A clear example of this comes from the Kenyan government’s ambitious Affordable Homes Program (AHP), which relies on ADM to give effect to the right to accessible and adequate housing as guaranteed by Article 43(1)(b) of the Constitution.[1]  In response to the challenge of affordable housing shortages in Kenya, one of the government’s main aims under its so‑called Big Four Agenda has been to deliver at least 500 000 affordable homes to Kenyans by 2022.  In order to achieve this, amongst other things, a national housing portal – aptly named BomaYangu, with ‘boma yangu’ meaning ‘my home’ in kiSwahili – was developed in order to process housing applications.  BomaYangu, in turn, functions as part of a broader system which includes the implementation of a credit and risk decision-making system (CRD System) which is purportedly ‘fully automated’.[2]

Amongst other things, the CRD System collates device metadata, psychometric profile data, data from social networks and email, data from telecoms and utility service providers, and data from credit bureaus in order to autonomously develop credit profiles.  Without ‘passing’ the credit check stage of the process, which relies on credit profiles developed by the CRD System, applicants for affordable housing finance are screened out.  This immediately implicates the general right of data subjects, set out in section 35(1) of the DPA, not to be subjected to ADM which produces legal effects concerning or significantly affects the data subject, including ADM which amounts to ‘profiling’, of which the operation of the CRD System is self evidently – and intentionally – a form.

While section 35(2) of the DPA contains exceptions to the general rule set out in section 35(1), including one which permits the use of ADM in this context if consent is given by the data subject, section 35(3) also imposes a number of obligations on data controllers and processors including notifying the data subject in writing that a decision has been taken based solely on automated processing and that the data subject may, after a reasonable period of receipt of the notification, request the data controller or data processor to reconsider the decision or take a new decision that is not based solely on automated processing.  In the event that a data controller or data processor receives a section 35(3) request, they must within a reasonable period of time consider the request, including any information provided by the data subject that is relevant to it, comply with the request and, by notice in writing, inform the data subject of the steps taken to comply with the request and the outcome of complying with the request.

From a fundamental rights perspective, moreover, it is clear that the AHP was intended to give effect to the right to accessible and adequate housing, and each step of its implementation process accordingly has the capacity to effect the extent to which the right is ultimately realised.  But it also implicates other rights.  For example, because the operation of the CRD System, which, as an ‘act, omission or decision of any person, body or authority that affects the legal rights or interests of any person to whom such action relates’, constitutes ‘administrative action’ for purposes of the Fair Administrative Action Act (FAA Act) and the Constitution, it also implicates the right to fair administrative action contained in Article 47 of the Kenyan Constitution and the FAA Act which was passed to give effect to that right .  Simply put, then, the CRD System arguably makes administrative decisions which form part of a larger policy framework intended to give effect to the right to accessible and adequate housing.  The manner in which the CRD System operates is thus also subject to the substantive and procedural rules of administrative law – in addition to being open to potential constitutional law scrutiny.[3]

To the extent that the CRD System prevents individuals from fully and equally enjoying the right to accessible and adequate housing, the right to equality and freedom from discrimination contained in Article 27 of the Constitution is also implicated by the operation of the CRD System.  As such, if the algorithms underpinning the CRD System were, for example, to operate in a manner which results in gender discrimination or discrimination on any other constitutionally protected ground such as race, age or marital status, administrative and other legal rights and recourses would come into play.  The same logic equally applies to the right to the privacy and consumer rights contained in Articles 31 and 46 of the Constitution respectively.  This is of great importance given that the operation of the CRD System constitutes a form of profiling.

Finally, citizens’ rights to access to information, enshrined in Article 35 of the Constitution, are of relevance in that citizens are entitled to access to information held by the public or private sector in relation to the CRD System required for the exercise or protection of any of the rights discussed above.  The Access to Information Act and the DPA contain the substantive and procedural rules necessary to exercise this right.  Citizens’ right to access to information are also of relevance because every person has the right to the correction or deletion of untrue or misleading information that affects that person.  This is of particular importance because the CRD System relies on a variety of data sources in producing credit profiles, and it is perfectly conceivable that untrue or misleading data may be relied on in order to do so.

The above description and analysis only begin to illustrate the broad array of questions that are likely to arise when ADM is used to give effect to fundamental rights or used in facilitating the delivery of public services more generally.  In the event that existing legal frameworks – which may well already be up to the task of protecting fundamental rights – are not enforced, the manner in which ADM systems operate clearly have the ability to impede the realisation of fundamental rights.  Given the opaque manner in which many ADM technologies are developed and the complexity of the actual technologies often involved, moreover, it may be challenging to assess the extent to which ADM systems are (or are not) legally compliant without concerted efforts to obtain access to pertinent information and undertake the necessary (often painstaking) work required to properly assess the implications of complex ADM systems.  It thus becomes a concerning possibility that ADM systems will operate in exclusionary ways without there being any general knowledge of these exclusionary effects (or alternatively their extent).

It is also quite possible that existing legal frameworks need to be developed further to keep pace with the rise of ADM and related technological developments.  In this context, it also serves us well to recall the reason behind the rise of ADM; that is, its implementation is touted for its cost saving abilities and potentially delivery efficiency gains.  In the event that existing legal frameworks are enforced as they currently stand – for example through asserting rights such as those contained in section 35 of the DPA, through litigating fundamental rights cases and undertaking data protection impact assessments in order to properly assess the actual and potential impacts of things like the CRD System – the associated costs and inefficiencies may very well defeat the entire purpose of using ADM technologies in the first place.

While this piece perhaps raises more questions than it provides answers, the hope is simply to encourage engagement with the subject matter.  The use of ADM in processes aimed to give effect to fundamental rights and public services is only likely to become more common – an extensive body of careful research will only aid us in making the most of it as it does.

[1] This and several other pertinent examples are examined in a forthcoming report I have produced with Fola Adeleke and Gabriella Razzano, titled ‘Algorithms and Administrative Justice: A Review of African ADM Implementation’, which will publicly become available in the coming months.

[2] A more detailed explanation of how the AHP works in totality is provided in Adeleke, Beyleveld and Razzano (n 1).

[3] As argued in Adeleke, Beyleveld and Razzano (n 1), this remains the case even if implementation of the CRD System is outsourced to the private sector.