The Ruto government wants to turn eCitizen records into a national revenue stream. Critics say the plan trades public trust for a fiscal lifeline, and a quiet health data deal with Washington may be only the beginning.
Every time a Kenyan renews a passport online, registers a business, or records the birth of a child through the government’s eCitizen platform, that transaction generates data. For years, that data sat in government servers, administratively useful but commercially dormant. The Ruto administration has decided that arrangement must end.
In a draft National Data Governance Policy published in May 2026, the Ministry of Information, Communications and the Digital Economy has outlined plans to build a formal marketplace where researchers, companies, and non-governmental organisations can purchase anonymised datasets drawn from eCitizen and dozens of other state systems. The proposal frames the move as an innovation play, a revenue fix, and a modernisation imperative all at once. Whether it is any of those things, critics argue, depends entirely on safeguards the government has not yet designed.
Cabinet Secretary William Kabogo Gitau set the tone in the policy’s foreword. “Data is no longer merely a by-product of transactions or administration; it is a strategic national asset that can strengthen governance, improve service delivery, promote innovation, and accelerate inclusive socio-economic transformation,” he wrote. The phrasing was careful, almost bureaucratic. But the underlying logic was stark: the state has been sitting on something economically valuable and has not been collecting on it.
| BY THE NUMBERS At least 1,000 datasets targeted for sale over five years Up to KES 396 million to build and operate the marketplace Kenya’s AI market estimated at $240 million in 2024 (U.S. International Trade Administration) Kenya’s data-centre market projected to reach $805 million by 2031 Cyber-related losses in Kenya: KSh 29.9 billion in 2025 Kenya’s projected government revenue for FY 2025/26: KSh 3,383.0 billion |
THE ARCHITECTURE OF THE PLAN
At the centre of the proposal is a new body called the National Data Governance and Emerging Technologies Council. The council would aggregate datasets from across government ministries, departments, and agencies, package them into structured, anonymised form, and make them available through a tiered pricing system. Some datasets would be free for public-interest uses; others would be priced according to categories that the policy does not yet specify.
The datasets on offer are not trivial. According to the draft policy, the marketplace would include business registration trends, passport and immigration application volumes broken down by region, birth, death, and marriage registration patterns, vehicle registration statistics, land transaction figures, crop production data by county, and traffic flow information. The Kenya National Bureau of Statistics and other agencies would contribute additional datasets, creating what officials describe as a unified national data catalogue.
The government draws a clear line at personal data. Names, phone numbers, identification numbers, email addresses, and images are off the table, in line with the Data Protection Act of 2019. The official position is that only aggregated, non-identifiable information will enter the marketplace. The problem, experts say, is that the boundary between anonymised and personal data is considerably more porous than the policy acknowledges.
| “When massive datasets are combined, the risk of re-identification increases.” — Analysis of Draft National Data Governance Policy, May 2026 |
THE RE-IDENTIFICATION PROBLEM
The proposal has faced immediate criticism from technical experts over the feasibility of true anonymisation. The core concern is statistical: when large datasets from multiple government systems are combined and sold to private actors, the chance that an individual can be re-identified from supposedly anonymous records rises sharply. A dataset of land transactions in a given ward, cross-referenced with vehicle registration volumes and passport renewal rates from the same area, can, under certain conditions, effectively pinpoint individuals even without names attached.
Kenya is not the first government to learn this lesson the hard way. In the United Kingdom, a 2014 analysis of the National Health Service’s anonymised hospital records demonstrated that roughly 87 percent of the records could be re-identified using only year of birth, sex, and postal district. The NHS had released the data believing it was safe. Kenya’s draft policy does not specify what re-identification risk assessment standard would be applied before any dataset reaches the marketplace, nor does it name a mechanism for auditing buyers’ use of the data after purchase.
The Daily Nation, in an editorial published hours after the policy draft circulated, called on the government to establish enforceable safeguards before proceeding, arguing that the revenue opportunity should not outpace the institutional capacity to manage it. The editorial stopped short of opposing the marketplace outright, but its concern mirrored a broader anxiety in the digital rights community: that the policy’s governance architecture is being designed after the commercial logic, not before it.
A PRECEDENT ALREADY SET
The eCitizen marketplace proposal did not emerge in isolation. Six months earlier, in a deal that attracted considerably more international attention, President William Ruto signed a health data agreement with the United States government that handed Washington 25 years of access to Kenyan health records, including personal medical files, genetic information, laboratory samples, and insurance data, in exchange for $1.6 billion over five years. The arithmetic worked out to roughly $5.66 per Kenyan per year.
That agreement was not anonymised. It was not aggregated. And it was not governed by Kenyan law. Wayan Vota, writing for ICTworks, observed that the deal “bypassed the Kenyan Data Protection Act, forgo[ing] anonymization guarantees,” and was structured under U.S. federal law rather than Kenyan jurisdiction. Opposition lawmakers in Nairobi described it as a sovereignty exchange, noting that Kenya had deployed 400 police officers to Haiti’s struggling peacekeeping mission under pressure from Washington and had narrowly avoided defaulting on $2 billion in debt in June 2025. The health data deal, critics argued, was the financial return on those commitments.
