In this episode of Sera na Sauti, we speak with Dr. Mugambi Laibuta, legal scholar and chair of the Data, Privacy and Governance Society of Kenya, whose work has shaped national debates on privacy, data protection, and civil liberties. He traces the long history of privacy in Kenya’s constitutional text and unpacks how it led to the 2019 Data Protection Act, while also examining the tensions between state security, corporate power, and free expression in a digital era.

Mugambi reminds us that privacy has been in Kenya’s constitutional DNA since independence. The 1963 constitution barred unconstitutional searches and seizures, protecting the privacy of individuals, homes, and property. Even as the text was amended over decades, this provision endured. Courts often sided with citizens in cases of illegal police searches, insisting on compliance with the Police Standing Orders and Criminal Procedure Code. From the CKRC draft to Bomas to the 2005 draft, privacy was consistently present in constitutional debates, and in 2010 it was firmly enshrined alongside dignity, freedom of expression, and access to information.

Yet constitutional principle was not enough. Civil society pushed for a data protection bill as early as 2009, but it stalled. The turning point came with Huduma Namba in 2018 and 2019. Petitions to the High Court argued that a national digital ID could not exist without comprehensive data protection laws. At the same time, Senator Gideon Moi’s Senate bill was sidelined in favor of a Ministry of ICT draft, which Parliament passed. Kenya thus enacted the Data Protection Act in 2019, providing clear principles for how personal data should be collected, stored, and shared, creating rights for data subjects, and establishing the Office of the Data Protection Commissioner to enforce compliance and provide recourse through fines and compensation.

The conversation moves through questions of enforcement and accountability. While the Data Commissioner has fined private companies, critics note limited action against government misuse of data. Mugambi highlights recent data breaches, such as leaks of eCitizen records, and emphasizes that the institutions with custody of data such as KRA, immigration, or ministries bear ultimate responsibility. He outlines how citizens can file complaints directly to the Data Commissioner through a simple online portal, with decisions required within 90 days.

We also delve into Kenya’s security laws. Since the passage of the Private Security Regulations Act, guards at buildings can legally demand IDs and record them, though the protection of this information remains weak. Surveillance powers for agencies like DCI and NIS are legal but require warrants, safeguards often ignored in practice. Mugambi cites cases like Albert Ojwang’s abduction and recalls concerns over spyware such as Pegasus. In reality, he says, government combines data from telcos, CCTV, social media, and even utility payments, making it nearly impossible for citizens to fully evade surveillance. The real question becomes whether evidence was obtained lawfully, and courts have occasionally thrown out improperly gathered phone data, though exceptions like in the Dusit terror trial show how public interest can override privacy.

Mugambi then turns to the privatized public square of social media. Platforms like Facebook, X, and TikTok both enable free expression and facilitate censorship, sometimes at the behest of states. He notes how during Covid-19, dissenting views were removed, raising questions about whether we are pro-speech or not. In Kenya, debates about misinformation risk being weaponized to suppress legitimate political speech. He insists that all speech must be allowed unless it is harmful, such as incitement to violence, genocide, or defamation, because truth ultimately surfaces when ideas are contested openly.

This tension played out during the 2024 Finance Bill protests. The #Msalimie campaign, where youth shared politicians’ phone numbers, was arguably legal for public officials but not for their relatives, who retain privacy rights. Around the same time, the Communications Authority attempted to halt live protest broadcasts, a directive Mugambi calls unconstitutional and in defiance of court rulings that broadcasting oversight lies with the Media Council of Kenya. Petitions by Katiba Institute and the Law Society restored live coverage, underscoring the role of courts in defending media freedom.

The episode also explores whistleblowing, where Kenya lacks strong laws beyond the Witness Protection Act and journalists’ rights to protect sources. Past cases, like the Goldenberg scandal, show how whistleblowers often suffer personally, even to the point of exile or poverty. On innovation, Mugambi stresses that data protection is not a barrier but a safeguard. Companies must secure informed consent, especially in sensitive sectors like health. The controversy over Worldcoin illustrates how transparency, not prohibition, should guide innovation.

Finally, he reflects on the broader landscape. The Data Commissioner has opened regional offices and engaged in public education, but resources remain thin and fines may not be deterrent enough. Citizens, meanwhile, can take practical steps such as strong passwords, two-factor authentication, careful posting habits, and awareness of what personal information they expose online.

📌 Key themes from the conversation:

✅ Huduma Namba and court petitions as the catalyst for the 2019 Data Protection Act✅ Principles of the Act: handling of personal data, rights for data subjects, and recourse through the Data Commissioner✅ Persistent gaps in holding government accountable for data misuse, despite action against private firms✅ Security laws and surveillance, what is legal on paper versus what happens in practice✅ The reach of telcos, CCTV, social media, and utility data in building an almost inescapable surveillance net✅ Social media as a privatized public square, and the risks of censorship justified as fighting “misinformation”✅ Protest, accountability, and privacy: from #Msalimie campaigns to unconstitutional broadcast bans✅ Weak whistleblower protections and reliance on journalists to shield sources✅ Innovation and data protection: why transparency and informed consent matter more than speed or scale

This is a conversation about how privacy, dignity, and free expression survive, or erode, in a digital Kenya. It is about the gap between constitutional text and lived reality, the risks of drifting into a surveillance state, and the possibility of building a culture where rights are not only written down but actively defended.

📚Reading Materials:

* Dr Mugambi Laibuta’s Website

* State surveillance: Kenyans have a right to privacy – does the government respect it?

* Data Privacy and Governance Society

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit seranasauti.substack.com