Mwai Victor Brian

Posted on Jun 8

Kenya Accidentally Discovered a Gold Mine and Immediately Started Asking Who Wants to Buy the Dirt

#data #datagovernance #datastewardship

An analysis of Kenya's proposal to monetize government data and the larger opportunity the debate has so far overlooked.

Introduction: The Most Valuable Thing Kenya Owns Isn't Gold, Oil, or Land

Imagine waking up tomorrow and hearing the government announce:

"We have discovered a new natural resource. It exists in every county. It grows every day. It never runs out. It powers AI, business, research, innovation and economic growth. We estimate it could become one of Kenya's most strategic national assets."

Most Kenyans would think of oil.

Or rare earth minerals.

Or perhaps the mythical treasures politicians always promise are just around the corner.

But the resource already exists.

You created it.

I created it.

Every Kenyan with a birth certificate, a passport, a driving licence, a business permit, a tax PIN, a title deed, or an eCitizen account helped generate it.

That resource is data.

And now Kenya wants to monetize it.

The proposal sits inside a document called the Draft Final National Data Governance Policy, May 2026, published by the Ministry of Information, Communications and the Digital Economy under Cabinet Secretary William Kabogo and Principal Secretary John Tanui. It was developed and this matters more than it sounds, as you'll see with technical support from the European Union and Germany's GIZ.

The announcement triggered two predictable reactions.

One group shouted:

"The government is selling our personal data!"

Another group fired back:

"Relax. It's only anonymized data."

Both sides are oversimplifying a far more interesting story.

The draft is explicit: personal data names, phone numbers, email addresses, ID numbers, images will not be sold. That part is real, at least on paper.

So the real question was never whether Kenya should auction off your ID number.

The real question is deeper:

What should a country do when it suddenly realizes it owns one of the most valuable datasets on the continent?

And that's where things get fascinating.

Kenya Accidentally Built One of Africa's Most Valuable Data Assets

Let's start with a simple observation.

Most people think eCitizen is a website.

It isn't.

eCitizen is a gigantic national sensor.

It launched in 2013 as a small pilot between the Treasury and the World Bank, offering about ten services. Then, after a 2022 presidential directive to accelerate, it exploded.

Today it lists somewhere between 16,000 and 22,000 services across more than 100 government ministries, departments and agencies. According to the eCitizen Director-General, daily collections rose from around KES 60 million to between KES 700 million and KES 1 billion a day. It is now wired into the Maisha Namba digital identity system. Mobile penetration in Kenya sits at roughly 149%.

Read that scale again. Most adult Kenyans now touch this system.

And every time they do, they leave a footprint.

Every passport application.

Every business registration.

Every vehicle transfer.

Every marriage certificate.

Every land transaction.

Every tax interaction.

Every permit.

Every service request.

Individually, these records seem boring.

Collectively?

They become one of the most powerful economic intelligence systems ever assembled in this country.

Imagine being able to see, in something close to real time:

Which counties are creating the most businesses
Where migration is increasing
Which industries are expanding
Which regions are attracting investment
Where vehicle ownership is growing
How property markets are shifting
Which services citizens use most
How economic activity moves over time

Economists dream about data like this.

Researchers spend years trying to collect fragments of it.

AI companies spend billions hunting for datasets of this quality.

Kenya already has it.

Here's the irony.

We didn't build eCitizen to create a data asset.

We built it to avoid standing in queues.

The gold mine came free with the digital transformation.

We just never realized we were standing on it.

The Government's Pitch Sounds Reasonable

To be fair, the proposal isn't as outrageous as some headlines suggest.

The government's argument runs like this:

Data is a national asset.
Most government data sits trapped in silos.
Researchers and businesses need access.
Proper governance is overdue.
Anonymized datasets can create economic value.

Honestly?

Most of this is correct.

