Petition filed against NTSA's new e-sticker over privacy and fraud concerns

The complaint, filed by Peter Agoro and John Wagai under the Data Protection Act, challenges the implementation of the Traffic (Motor Vehicle Inspection) Rules, 2026, which came into force on July 1, 2026.

The petitioners argue that the new inspection E-Sticker requires motorists to publicly display sensitive personal and vehicle information on their windscreens, including the vehicle owner's full name, registration number, engine number, chassis number, vehicle identification number (VIN), vehicle model, colour, fuel type and inspection expiry date.

According to the complainants, the information displayed on the sticker is equivalent to the contents of a vehicle logbook and was previously accessible only through NTSA's secure database.

"The E-Sticker scheme reverses this entirely by mandating the permanent, compelled and continuous public broadcast of all this data on every inspected vehicle's windscreen," the complaint states.

The petitioners contend that the mandatory display of such information creates a serious security risk, exposing vehicle owners to identity theft, fraudulent logbook loans, forged ownership transfers, vehicle cloning and targeted vehicle theft.

They further argue that the risks are heightened by the recent rollout of NTSA's eLogbook system, which is integrated with banks, microfinance institutions, savings and credit cooperatives and insurance companies to facilitate vehicle-backed financing.

"The simultaneous operation of the E-Sticker data-broadcast scheme and the eLogbook financial integration creates a specific, serious and nationwide systemic vulnerability," the complaint reads.

The complainants accuse NTSA of introducing the system without conducting a Data Protection Impact Assessment, issuing a privacy notice to motorists or implementing security measures to safeguard personal information.

They also argue that there was no lawful basis for compelling motorists to publicly display personal data and that the scheme violates Articles 28, 31, 40 and 47 of the Constitution, which protect human dignity, privacy, property rights and fair administrative action.

According to the petitioners, a less intrusive alternative exists.

"A sticker displaying only a unique certificate number and a QR code verifiable through the NTSA mobile application would fully achieve the intended regulatory purpose without exposing motorists' personal data," they argue.

In the complaint, the petitioners want the Data Protection Commissioner to immediately suspend the issuance of the current E-Sticker and compel NTSA to redesign it in compliance with the Constitution and the Data Protection Act.

They are also seeking a declaration that the current sticker is unconstitutional and unlawful, as well as compensation for all motorists who may suffer harm as a result of the alleged violations.

The complaint relies on the High Court decision in the case of Arunda v Office of the Data Protection Commissioner & Another (2025) which held that complaints involving alleged breaches of privacy rights must first be presented before the Data Protection Commissioner before being escalated to court.

The Office of the Data Protection Commissioner is expected to consider the complaint and determine whether NTSA's new inspection sticker complies with Kenya's data protection and privacy laws.