Ownership Without Control: AI, Health Data, and the Price of Development

Ownership Without Control: AI, Health Data, and the Price of Development When the powerful write the rules, the powerless pay — in Nairobi and in Washington alike" publication: Lex Machina Kenya author: Timon Tindi Jobic date: May 2026 #AIGovernance, #DataProtection There is a particular kind of arrangement that looks like generosity from the outside and operates as extraction from within. The terms are dressed in the language of partnership. The signing ceremonies are photographed at the highest levels. And by the time the fine print is read — if it is read at all — the machinery is already running. We are living through several of these arrangements simultaneously: in government health registries, bilateral diplomatic frameworks, and federal data warehouses. In each case, the mechanism is the same. Algorithmic systems are deployed at scale, ahead of the legal frameworks that should govern them, on populations who have no meaningful ability to consent, object, or appeal in time to matter. This essay is about three convergent stories: the United States’ Department of Government Efficiency (DOGE) and its unprecedented raid on Americans’ personal data; Kenya’s Social Health Authority (SHA) and an AI means-testing system that quietly overcharges the poor while giving the wealthy a discount; and a $2.5 billion Kenya–US health deal that courts have been fighting over since December 2025. Together, they tell a single story about what happens when AI is deployed by the powerful, on the vulnerable, without adequate legal guardrails — and what it looks like when courts and citizens decide to push back. I. The DOGE Blueprint: Efficiency as Cover for Overreach In early 2025, the Trump administration’s Department of Government Efficiency — operating under Elon Musk’s stewardship — began accessing the personal records of millions of Americans across multiple federal agencies, including the Social Security Administration, the Internal Revenue Service, and the Department of Health and Human Services. The data accessed included Social Security numbers, bank accounts, medical histories, income records, and benefit payment histories. No individual consent was obtained. No public participation process was conducted. According to analysis from the US Senate Intelligence Committee, DOGE personnel connected personal devices to sensitive government networks without following standard cybersecurity protocols — exposing the data of tens of millions of Americans to entirely novel risks. The stated rationale was efficiency: the elimination of “waste, fraud, and abuse.” The Privacy Act of 1974 — passed after the Watergate scandal to prevent precisely this kind of executive surveillance — was treated as an obstacle rather than a guardrail. Federal courts stepped in, with several judges ruling that the government had violated the Privacy Act. But the administration continued, sometimes successfully appealing those restrictions. The DOGE model reveals something important: when efficiency is invoked as justification, data protection frameworks collapse. The algorithm doesn’t ask whether the access is lawful. It just processes. The danger is not only the immediate privacy violation — it is the precedent. If a superpower can sweep up the personal data of its own citizens under the banner of administrative reform, what signal does that send to governments elsewhere about the acceptability of algorithmic overreach? The same logic — efficiency over rights, speed over accountability, deployment ahead of legal frameworks — was already running in Kenya’s health system. And it was doing so with the full knowledge of the government that built it. II. SHA’s Broken Algorithm: When the Poor Pay More When President Ruto launched the Social Health Authority in October 2024, the promise was historic: universal health coverage for every Kenyan, an end to the harambees — the community fundraisers — that families relied on to pay hospital bills. The NHIF was to be replaced by something smarter, more equitable, more data-driven. What emerged instead was a case study in algorithmic harm. At the heart of SHA’s premium-setting system is a method called Proxy Means Testing (PMT) — a machine learning model that predicts household income not by asking what people earn, but by examining what they own. Does the house have an iron roof? Is there electricity? What kind of sanitation is used? Forty-three variables feed the model, drawn from the 2021 Kenya Household Census. An investigation by Africa Uncensored, Lighthouse Reports, and The Guardian revealed the result: the algorithm systematically overcharges the poorest Kenyans and underestimates the wealth of the rich. A struggling farmer with an iron-sheet roof and an electricity connection — perhaps the result of a government rural electrification programme — is assessed as “middle-income.” Their premium can consume between ten and twenty percent of their