Ownership Without Control: AI, Health Data, and the Price of Development

🔗 원문 전체 보기 → Substack.com

요약

When the powerful write the rules, the powerless pay — in Nairobi and in Washington alike" publication: Lex Machina Kenya author: Timon Tindi Jobic date: May 2026 #AIGovernance, #DataProtection

본문

When the powerful write the rules, the powerless pay — in Nairobi and in Washington alike" publication: Lex Machina Kenya author: Timon Tindi Jobic date: May 2026 #AIGovernance, #DataProtection

There is a particular kind of arrangement that looks like generosity from the outside and operates as extraction from within. The terms are dressed in the language of partnership. The signing ceremonies are photographed at the highest levels. And by the time the fine print is read — if it is read at all — the machinery is already running.

We are living through several of these arrangements simultaneously: in government health registries, bilateral diplomatic frameworks, and federal data warehouses. In each case, the mechanism is the same. Algorithmic systems are deployed at scale, ahead of the legal frameworks that should govern them, on populations who have no meaningful ability to consent, object, or appeal in time to matter.

Thanks for reading! Subscribe for free to receive new posts and support my work.

This essay is about three convergent stories: the United States’ Department of Government Efficiency (DOGE) and its unprecedented raid on Americans’ personal data; Kenya’s Social Health Authority (SHA) and an AI means-testing system that quietly overcharges the poor while giving the wealthy a discount; and a $2.5 billion Kenya–US health deal that courts have been fighting over since December 2025. Together, they tell a single story about what happens when AI is deployed by the powerful, on the vulnerable, without adequate legal guardrails — and what it looks like when courts and citizens decide to push back.

I. The DOGE Blueprint: Efficiency as Cover for Overreach

In early 2025, the Trump administration’s Department of Government Efficiency — operating under Elon Musk’s stewardship — began accessing the personal records of millions of Americans across multiple federal agencies, including the Social Security Administration, the Internal Revenue Service, and the Department of Health and Human Services.

The data accessed included Social Security numbers, bank accounts, medical histories, income records, and benefit payment histories. No individual consent was obtained. No public participation process was conducted. According to analysis from the US Senate Intelligence Committee, DOGE personnel connected personal devices to sensitive government networks without following standard cybersecurity protocols — exposing the data of tens of millions of Americans to entirely novel risks.

The stated rationale was efficiency: the elimination of “waste, fraud, and abuse.” The Privacy Act of 1974 — passed after the Watergate scandal to prevent precisely this kind of executive surveillance — was treated as an obstacle rather than a guardrail. Federal courts stepped in, with several judges ruling that the government had violated the Privacy Act. But the administration continued, sometimes successfully appealing those restrictions.

The DOGE model reveals something important: when efficiency is invoked as justification, data protection frameworks collapse. The algorithm doesn’t ask whether the access is lawful. It just processes. The danger is not only the immediate privacy violation — it is the precedent. If a superpower can sweep up the personal data of its own citizens under the banner of administrative reform, what signal does that send to governments elsewhere about the acceptability of algorithmic overreach?

The same logic — efficiency over rights, speed over accountability, deployment ahead of legal frameworks — was already running in Kenya’s health system. And it was doing so with the full knowledge of the government that built it.

II. SHA’s Broken Algorithm: When the Poor Pay More

When President Ruto launched the Social Health Authority in October 2024, the promise was historic: universal health coverage for every Kenyan, an end to the harambees — the community fundraisers — that families relied on to pay hospital bills. The NHIF was to be replaced by something smarter, more equitable, more data-driven.

What emerged instead was a case study in algorithmic harm.

At the heart of SHA’s premium-setting system is a method called Proxy Means Testing (PMT) — a machine learning model that predicts household income not by asking what people earn, but by examining what they own. Does the house have an iron roof? Is there electricity? What kind of sanitation is used? Forty-three variables feed the model, drawn from the 2021 Kenya Household Census.

An investigation by Africa Uncensored, Lighthouse Reports, and The Guardian revealed the result: the algorithm systematically overcharges the poorest Kenyans and underestimates the wealth of the rich. A struggling farmer with an iron-sheet roof and an electricity connection — perhaps the result of a government rural electrification programme — is assessed as “middle-income.” Their premium can consume between ten and twenty percent of their income. Meanwhile, wealthier households whose assets are less visible to the algorithm pay proportionally less.

Florence, an unemployed mother in Huruma, was assigned a premium of Ksh 6,600 per year — an impossible sum for her family. When she appealed, the system rejected her request because her premium did not meet the minimum threshold for reconsideration. The algorithm had created a Kafkaesque trap: too poor to pay, but not poor enough to qualify for a review. Community Health Promoters report that critically ill people are being denied care at hospitals because the system lists them as ineligible.

