In a controversial move to clamp down on tax evasion, the Treasury is seeking to amend the Data Protection Act, 2019, to allow the Kenya Revenue Authority (KRA) access to sensitive personal data without needing a court warrant.

Treasury Cabinet Secretary Njuguna Ndung’u has tabled the Finance Bill, 2024 in the National Assembly, proposing significant changes aimed at empowering the tax authority.

The proposed amendments include integrating databases from data controllers and processors—such as banks, telecom operators, utilities, schools, land registries, and the National Transport and Safety Authority (NTSA)—with the KRA's digital system, known as i-Tax.

Legal experts have expressed concern over this proposal.

“Section 51(2) of the Data Protection Act is amended by inserting the following new paragraph immediately after paragraph (b)—(ba) disclosure is necessary for the assessment, enforcement or collection of any tax or duty under a written tax law,” the Finance Bill states.

Read More

  1. Court blocks KRA's controversial mobile phone tracking plan in privacy clash
  2. Lobby group challenges KRA's new IMEI disclosure policy for incoming phones
  3. CBK announces release of new currency banknotes with enhanced features

Currently, Section 51 (2) of the Data Protection Act permits data sharing with third parties if it pertains to the individual for personal or household activities, or if it is essential for national security or public interest.

Additionally, Section 51 (2) (c) allows exemptions if the disclosure is mandated by law or a court order. However, the KRA finds this provision cumbersome for pursuing unpaid taxes.

Instead, it seeks to harness the growing use of data and interlinkages between KRA systems and third parties such as banks and mobile money platforms like M-Pesa, using technology like Internet-enabled cameras and digital electronic tax registers (ETRs) to enhance revenue collection.

The KRA's enforcement unit has been leveraging various databases to track suspected tax evaders.

These include bank statements, import records, motor vehicle registration details, Kenya Power records, water bills, and data from the Kenya Civil Aviation Authority (KCCA), which reveal asset ownership such as aircraft.

For instance, car registration details are used to identify individuals driving luxury vehicles but showing minimal tax remittance, and Kenya Power meter registrations help identify landlords avoiding taxes.

The KRA has also sought information on suppliers and contractors hired by county governments to tighten its grip on tax evasion.

A notable rise in imports of luxury goods and significant investments in real estate has highlighted potential massive tax leakages.

The KRA believes that tapping into these could generate billions of shillings in additional revenue.

Despite the visible increase in conspicuous consumption, particularly in Nairobi, only a few Kenyans are officially registered as high-income earners.

This discrepancy fuels the taxman's need for more robust tax enforcement measures.

Previously, Section 60 of the Tax Procedures Act required the KRA to obtain a court order before accessing personal data, a requirement that was declared unconstitutional by the High Court.

The Data Protection Act mandates data controllers and processors to protect sensitive information, including personal identification details, DNA, blood type, personal property, marital status, ethnicity, and race.

The Treasury’s proposal, if enacted, would mark a significant shift in Kenya’s approach to data privacy and tax enforcement, raising critical questions about the balance between state power and individual privacy rights.

 As the Finance Bill, 2024, progresses through the legislative process, it remains to be seen how these proposals will impact Kenya's approach to tax collection and data privacy.