KRA commissioner-general John Njiraini said on Wednesday the authority is implementing third-party data mining and physical mapping of small businesses across the country. The country has around nine million small and medium-sized enterprises (SMEs).
“For third-party data mining, our officers are tracking money transferred by mobile phone services and transactions made through financial institutions before we ask parties involved to pay taxes due,” Mr Njiraini said.

16.1 You hereby expressly consent and authorize Safaricom to
disclose any Transaction data or information pertaining to
your M-PESA Account to any law enforcement, investigative
or regulatory authority including without limitation the Kenya
Police, Central Bank of Kenya, Kenya Anti-Corruption
Commission, Kenya Revenue Authority or any competent
Anti-Money Laundering authority for the purposes of any
genuine enquiry or investigation or to any third party to which
you have separately, either in writing or electronically through
the M-PESA System or otherwise, authorised Safaricom to
disclose Transaction data or information pertaining to you or
your usage of Safaricom Products and Services, including
your M-PESA account provided that any consent given to
Safaricom to disclose information to any third party (not being
a law enforcement, investigative or regulatory authority )
pursuant to this clause may be withdrawn at any time.

@Kobayashi, thanks for the link. That was actually my concern, that the KRA can just start fishing and hoping to find any information it can use against a taxpayer. In my mind, it is like the police just walking into someone’s house on the off chance they might find something worth prosecuting (or to get TKK).

For Safaricom and the financial institutions to hand over all the information as the article suggests seems to me to be illegal. Customer’s data must be privileged information until and unless there is a genuine case to be investigated, not given out wholesale. The Safaricom T&C I quoted above even highlights this (pointed out by Thinkersroom), by specifically mentioning “for the purposes of any genuine enquiry or investigation”. KRA is as usual feeding the public nonsense so they can continue being inefficient.

What are those "necessary legal means" that you allude to?