The most damning detail is not the bias itself, but the timeline. A pre-deployment report by data consultancy IDinsight — obtained by journalists — warned that the SHA system was “inequitable, particularly for low-income households.” The government deployed it anyway. On 20 million people. This is not a technical failure. It is a policy choice — one that transferred accountability from elected officials to opaque code.

Health economist David Khaoya, who advised Kenya’s health ministry, confirmed the structural nature of the problem: the system was deliberately calibrated to accurately assess the wealthy, even at the cost of overcharging the poor. “If you identify a richer person as poor and therefore ask him to pay less,” he said, “this person will never own up and say, ‘I’m actually supposed to be paying more.’”

Brian Lishenga of Kenya’s Rural and Urban Private Hospitals Association put it more bluntly: “This is an experiment that has failed. It’s a really poor tool for identifying poor households. It’s a great tool for helping the government run away from responsibility.”

The SHA crisis is Kenya’s domestic DOGE moment. In both cases, algorithmic systems are deployed by governments on their own populations without meaningful transparency, without adequate appeals mechanisms, and without legal frameworks capable of holding the algorithm to account. The difference is scale. The similarity is structure.

III. The Health Deal: Diplomacy, Data, and the Question of Leverage

On December 4, 2025, President Ruto and US President Trump witnessed the signing of the Kenya–US Health Cooperation Framework in Washington D.C. — a deal valued at $2.5 billion, structured to run from 2026 to 2030. The framework covered disease surveillance, health systems strengthening, management of global epidemics, and — critically — the sharing of health data between the two countries.

Within days, civil society moved. The Consumer Federation of Kenya (COFEK) and Senator Okiya Omtatah filed separate petitions in the High Court. COFEK argued that the data-sharing provisions violated the Data Protection Act, the Digital Health Act, the Health Act, and the Digital Health Regulations of 2025. Omtatah challenged the deal’s constitutionality on broader grounds: lack of public participation, absence of parliamentary oversight, and fiscal provisions that could strain Kenya’s budget — including an $850 million spending commitment that had received no parliamentary approval.

On December 11, Justice Bahati Mwamuye issued conservatory orders suspending the data-sharing components. On December 19, Justice Chacha Mwita went further — halting the entire framework pending full hearing. The Court of Appeal, in May 2026, temporarily restored the government’s ability to proceed, pending a final ruling scheduled for October 30, 2026.

The legal battle continues. But the deeper questions it has surfaced are not merely procedural.

IV. What’s In It For Washington? The Anatomy of the Deal

This is the question that the Kenyan government’s public statements have consistently sidestepped.

The deal’s own text provides the answer. Article 1 of the bilateral agreement states: “The purpose of this Agreement is to establish the terms and conditions under which the Government of Kenya shall provide the US Government with data, derived from Health Programs supported through the Cooperation Framework.” The primary US interest is stated plainly in the document — health sector data from Kenya.

The companion MOU guide is equally direct, describing the objective as establishing terms that will “advance US interests, save lives and help countries build resilient and durable health systems.” The strategic rationale: “To keep America safe from infectious disease threats, all countries should generally have the same vision: a surveillance and outbreak response capability.”

Kenya, in other words, functions as an early warning system. The US gains access to Kenya’s digital health infrastructure, outbreak databases, disease surveillance networks, and — most significantly — genomic sequence data of diseases circulating in East Africa. Kenya is described in the agreement’s own framing as a “key location for spotting new diseases.”

The terms of exchange are time-asymmetric in a way that critics have called lopsided. Kenya receives five years of funding. The US retains data access for up to 25 years — including for a decade after any agreement is terminated. Digital health systems evolve. Laws change. Governments turn over. Yet the access persists.

Critics have also flagged paragraph 18 on Intellectual Property, arguing that the agreement gives Kenya ownership on paper while ceding practical control. Data advocates say there is no mechanism in the agreement to audit, monitor, review, or limit how the US government uses the data once it is shared. As the Health and Human Rights Journal concluded: “Data ownership without effective control risks becoming symbolic rather than substantive.”

The government has pushed back on the most alarming characterisations. Health CS Aden Duale has stated that the agreement does not permit sharing of individual medical records or personally identifiable information, that it focuses on aggregate epidemiological data, and that Kenyan law prevails under Article 5(f) where any conflict arises. Article 2(a) requires strict compliance with Kenya’s Data Protection Act and Digital Health Act.