The draft policy contains genuinely excellent ideas:

A once-only principle citizens give their information once, and authorized agencies share it securely instead of asking you for the same documents ten times
Better interoperability between agencies
Shared standards and data quality
A national API gateway
A master-data system with "single sources of truth" for identity, business and land records
Less duplication
Stronger governance, with data officers in every ministry and county

These reforms are long overdue.

If the policy stopped there, it would arguably be one of the most important digital-governance reforms Kenya has attempted in years.

The trouble starts with one specific feature.

A national marketplace, where researchers, businesses, NGOs and innovators can buy anonymized and aggregated datasets. The reported target: at least 1,000 datasets over five years. The reported cost to build and run it: up to KES 396 million roughly USD 3 million.

The datasets reportedly under consideration include business-registration trends, passport and immigration application volumes by region, birth/death/marriage registration trends, vehicle-registration statistics, land-transaction volumes, traffic-flow patterns, and regional crop production plus data from the Kenya National Bureau of Statistics.

And that's where the conversation takes a dramatic turn.

Because someone in the room looked at this gold mine and asked:

"Since we have all this data… why don't we sell access to it?"

The Problem Isn't That Kenya Wants to Use Data

The problem is that Kenya jumped straight to the least imaginative use case.

Selling it.

Imagine discovering that your family owns 1,000 acres of fertile land.

You could:

Build farms
Grow food
Create jobs
Develop factories
Generate exports
Build wealth that compounds for generations

Instead, you sell truckloads of topsoil.

Yes, you'll make some money.

But you've sold the foundation of every future harvest.

That's what worries many of us in the data world.

Data isn't valuable because someone buys a spreadsheet.

Data is valuable because of everything built on top of it.

The spreadsheet isn't the product.

It's the raw material.

You don't get rich selling the dirt from a gold mine.

You get rich learning how to mine.

The Great Data Myth: "Anonymous Means Safe"

Now we arrive at the most misunderstood part of the entire debate.

Many people assume anonymization works like magic.

Remove names.

Remove ID numbers.

Remove phone numbers.

Problem solved.

Unfortunately, privacy doesn't work that way.

Data scientists have spent decades learning this lesson the hard way.

The most famous example happened in the United States in the late 1990s.

Researchers were given "anonymous" hospital records.

No names.

No obvious identifiers.

Completely safe, the public was assured.

Then a graduate student named Latanya Sweeney bought a voter-registration list for about twenty dollars and showed she could re-identify specific individuals using only three fields:

ZIP code
Date of birth
Gender

One of the people she identified was the Governor of Massachusetts. She reportedly mailed his own medical records back to him.

Sweeney later estimated that roughly 87% of Americans could be uniquely identified using just those three innocent-looking attributes.

It happened again with Netflix. In 2006 the company released "anonymized" movie ratings for a competition. Two researchers, Narayanan and Shmatikov, cross-referenced them with public IMDb reviews and re-identified users — exposing inferences as sensitive as political and sexual orientation.

It happened again in Australia, where "de-identified" health records had to be pulled after researchers cracked them.

The pattern repeated so many times that privacy researchers now have a saying, usually attributed to the cryptographer Cynthia Dwork:

Anonymized data isn't. Or it isn't data.

It's funny because it's true.

And slightly terrifying.

Because the more useful a dataset is, the easier it is to re-identify. And the safer you make it, the less it actually tells you. That trade-off doesn't disappear because a policy says "anonymized." It just gets hidden.

Four Data Points Are Enough to Find You

Here's the statistic that should make every policymaker pause.

Researchers studying mobile-phone mobility data found that just four location-and-time points were enough to uniquely identify about 95% of people.

Read that again.

Four.

Not forty.

Not four hundred.

Four.

For example:

Home at 7am
Office at 9am
A particular mall at 6pm
Church on Sunday

Congratulations.

You're now almost certainly unique in the dataset.

This matters enormously, because one of the datasets reportedly on Kenya's list is traffic and mobility patterns.

In privacy engineering, mobility data isn't the easy stuff.

