Recently, the Kenyan and U.S. governments signed a five-year bilateral health cooperation framework agreement for a U.S. investment of $1.6 billion. The Kenya-U.S. Health Cooperation Framework, now available online, has many strengths, but also includes a concerning agreement pledging Kenya to share health data with the U.S. government. The news has sparked controversy in Kenya. It deserves closer scrutiny in the U.S., too. Why is the U.S. government pressuring countries to share sensitive health data in exchange for aid, who will manage the data, and what is their end game?
Under the America First Global Health Strategy, the U.S. seeks more such bilateral agreements with low- and middle-income countries, including many that may now be feeling the pain of this year’s sweeping health aid cuts––and may be ready to negotiate. The Data Sharing Agreement signed in Kenya gives some indication of what may be to come, but raises many questions.
First, what the agreement does say: Kenya will provide data derived from health programs supported by the Cooperation Framework, including activities aimed at strengthening Kenyan digital health systems. The specific kinds of data are to be defined, and will include “aggregate level data” from “aggregate systems, dashboards and reporting tools”. The agreement commits the U.S. to upholding data confidentiality measures in Kenyan laws and regulations, and to only using the data for purposes consistent with the Cooperation Framework; however, those purposes are broadly defined. The Government of Kenya retains ownership of the data.
So far, so good, but the agreement leaves key questions unanswered. First, which U.S. Government agency will receive and store Kenyan health data? The Cooperation Framework was signed by the Secretary of State, but no specific agency is named in the data agreement. Given the dismantling of USAID, who in the State Department is left standing to manage and protect this sensitive information? Or will the data be handed over to some other agency?
The current U.S. administration does not have an encouraging track record in this regard. Elon Musk’s time as head of the Department of Government Efficiency, DOGE, controversially gave his team unprecedented access to private data of American citizens, including Social Security and tax data, valued by one report at close to $43 billion. Musk is one of many private actors who may have a strong interest in health data from Africa: As data governance becomes more robust in the U.S. and Europe, the demand for data to train artificial intelligence (AI) is increasingly urgent. Musk now owns a digital empire that draws on data from Starlink, Neuralink, Tesla, and X (Twitter), enabling him to hold a 360-degree view on the motivations and interests of thousands of individuals, and to train his AI chatbot. Whose job will it be to protect Kenyan health data from interested private actors–-be it Musk, Palantir, Big Pharma, or someone else?
The agreement is also unclear about which U.S. health data governance laws apply to Kenyan health data. It conspicuously does not mention the Health Insurance Portability and Accountability Act (HIPAA), the central robust U.S. standard for protecting patient health information protection. Does HIPAA apply to Kenyan data? Will American courts be willing to find out––and to uphold whatever protections apply, even in the face of pressure from the State department in the name of national security?
Health data could be used to train new vaccines and AI-enabled tools, but under the data agreement, the benefits do not automatically go to Kenya. Article 3 states, “All benefits obtained based on insights derived from data provided shall require entering into other subsidiary agreements.”
The Kenya-U.S. agreement thus leaves many gaps and inequalities in transborder health data governance. As Kenyan rights expert Allan Maleche notes, the agreement states that both countries follow their respective national laws, but this could break down if “Kenya’s strong privacy protections collide with United States national security laws on surveillance or use of genomic data. Whose legal standard prevails?” There is no clear route to remedy for Kenyan citizens who believe their privacy rights are violated. Paragraph 14 of the Cooperation Framework says that any differences are to be resolved through “consultations and negotiations through diplomatic channels”.
The Kenya-U.S. agreement highlight what Couldry and Mejias have described as new data colonialism in the geopolitics of the digital transformation. Sekalala and Chatikobo note that digital health has the potential to deepen digital coloniality; to increase dependence of low- and middle-income countries on platforms and technologies of the Global North, while entrenching discriminatory hierarchies in software, hardware and storage. Unless these questions are answered, the data agreement may prove their point.
Kenya has strong rule of law and a vibrant civil society, features that many other countries lack. Two recent civil society petitions to the High Court of Kenya focused on data protection rights, and on the need for parliamentary oversight. On December 12th, based on review of these petitions, the High Court of Kenya temporarily halted the “transfer, sharing or dissemination of medical, epidemiological, or sensitive personal health data” under the framework, pending further legal review.
The outcome of the Kenya court cases could shape what the U.S. is able to achieve in other countries. As Maleche commented on LinkedIn, “Data sovereignty has become a major concern in healthcare governance. International data sharing has to be legal, justifiable and secure.” U.S. health and privacy rights advocates should also pay close attention to deals like this one, and while we are at it, to U.S. trade and tariff deals: any instruments that facilitate data extractivism under the guise of “security” or “regulatory alignment”.
As tech and health interests collide, now more than ever we need health and privacy experts and advocates to collaborate across borders, promoting transparency, accountability, and meaningful data governance in the digital transformation.
About the Author
Professor Sara (Meg) Davis is Professor, Digital Health and Rights, and the principal investigator of the Digital Health and Rights Project at the University of Warwick. She has over twenty years’ experience in global health and human rights as a scholar and practitioner, and is the author of two books, most recently The Uncounted: Politics of data in global health (Cambridge 2020). At the Global Fund to Fight AIDS, TB and Malaria, Dr. Davis led early work to operationalise the Fund’s commitments on human rights.
Subscribe to our newsletter to stay up to date about blog posts and seminars from the Collective of the Political Determinants of Health.