But critics raise a concern that these formal protections do not resolve: the agreement does not account for AI’s ability to re-identify individuals from anonymised datasets. A postdoctoral fellow at the Free State Centre for Human Rights in South Africa, writing in JURIST, noted that while Kenya secured important legal protections in the agreement, the deal — like data protection frameworks across Africa — fails to address the unique privacy risks posed by AI’s capacity to reverse-engineer individual identities from aggregate health data. You can promise not to share names. You cannot promise that names cannot be recovered.

There is also the geopolitical dimension. The America First Global Health Strategy — under which this deal sits — has been characterised by analysts as a deliberate pivot away from multilateral health governance. USAID was dismantled in July 2025. The US withdrew from the WHO. In their place: direct, bilateral, government-to-government arrangements that route US influence through individual capitals, bypassing the accountability mechanisms of multilateral institutions.

The sequence matters and should be named. USAID’s dismantling created an immediate funding crisis across African health systems — HIV medication stockouts, TB treatment gaps, collapsed maternal health programmes. The AFGHS bilateral deals were then offered to fill that void. The price of filling it: data. The old system was dismantled. A replacement was offered. The terms of that replacement included access the old system never required. Each bilateral deal is, structurally, a relationship that cannot be collectively negotiated or challenged. That is not incidental — it is the design. Washington did not simply exploit a crisis. It created the conditions under which African governments had little choice but to negotiate individually, from weakness, on terms set elsewhere.

V. The African Pushback: Kenya Was Not Alone

Kenya’s High Court fired an early judicial shot, but Africa’s resistance to the AFGHS has been broader than any single courtroom.

In the four months following Kenya’s signing, twenty-two African countries signed bilateral agreements under the America First Global Health Strategy. By late April 2026, Washington had signed 32 deals globally, representing $20.6 billion in commitments — $12.8 billion from the US, and $7.8 billion in co-investment pledged by recipient governments. But a growing number of those governments have begun to question what they are giving up to access the money.

Ghana rejected its proposed deal entirely. The executive director of Ghana’s Data Protection Commission stated publicly that the scope of data access requested “went far beyond what would typically be required.” Ghana is now seeking a renegotiated agreement.

Zambia halted talks after its deal was tied to cooperation around copper and cobalt — making the link between health funding and resource extraction explicit, in a way that stripped away any pretence of pure humanitarian intent.

Zimbabwe walked away over clauses requiring rapid sharing of pathogen data. In the DRC, lawyers challenged the MOU in court.

More than 50 civil society organisations across the continent published a joint appeal urging African governments not to sign, warning that the bilateral structure was deliberately designed to prevent collective pushback. “Bilateral agreements between the US and individual African countries are meant to limit the ability of any one partner country to challenge the terms,” said Ravi Ram of the People’s Health Movement, “due to the unequal power relations involved.”

Chatham House analyst Ebere Okereke has argued that African countries should respond strategically: reclaim the narrative around aid dependency, negotiate collectively to increase leverage, resist tied aid to protect industrial policy, and insist on reciprocity in the sharing of surveillance data. African governments, she argues, should not reject the strategy out of hand — but should ask hard questions about the alternatives, and about whether the terms as structured serve their citizens’ long-term interests.

The continent is not speaking with one voice. Many governments have signed with relatively muted public debate — including Botswana, Rwanda, and Mozambique. Others like Nigeria and Uganda have signed but are not without internal challenge: Nigeria faces civil society questions over religious provisions in its agreement, after it emerged that approximately $200 million in US support was designated for Christian faith-based healthcare facilities in a country of significant religious diversity. Uganda’s opposition, meanwhile, has demanded parliamentary review along the same lines Kenya’s courts enforced — opposition leader Joel Ssenyonyi stating plainly: “If this is such a good deal, it must be brought to Parliament for review.” The fracture is real: health systems devastated by the dismantling of USAID and PEPFAR cuts need funding now. The leverage Washington holds is not abstract. It is measured in HIV medication stockouts, TB treatment gaps, and maternal mortality rates.

That is precisely what makes the question of terms so important. Accepting aid under conditions that compromise data sovereignty is not a free choice when the alternative is preventable deaths. The question is whether Washington is offering a genuine partnership — or exploiting a crisis of its own making.

VI. The Regulatory Gap — and Whether Kenya’s New Laws Can Fill It

Both the SHA crisis and the health deal expose the same structural vulnerability: Kenya has the constitutional architecture to protect its citizens, but the specific legislative framework for AI governance is still being built in real time.