It's the dangerous stuff.

It's the privacy equivalent of juggling chainsaws.

Can it be done safely? Yes with serious techniques like differential privacy, query-only access, and secure environments where outsiders compute on data they never get to copy.

Should anyone pretend it's risk-free?

Absolutely not.

And here's the quiet legal twist most coverage misses: the moment an "anonymized" dataset is re-identified, it stops being non-personal data. It becomes a personal-data breach, retroactively and Kenya's Data Protection Act, the Constitution's Article 31 right to privacy, and the Office of the Data Protection Commissioner all come crashing back into the picture. The "it's only anonymized data" defense evaporates the instant the anonymization fails.

The Question Nobody Is Asking

Media coverage has focused almost entirely on privacy.

That's important.

But it misses an even bigger question.

Suppose privacy concerns are solved.

Suppose anonymization actually holds.

Suppose governance is excellent and security is airtight.

Even then:

Why are we selling the data?

This is where Kenya's debate becomes genuinely interesting because the world's most successful digital governments often reached the opposite conclusion.

The European Union the same partner that helped Kenya develop this very policy built its flagship data law on the principle that high-value public datasets should be free, accessible to anyone through open APIs. Why? Because free reuse generates far more total economic value startups, products, jobs, taxes than access fees ever could.

Sit with that contradiction for a second. Kenya's own technical adviser made its most valuable data free. Kenya is proposing to charge for its.

Estonia became a global digital-government powerhouse without turning its data into a marketplace at all. It built X-Road secure data exchange between agencies and won the world's trust by letting citizens see exactly who accessed their records. It didn't sell the data. It circulated it, under trust.

India is the most uncomfortable comparison of all. In February 2022 it published a draft policy proposing to sell and license government data. It looked remarkably like Kenya's. Within months it was scrapped after researchers, lawyers and technologists warned it violated open-government principles and would push agencies to over-collect data in breach of data-minimization rules. The replacement framework quietly dropped monetization entirely.

Kenya appears ready to walk down a road India already turned back from.

So the obvious question is:

What do they know that we don't?

Or, more provocatively:

What do we know that they already learned the hard way?

The Trap Inside the Plan: When Money Makes You Collect More

There's a contradiction buried inside the policy that almost nobody is talking about.

Kenya's own Data Protection Act demands data minimization collect only what you need, keep it only as long as you must.

But the moment data becomes a revenue line, every agency gains a quiet incentive to do the opposite.

Collect more.

Keep it longer.

Link it wider.

More data means more inventory. More inventory means more to sell.

This is exactly the contradiction India's reviewers flagged before they killed their version. Paying for data, they warned, nudges the state to gather more than it should.

So here's the uncomfortable truth: a monetization motive doesn't just create privacy risk at the point of sale. It creates pressure, upstream, to harvest more of you in the first place.

The seller and the protector cannot live comfortably in the same body.

Don't Sell the Harvest. Build the Farm.

As a data scientist, I believe Kenya is asking the wrong question.

The question shouldn't be:

"How much money can we make selling government data?"

The question should be:

"How much value can Kenya create by using government data better than anyone else?"

This is the part that should excite us, because the answer is enormous.

Imagine pointing these same datasets inward at our own problems instead of shipping them out:

