office, Sheria House, P.O. Box 401112 Nairobi. : 5. The 3" Respondent is a State Organ responsible for Information, Broadcasting and Communication policies in Kenya whose is address for the purposes of this suit is Teleposta Towers, Kenyatta Ave, Koinange StreetP.O Box 30025-00100 Nairobi 6. The 4* Respondent is a State department whose mandate is to exercise oversight con data processing operations and promote self regulation among data controllers and data processors whose address for the purposes of this suit is Britam Tower, Hospital Road, Upperhill P.O Box 30920-00100 Nairobi The S* Respondent is a state department responsible for facilitating the development of the information and communications sector including; cybersecurity, broadcasting multimedia, telecommunications, electronic commerce, postal and courier services whose address is for the purposes of this suit is P.O Box 14448-00800 Waiyaki Way, Nairobi. LEGAL FOUNDATION OF THE PETITION6. Article 2(1) of the Constitution of Kenya pronounces the supremacy of the Constitution and provides that the Constitution binds all State Organs at both levels of government Article 2(4) of the Constitution of the Republic of Kenya rovides among other thin i contravention of the ‘Constitution is invalid. Article 2(6) of the Constitution states that any treaty or convection ratified by Kenya shall form part of the law of Kenya under this constitution Article 3 of the Constitution of the Republic of Kenya obligates every Person to respect, uphold and defend the Constitution. Article 10 of the Constitution of the Republic of Kenya sets out the National ‘Values and Principles of governance that bind all state officers, state organs, public officers and all persons whenever they apply or interpret the constitution, enact, apply or interpret any law, make or implement public policy decisions. Article 19 (3) (a) states that the rights and fundamental freedoms in the Bill of Rights belong to each individual and are not granted by the state; Article 19 (3) (b), The rights and fundamental freedoms granted in the Bill of Rights do not exclude other rights and fundamental freedoms not in the Bill of Rights but recognized or conferred by the law except where they are inconsistent with the Bill of Rights. Article 19 (3) (€), the rights granted in the Bill of Rights are subject only to the limitations contemplated in the Constitution. Article 20 (2) states that every person shall enjoy the right to be protected by the constitution to the greatest extent consistent with the nature of the right or fundamental freedom. Article 21 (1) states that it is the fundamental duty of the state and every state organ to observe, respect, promote and fulfil the rights and freedoms in the Bill of Rights.8. 10. i, AD, 13, 14, 15. Article 23 confers the High Court with special jurisdiction to issue declarations conservatory orders, judicial review orders for conservation to enforce the rights of Kenyans. Article 24 (I) states that rights or fundamental freedoms in the Bill of Rights shall not be limited except by law and then only to the extent that limitation is reasonable and justiffable in an open and democratic society based on human dignity equality and freedom taking into account all relevant factors. Article 21 (3) of the Constitution — a. imposes a duty on all State organs and all public officers—including the Respondents—to address the needs of “wuiherable groups” within the Kenyan society. Article 27 of the Constitution confers on the PETITIONER a fundamental and inalienable right to equal protection and equal benefit of the law, and not to be discriminated against. Article 31 provides for the right of privacy including privacy of communication, Article 159 states that Judicial authority is derived from the people and vests in and shall be exercised by the courts and tribunals established by under the constitution; (4)(2)(a) Justice shall be done to all irrespective of status (b) justice shall not be delayed (d) Justice shall be administered without undue regard to procedural technicalities. Section 8 of the data protection act provides for the rights and duties of the Data ‘Commissioner in Kenya toward data subjects. Chapter 2 & 3 of the African Union Convention on Cyber Security and Personal Data protection provides who should personal data and to what extent, rights ofdata subjects and regulation on cyber crime at national level of each individual state member, THE FACTS 16. The 2 -29* Petitoners are users of the First Respondents applications running ‘on the Android platform including google photos, Chrome, amongst other applications. 17. The I* Respondent has been using biometrics to collect data from Kenyan citizens, 18, THAT I* Respondent form of collecting data from Kenyan citizens has been through various forms like Google photos, Google maps, Google search engine and other apps developed by Google. 19. THAT I* Respondent has been using the data collected to improve its Artificial intelligence (Al) platform. 