The Data Protection Act 2019 provides some cover — it limits decisions made solely by automated means when those decisions carry legal or significant adverse effects. But it was never designed for PMT-scale algorithmic deployment across 20 million people, and its enforcement capacity has not kept pace with the speed of deployment.

The Artificial Intelligence Bill 2026, recently tabled, moves in the right direction. It adopts a risk-based classification model modelled on the EU AI Act, categorising AI systems by their potential for harm. Critically, it requires all providers and deployers of AI systems — not only high-risk ones — to disclose to users the nature, purpose, and limitations of the system, the extent of automated decision-making, and the measures taken to mitigate biases. For high-risk AI, Data Protection Impact Assessments are mandatory.

Had this bill been in force before SHA was deployed, the IDinsight pre-deployment warning — which explicitly flagged inequity for low-income households — would have triggered a legal obligation to redesign or delay the system. Florence in Huruma would have had a law on her side before the algorithm ever ran. That is exactly the structural check that algorithmic governance requires. The bill’s limitation, flagged by legal commentators, is that the layering of AI-specific obligations on top of existing data protection requirements may create a duplicative compliance regime — one that is administratively complex without adding proportionate protection.

The Data Protection (Amendment) Bill 2025 strengthens the existing framework further, proposing significantly higher fines — up to Ksh 5 million or 1% of annual turnover, whichever is higher — and expanding categories of sensitive personal data.

But bills are not yet law. And in the gap between policy ambition and legislative reality, Kenyans are being overcharged for health insurance by an algorithm the government knew was flawed, their health data is being contested across multiple courtrooms, and foreign entities are being offered access to their most intimate biological information under terms that have never been debated by parliament.

VII. The Judiciary as the Last Line

There is, in all of this, a thread of genuine hope — and it runs through Kenya’s courts.

The High Court’s December 2025 intervention in the Kenya–US health deal was not a minor procedural matter. It was a constitutional statement: that executive enthusiasm and diplomatic prestige do not override the rights of citizens to privacy, to public participation, and to parliamentary oversight. Justice Mwita’s order established that even agreements witnessed by two heads of state must meet Kenya’s constitutional standards before they take effect.

The Court of Appeal’s subsequent, temporary restoration of the deal does not erase that principle. The constitutional questions remain live. The October 2026 ruling will be one of the most significant digital rights judgments in Kenya’s history.

This is the judiciary doing exactly what it should: not blocking development, but insisting that development be lawful. The same instinct animates the SHA challenge — a growing chorus of health economists, advocates, and community health workers demanding that the algorithm be made transparent, auditable, and correctable.

Kenya’s Constitution — drafted in 2010 with explicit and enforceable digital and privacy rights — gives its courts a mandate that many older constitutional frameworks do not. Article 31, which protects the right to privacy, has proven to be a genuine constraint on executive power, not merely an aspiration. That is worth noting in a continental context where constitutional rights to privacy often exist on paper but rarely reach courtrooms in time to matter.

Conclusion: Who Writes the Rules?

The pattern across DOGE, SHA, and the Kenya–US health deal is the same: powerful institutions deploy data and algorithmic systems at scale, ahead of the legal frameworks that should govern them, on populations who have no meaningful ability to consent or object in real time.

The DOGE model showed what happens when a government decides that its own citizens’ data is an administrative asset to be optimised. The SHA model showed what happens when an algorithm designed to serve the poor is calibrated, knowingly, to protect the wealthy instead. The health deal model shows what happens when one country’s early warning system is another country’s medical record.

In each case, the justification is compelling in the abstract: government efficiency, universal health coverage, global pandemic preparedness. These are not bad goals. They become dangerous when they are used to foreclose the questions that democratic governance requires: Who decided this? What are the terms? Who bears the risk? Who can appeal?

Kenya’s AI Bill 2026, its Data Protection Amendment, its assertive judiciary — these are the beginnings of an answer. But beginnings are not conclusions.

The deeper lesson is this: AI governance is not a technical problem. It is a power problem. The question of who writes the rules is the question of who gets protected. Until the communities most exposed to algorithmic systems — Florence in Huruma, the farmer with the iron-sheet roof, the citizen whose genomic data will outlive the agreement that governs it — have a meaningful seat at the table where those rules are written, the dog will keep wagging.

Timon Tindi Jobic writes on AI, law, and justice in East Africa at Lex Machina Kenya. He is currently enrolled in AI, Justice and the Rule of Law at the University of Oxford's Saïd Business School, in partnership with UNESCO and the Blavatnik School of Government.

Thanks for reading! Subscribe for free to receive new posts and support my work.