income. Meanwhile, wealthier households whose assets are less visible to the algorithm pay proportionally less. Florence, an unemployed mother in Huruma, was assigned a premium of Ksh 6,600 per year — an impossible sum for her family. When she appealed, the system rejected her request because her premium did not meet the minimum threshold for reconsideration. The algorithm had created a Kafkaesque trap: too poor to pay, but not poor enough to qualify for a review. Community Health Promoters report that critically ill people are being denied care at hospitals because the system lists them as ineligible. The most damning detail is not the bias itself, but the timeline. A pre-deployment report by data consultancy IDinsight — obtained by journalists — warned that the SHA system was “inequitable, particularly for low-income households.” The government deployed it anyway. On 20 million people. This is not a technical failure. It is a policy choice — one that transferred accountability from elected officials to opaque code. Health economist David Khaoya, who advised Kenya’s health ministry, confirmed the structural nature of the problem: the system was deliberately calibrated to accurately assess the wealthy, even at the cost of overcharging the poor. “If you identify a richer person as poor and therefore ask him to pay less,” he said, “this person will never own up and say, ‘I’m actually supposed to be paying more.’” Brian Lishenga of Kenya’s Rural and Urban Private Hospitals Association put it more bluntly: “This is an experiment that has failed. It’s a really poor tool for identifying poor households. It’s a great tool for helping the government run away from responsibility.” The SHA crisis is Kenya’s domestic DOGE moment. In both cases, algorithmic systems are deployed by governments on their own populations without meaningful transparency, without adequate appeals mechanisms, and without legal frameworks capable of holding the algorithm to account. The difference is scale. The similarity is structure. III. The Health Deal: Diplomacy, Data, and the Question of Leverage On December 4, 2025, President Ruto and US President Trump witnessed the signing of the Kenya–US Health Cooperation Framework in Washington D.C. — a deal valued at $2.5 billion, structured to run from 2026 to 2030. The framework covered disease surveillance, health systems strengthening, management of global epidemics, and — critically — the sharing of health data between the two countries. Within days, civil society moved. The Consumer Federation of Kenya (COFEK) and Senator Okiya Omtatah filed separate petitions in the High Court. COFEK argued that the data-sharing provisions violated the Data Protection Act, the Digital Health Act, the Health Act, and the Digital Health Regulations of 2025. Omtatah challenged the deal’s constitutionality on broader grounds: lack of public participation, absence of parliamentary oversight, and fiscal provisions that could strain Kenya’s budget — including an $850 million spending commitment that had received no parliamentary approval. On December 11, Justice Bahati Mwamuye issued conservatory orders suspending the data-sharing components. On December 19, Justice Chacha Mwita went further — halting the entire framework pending full hearing. The Court of Appeal, in May 2026, temporarily restored the government’s ability to proceed, pending a final ruling scheduled for October 30, 2026. The legal battle continues. But the deeper questions it has surfaced are not merely procedural. IV. What’s In It For Washington? The Anatomy of the Deal This is the question that the Kenyan government’s public statements have consistently sidestepped. The deal’s own text provides the answer. Article 1 of the bilateral agreement states: “The purpose of this Agreement is to establish the terms and conditions under which the Government of Kenya shall provide the US Government with data, derived from Health Programs supported through the Cooperation Framework.” The primary US interest is stated plainly in the document — health sector data from Kenya. The companion MOU guide is equally direct, describing the objective as establishing terms that will “advance US interests, save lives and help countries build resilient and durable health systems.” The strategic rationale: “To keep America safe from infectious disease threats, all countries should generally have the same vision: a surveillance and outbreak response capability.” Kenya, in other words, functions as an early warning system. The US gains access to Kenya’s digital health infrastructure, outbreak databases, disease surveillance networks, and — most significantly — genomic sequence data of diseases circulating in East Africa. Kenya is described in the agreement’s own framing as a “key location for spotting new diseases.” The terms of exchange are time-asymmetric in a way that critics have called lopsided. Kenya receives five years of funding. The US retains data access for up to 25 years — including for a decade