The government has not drawn a public connection between the health data agreement and the new eCitizen marketplace proposal. But observers watching both developments argue they reflect the same underlying logic: a fiscally pressured state discovering that the data it collects in the course of governing has a market value that it has not yet monetised.
| “Kenya is trading both digital and military sovereignty for American financial support.” — ICTworks analysis, December 2025 |
THE ENFORCEMENT GAP
Kenya passed the Data Protection Act in 2019 and established the Office of the Data Protection Commissioner to enforce it. By most assessments, the ODPC has grown in reach and ambition since then. In early 2026, it issued 184 compensation orders against organisations that had misused personal data, ranging from digital lenders who deployed debt-shaming tactics to institutions that had used citizens’ photographs without consent. The signal was intentional: the ODPC was moving from a regime of warnings into one of penalties.
But the new data marketplace proposal sits in a complicated relationship with that enforcement architecture. The government is not a regulated entity in the same way that a private digital lender is. The National Data Governance and Emerging Technologies Council, as proposed, would answer to the Ministry of Information, not to the ODPC. The PwC Kenya analysis of the country’s evolving data landscape, published in January 2026, noted that organisations entering 2026 should expect “more structured regulatory scrutiny” and “increased accountability for data governance and privacy failures.” That scrutiny, however, was understood to apply to the private sector, not to the government commercialising its own holdings.
The question of who regulates the regulator has no clear answer in the draft policy. Civil society organisations in Nairobi have flagged the gap. They argue that any marketplace built on data generated by citizens interacting with public services carries an implicit consent problem: Kenyans who registered businesses on eCitizen or recorded births in a government system did so because those processes were legally required, not because they agreed to have the aggregated traces of those interactions sold to a pharmaceutical company or an agricultural data firm. The draft policy does not address that asymmetry.
THE REVENUE LOGIC
The government’s fiscal motivations are not difficult to identify. Kenya’s projected ordinary revenue for the 2025/26 financial year stands at KSh 3,383 billion, a figure that leaves limited room for new spending given rising debt service obligations and the collapse of USAID and PEPFAR funding that had previously supported a substantial share of the national health budget. The eCitizen marketplace, costing up to KES 396 million to build, is not a solution to that fiscal pressure. But it signals a philosophy: that Kenya’s digital infrastructure, built on the mandatory participation of 56 million citizens, can be reoriented as a commercial asset.
The opportunity is real. The U.S. International Trade Administration estimates Kenya’s AI market at approximately $240 million in 2024, with strong growth anticipated. Separate projections suggest the country’s data-centre market could reach $805 million by 2031. Demand for structured public datasets is rising across financial services, agricultural forecasting, urban logistics, and credit modelling. The government is not wrong to see a market.
International precedent offers a mixed picture. Singapore’s public data portal makes thousands of datasets available to developers and researchers at no cost, prioritising ecosystem development over direct revenue. The United States, which Kenya appears to be modelling in part, has generated hundreds of millions of dollars through state-level vehicle and licensing data sales, but that system has produced years of litigation, regulation, and public backlash over privacy violations. The Innovation Village analysis published in June 2026 noted plainly: “For the initiative to work, Kenya will need strong safeguards to ensure that anonymised data cannot be re-identified or misused.” None of those safeguards have been specified yet.
WHAT CONSENT ACTUALLY MEANS
Kenya’s Constitution, under Article 31, enshrines the right to privacy as a fundamental guarantee. The Data Protection Act of 2019 operationalises that right, requiring that personal data be processed only with informed consent and for stated, lawful purposes. The government’s position is that the eCitizen marketplace does not implicate those provisions because the data being sold is not personal.
Critics are not persuaded. The consent that citizens gave when using eCitizen was consent to access a government service, not consent to have the statistical residue of that interaction packaged and sold. The distinction matters legally and ethically, particularly given the enforcement climate the ODPC has been building since 2026. If a private company were to collect equivalent data from millions of users and sell it commercially without disclosure, it would face regulatory action. The draft policy does not explain why the same logic should not apply when the collector is the state.
What the government is proposing is not without legitimate precedent or potential benefit. Better public data, properly governed, can improve credit access, agricultural planning, disease surveillance, and urban infrastructure. The question Kenyans are now being asked to answer, without being explicitly asked at all, is whether they trust the state to govern that marketplace in their interest rather than in the interest of the budget line.
Given the precedent set by the health data agreement signed in Nairobi in late 2025, it is a question that deserves a public answer before the marketplace opens.
Stay ahead of the stories shaping our world. Subscribe to Impact Newswire for timely, curated insights on global tech, business, and innovation all in one place.
Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.
Got a story to share? Pitch it to us at info@impactnews-wire.com and reach the right audience worldwide
Mohd Hassan has extensive experience in news gathering, editing, and writing for the newswire industry, Contact – Info@impactnews-wire.com
Discover more from Impact Newswire
Subscribe to get the latest posts sent to your email.
