Abstract
<jats:p>This case study examines the constitutional, regulatory and operational difficulties that have attended Kenya’s three successive attempts to deploy a national digital identity system: the Huduma Namba (2019), the Huduma Card (2021) and the Maisha Namba (2023 to present). Each generation has been challenged in the High Court, and in each case the same legal flaw has been determinative: the state proceeded with population-scale processing of personal data without first conducting a data protection impact assessment under section 31 of the Data Protection Act, No. 24 of 2019. The case asks how a state should respond when its preferred operational path has been twice declared unlawful, and a third generation of the same system is now before the courts.</jats:p>