Catch the thieves. Cross-agency linkage to detect procurement fraud, ghost workers, and tax leakages. This alone almost certainly recovers more money than any marketplace fee and it exposes no citizen to a foreign buyer, because it never leaves the building. The biggest revenue story isn't selling data. It's plugging the holes the data can reveal.
Free the data for Kenyans first. Make the low-risk, high-value aggregates free for Kenyan universities, county planners, hospitals and startups. It is absurd that a taxpayer-funded university might have to buy back data that taxpayers created. Following the EU's logic, the downstream jobs and tax base dwarf whatever fees a paywall collects.
Build a Data Trust, not a data shop. Vest the data in an independent steward with a legal duty to act in citizens' interest insulated from fiscal pressure, with the ODPC guarding privacy. It licenses use, never ownership, never exclusively. Any surplus is reinvested or returned.
Let outsiders visit, not take. For sensitive data, use secure "data clean rooms" where approved researchers and firms compute on the data without ever copying it. You capture the insight while keeping the raw asset and the risk under national control.
Pay a data dividend. If real value is realized, return a share to the people who bore the risk through better digital services, connectivity, or a ring-fenced public fund.
Train Kenyan AI on Kenyan data. Build sovereign models for agriculture, health, and Swahili and indigenous languages instead of selling the raw material cheap to train models owned offshore. Keep the value-add, and the intellectual property, here.

The economic value of those applications could dwarf whatever revenue a marketplace generates.

In other words:

Selling the data may be the quickest way to make money.

But it is probably the weakest way to create wealth.

Those are not the same thing.

One produces a line item.

The other transforms a nation.

Don't sell the harvest.

Build the farm.

Data Is the New Currency

We keep being told that data is the new oil.

That metaphor is wrong in the way that matters most.

Oil is rivalrous and depletable. Burn a barrel and it's gone, and only one person can use it. Data is the opposite it can be copied endlessly, used by many at once, and it grows more valuable the more it is combined.

So data isn't the new oil.

Data is the new currency.

And currency only has value in one condition: circulation, under trust.

A coin locked in a vault does nothing. Money creates wealth by moving by being exchanged, by underwriting credit, by powering an economy that trusts it.

Data is the same. Its worth is unlocked when it flows between agencies, into research, through models, across an innovation ecosystem under rules people believe in.

Which means a nation should treat its data the way a sound central bank treats its money.

Protect its integrity.

Guard against counterfeiting here, re-identification and misuse.

Keep it in trusted circulation.

And never, ever sell the sovereign asset cheap to outsiders.

No serious country gets rich by selling its currency to foreigners at a discount. It gets rich by keeping a stable, trusted currency that powers everything built on top of it.

This dissolves the false choice at the center of Kenya's whole debate.

We were told the options were: hoard it in silos, or sell it in a marketplace.

But currency teaches a third way.

Circulate it. Under trust. For your own people first.

The most important insight from this entire debate is that Kenya already owns the gold mine. The diagnosis in the policy is right data is a strategic national asset. The instinct to govern it is right.

The only thing that's wrong is the impulse to stand at the mouth of the mine and ask who wants to buy the dirt.

Because in the twenty-first century, a country's most valuable resource isn't buried underground.

It's sitting in databases.

And the nations that prosper won't be the ones that sell the most data.

They'll be the ones that learn to use it most wisely — and make sure the wealth it creates flows back to the people who minted it in the first place.

A steward asks:

"How can this asset improve the lives of the people who created it?"

A seller asks:

"How much can we charge for access?"

Kenya is standing at exactly that fork.

Let's hope we choose to be stewards.

Because we didn't discover a pile of dirt.

We discovered a gold mine.

It would be a tragedy to sell it by the truckload.

A Note on Sources

This article draws on reporting from Business Daily, Daily Nation, People Daily, CIO Africa, TechTrends KE and Techweez on the Draft Final National Data Governance Policy (May 2026); the Ministry of ICT (ict.go.ke) and the eCitizen Director-General for platform scale and revenue figures; the Office of the Data Protection Commissioner and Kenya's Data Protection Act, 2019 (and Article 31 of the Constitution) for the legal frame; MediaNama, Deccan Herald and Mondaq for the Indian policy reversal; data.europa.eu and the European Commission for the EU's free high-value-datasets approach; and the academic literature on re-identification — Sweeney (Massachusetts/Weld), Narayanan and Shmatikov (Netflix), and de Montjoye et al. (the four-points/95% mobility finding). All policy figures are drawn from a draft under public consultation and should be verified against the final gazetted document before publication.