after any agreement is terminated. Digital health systems evolve. Laws change. Governments turn over. Yet the access persists. Critics have also flagged paragraph 18 on Intellectual Property, arguing that the agreement gives Kenya ownership on paper while ceding practical control. Data advocates say there is no mechanism in the agreement to audit, monitor, review, or limit how the US government uses the data once it is shared. As the Health and Human Rights Journal concluded: “Data ownership without effective control risks becoming symbolic rather than substantive.” The government has pushed back on the most alarming characterisations. Health CS Aden Duale has stated that the agreement does not permit sharing of individual medical records or personally identifiable information, that it focuses on aggregate epidemiological data, and that Kenyan law prevails under Article 5(f) where any conflict arises. Article 2(a) requires strict compliance with Kenya’s Data Protection Act and Digital Health Act. But critics raise a concern that these formal protections do not resolve: the agreement does not account for AI’s ability to re-identify individuals from anonymised datasets. A postdoctoral fellow at the Free State Centre for Human Rights in South Africa, writing in JURIST, noted that while Kenya secured important legal protections in the agreement, the deal — like data protection frameworks across Africa — fails to address the unique privacy risks posed by AI’s capacity to reverse-engineer individual identities from aggregate health data. You can promise not to share names. You cannot promise that names cannot be recovered. There is also the geopolitical dimension. The America First Global Health Strategy — under which this deal sits — has been characterised by analysts as a deliberate pivot away from multilateral health governance. USAID was dismantled in July 2025. The US withdrew from the WHO. In their place: direct, bilateral, government-to-government arrangements that route US influence through individual capitals, bypassing the accountability mechanisms of multilateral institutions. The sequence matters and should be named. USAID’s dismantling created an immediate funding crisis across African health systems — HIV medication stockouts, TB treatment gaps, collapsed maternal health programmes. The AFGHS bilateral deals were then offered to fill that void. The price of filling it: data. The old system was dismantled. A replacement was offered. The terms of that replacement included access the old system never required. Each bilateral deal is, structurally, a relationship that cannot be collectively negotiated or challenged. That is not incidental — it is the design. Washington did not simply exploit a crisis. It created the conditions under which African governments had little choice but to negotiate individually, from weakness, on terms set elsewhere. V. The African Pushback: Kenya Was Not Alone Kenya’s High Court fired an early judicial shot, but Africa’s resistance to the AFGHS has been broader than any single courtroom. In the four months following Kenya’s signing, twenty-two African countries signed bilateral agreements under the America First Global Health Strategy. By late April 2026, Washington had signed 32 deals globally, representing $20.6 billion in commitments — $12.8 billion from the US, and $7.8 billion in co-investment pledged by recipient governments. But a growing number of those governments have begun to question what they are giving up to access the money. Ghana rejected its proposed deal entirely. The executive director of Ghana’s Data Protection Commission stated publicly that the scope of data access requested “went far beyond what would typically be required.” Ghana is now seeking a renegotiated agreement. Zambia halted talks after its deal was tied to cooperation around copper and cobalt — making the link between health funding and resource extraction explicit, in a way that stripped away any pretence of pure humanitarian intent. Zimbabwe walked away over clauses requiring rapid sharing of pathogen data. In the DRC, lawyers challenged the MOU in court. More than 50 civil society organisations across the continent published a joint appeal urging African governments not to sign, warning that the bilateral structure was deliberately designed to prevent collective pushback. “Bilateral agreements between the US and individual African countries are meant to limit the ability of any one partner country to challenge the terms,” said Ravi Ram of the People’s Health Movement, “due to the unequal power relations involved.” Chatham House analyst Ebere Okereke has argued that African countries should respond strategically: reclaim the narrative around aid dependency, negotiate collectively to increase leverage, resist tied aid to protect industrial policy, and insist on reciprocity in the sharing of surveillance data. African governments, she argues, should not reject the strategy out of hand — but should ask hard questions