Kenya’s government is once again seeking to give the Kenya Revenue Authority (KRA) sweeping access to personal and customer financial data just months after a similar move sparked public outcry and mass protests.
In the proposed 2025 Finance Bill, the National Treasury is pushing to delete a legal safeguard—Section 59A(1B) of the Tax Procedures Act that currently prevents the KRA from demanding trade secrets or sensitive personal data held by businesses on behalf of their customers.
The proposed change is straightforward but consequential:
“Section 59A of the Tax Procedures Act is amended by deleting subsection (1B),” the draft bill reads.
That clause, enacted in December 2024 after intense public pressure, explicitly bars the tax agency from compelling firms to share data tied to trade secrets or customer privacy. Its removal would give KRA direct access to mobile money and bank transactions, raising fresh concerns over surveillance and data protection.
The move signals a renewed push by the government to use data access as a tax compliance tool, a shift that rekindles a tense debate about state overreach and the erosion of privacy rights.
This is not the first time the Treasury has tried to loosen data protections for tax enforcement. In the 2024 Finance Bill, it proposed amending the Data Protection Act to give the KRA unrestricted access to information held by data controllers and processors, including banks, telcos, schools, utilities, and even the NTSA without requiring a court order.
That effort was met with fierce resistance. The National Assembly’s Finance Committee ultimately rejected the proposal, citing existing legal frameworks. It argued that Section 60 of the Tax Procedures Act already permits the KRA to access data provided it obtains a warrant. Civil society groups, including the Law Society of Kenya and Amnesty International Kenya, condemned the proposal as unconstitutional. Mass youth-led protests erupted nationwide, forcing the government to back down.
Now, under Treasury Cabinet Secretary John Mbadi, the state appears to be trying a subtler route. Rather than amending the broader Data Protection Act, the 2025 bill simply removes a specific privacy clause from the tax code effectively achieving the same end through narrower legislative changes.
Officials argue the Finance Bill is part of a broader effort to close tax loopholes and expand the revenue base. But critics warn that deleting Section 59A(1B) would fundamentally alter how KRA interacts with Kenya’s financial ecosystem raising urgent questions about checks, balances, and digital rights.