20. THAT as the I* Respondents Al improves with time guided by its consumers personal data it is able to scan the face of its specific user,store the data and extract facial feature data based on specific “biometric identifiers” (ie, details about the face's geometry as determined by facial points and contours), and comparing the resulting “face template” (or “faceprint”) against the face templates stored in a “face template database.” If a database match is found, an individual may be identified 21. THAT the I* Respondent has a cloud based platform, The Google Photos app, which comes pre-installed on all Google android devices, is set by default to automatically upload all photos taken by the android device user to the cloud- based Google Photos service. Users can also connect other devices'to Google Photos to upload and access photos on the cloud-based service. The cloud-based22. 2B. 24, 25. Google Photos service uses these face templates to organize and group together photos based upon the particular individuals appearing in the photos. This technology works by comparing the face templates of individuals who appear in newly uploaded photos with the facial templates already saved in Google's face database. Google's sophisticated facial recognition technology creates a template for each face detected therein, without consideration for whether a particular face belongs to a Google Photos user or unwitting non-user, and then compares each template against Google's face template database. If there is a match, then Google groups the photo from which the newly uploaded face template was derived with the previously uploaded photos depicting that individual These unique face templates are not only collected and used by Google Photos to identify individuals, but also to recognize their gender, age, and location. Accordingly. Google also collects “biometric information” from users and non- THAT the I* Respondent has a set of functions and procedures allowing the ‘creation of applications that access the features or data of an operating system, application, or other service i.e where 3" parties can access personal data stored Google. The First Respondent, through Global Positioning System (GPS), is aptly able to track the movement of android users without their explicit consent. ‘The First Respondent also runs a digital distribution service dubbed 'Google Play Store’ and which serves as the official app store for certified devices running on the Android operating system and its derivatives, as well as ChromeOS, allowing Users to browse and download applications developed with the Android software development kit (SDK) and published through Google. The First Respondent collects users information and which third party applications have direct access to without consent of the users.26. The use of artificial intelligence(Al) to improve using personal data from their users is a breach of the Data Protection Act 2019 which states that data controllers have an obligation to explicitly disclose to its data subjects what data is being collected and how the data is used. The collection of personal data by Google using biometrics system and extract facial feature data based on specific “biometric identifiers” is a violation of the Constitution of Kenya Article 31 which states; ©) information relating to their family or private affairs unnecessarily required or revealed; or 4) the privacy of their communications infringed. 27. That the use of the location service provided by the 1“ Respondent for their Users to track their movements is a violation their right to privacy accorded by Article 31 of the Constitution of Kenya and a violation of the duties of a data controller according to the Data Protection Act. 28. That the API policy provided by Google allows for 3% Party users to access - Personal data without consent of the data subjects which is a violation of the Data Protection Act which provides that explicit consent must be sought from the users. 29. To the extent that the First Respondent, through Global Positioning System (GPS), is aptly able to track the movement of android users without their explicit consent is a breach of Article 31 of the Constitution of Kenya. 30. To the extent that the First Respondent publishes users information obtained through the Google Play Store platform is a violation of Article 31 of the Constitution of Kenya. REASONS WHEREFORE: ‘Your Petitioners therefore humbly pray for— A. A declaration that thi a public interest case: B. A declaration that the petitioner has all rights and guarantees as provided for under the Constitution, and as specifically referenced herein;C. A Declaration that impugned actions conravene Article 31 of the Constitution of Kenya, 2010; D. Damages for breach of privacy of the petioners herein; E. Costs, and. F, Such other Orders as this Honourable Court shall deem just and expedient to a pareve QP dat [Whveuts I sa aa Gi BUGUA Kanes DEATES FGR 1 'HE PETITIONER DRAWN & FILED BY; Karugu Mbugua & Company Advocates, Muthaiga Square, 3° Floor, Thika Superhighway, Exit 4/4- Opposite Muthaiga Golf Club, P.O. BOX 10642-00400, NAIROBI TO BE SERVED UPON: Google Kenya Ltd, Purshottam Place, 7* Floor Chiromo Road, P.O Box 66217-00800 Westlands, NAIROBI ‘Attorney General, Sheria House, P.O. Box 40112, NAIRO! Cabinet Secretary Ministry of ICT, Teleposta Towers, Kenyatta Avenue, Koinange Street, P.O Box 30025-00100 NAIROBI Data Protection Commissioner, Britam Tower, Hospital Road, Upperhill, P.O Box 30920-00100, NAIROBI‘Communication Authority of Kenya, P.O. BOX 14448-00800, Waiyaki Way, NAIROBI