On 10th December 2025, the High Court of Kenya issued ex parte conservatory orders restraining the Government of Kenya (GOK) from implementing or operationalising the health cooperation framework executed between GOK and the United States of America (US) on 4th December 2025. The Kenya–US cooperation framework forms part of a new bilateral model of U.S. health assistance under its current global health strategy, with similar agreements already being pursued with other African states. The conservatory orders are temporary, remaining in effect pending the inter partes hearing of the matter, and apply insofar as the framework provides for or facilitates the transfer, sharing, or dissemination of medical, epidemiological, or sensitive personal health data from Kenya to the US.
The orders followed a petition filed by the Consumer Federation of Kenya (COFEK), which contended broadly that the framework was concluded without due regard to the constitutional principles of transparency, accountability, and public participation under Article 10 of Kenya’s Constitution. The Petition further alleged that the framework envisages the transfer of health data of persons living in Kenya (characterised as sensitive personal data), to the US in a manner inconsistent with the Data Protection Act, 2019 (“the DPA”).
The Government, through the Office of the Attorney-General, has since filed an application seeking, among other reliefs, a stay and the setting aside of the ex parte orders pending the substantive hearing. As the matter remains sub judice, this commentary refrains from expressing a view on the merits and instead highlights the legal questions arising from the proceedings.
These proceedings provide a timely opportunity to examine data governance in Kenya in the context of bilateral agreements between states, particularly where the data to be shared is in aggregate and de-identified form, yet the foreign recipient is granted access to Kenya’s domestic health information systems. The DPA and its regulations set out clear requirements for cross-border transfers of personal data. Before any such transfer, a data controller must ensure that appropriate safeguards are in place, obtain an adequacy decision from the Data Commissioner, and ensure that, where transfers are based on necessity or public interest, the rights and freedoms of data subjects are respected. In the case of sensitive personal data, the explicit consent of the data subject is required.
The Digital Health Act, 2023 complements this framework by introducing a statutory regime for the collection, storage, processing, and exchange of health data. The Act emphasises that all health data, including sensitive personal information, must be handled with due regard to privacy, confidentiality, and security. It also introduces classifications distinguishing aggregate, de-identified, and individually identifiable data. In the context of the Kenya–US health cooperation framework, the courts may be asked to clarify how these obligations apply where, although only aggregate data is shared, the foreign entity has access to Kenya’s health information systems locally.
The proceedings likewise offer an important lens through which the courts may address the principle of public participation under Article 10 of the Constitution. It will be instructive to see the court’s view on the timing and scope of public participation in the context of bilateral agreements, from negotiation and signing by the Executive to parliamentary ratification. In Kenya, the Treaty Making and Ratification Act, 2012 establishes procedures for treaty ratification, requiring all agreements negotiated by the Executive to be presented to Parliament for approval before acquiring legal force.
In case of any enquiries and/or for more information, please contact Cosima Wetende, Partner at LEX Africa member for Kenya, Kaplan & Stratton on CWetende@kapstrat.com or Allan Kimani on AKimani@kapstrat.com, or visit https://www.kaplanstratton.com/.
This publication is for general information only and is not intended to provide legal advice. It does not create an advocate–client relationship with Kaplan & Stratton. Readers should seek specific legal advice before taking any action based on its content.
--
Read the original publication at LexAfrica/Kaplan & Stratton
