Introduction
In a landmark decision that marks a significant evolution in Kenya’s digital rights jurisprudence, the High Court of Kenya has ruled that registered mobile phone numbers are protected components of an individual’s digital identity under the Constitution of Kenya, 2010. This judgment, delivered in Odhiambo & another v Attorney General & another (Petition E290 of 2024) [2026] KEHC 3809 (KLR), has wide-ranging implications for telecommunications practice, data protection, and digital privacy rights in Kenya.
Factual and Legal Background
The petition was filed in June 2024 by individuals, including a long‑term prisoner, who challenged the common industry practice of deactivating and reassigning inactive mobile numbers after a fixed period of non‑use—usually around 90 days. The petitioners argued that once a mobile number is registered, it effectively becomes a gateway to personal and sensitive information, including financial data, bank notifications, social communications, and access codes for digital platforms.
The respondents included the Attorney General and the Kenya Prisons Service, with the petition challenging the legality of automatic number deactivation under existing regulations, particularly Legal Notice No. 90 of 2025.
The High Court’s Decision
In a judgment delivered on 19 March 2026, delivered by Justice Lawrence Mugambi, the High Court made several pivotal findings:
1. Mobile Numbers as Digital Identifiers
The Court held that a registered mobile number qualifies as a digital identifier that links directly to private personal data, including financial and social information. Such identifiers are protected under Article 31(c) and (d) of the Constitution, which guarantees every person’s right to privacy and the right not to have information relating to their private life unnecessarily disclosed.
Justice Mugambi observed that mobile numbers are not mere contractual property or functional communication tools; they are increasingly embedded in digital and financial ecosystems in ways that make them integral to an individual’s digital identity.
2. Arbitrary Nature of the 90‑Day Deactivation Rule
The Court found the automatic deactivation and reassignment of mobile numbers after a period of inactivity to be arbitrary and unreasonable. The rule failed to account for legitimate reasons why a subscriber might not use a mobile line—such as incarceration, illness, travel, or restrictive environments—and did not provide adequate safeguards for those circumstances.
3. Consent and Public Notice Requirements
The judgment clarified that mobile network operators and regulators must obtain informed and verifiable consent from the original subscriber before any reassignment of an inactive number. Alternatively, if consent cannot be obtained, operators must provide public notice and a documented verification process confirming that the original subscriber cannot be traced or has clearly relinquished their rights.
4. Regulatory and Technical Safeguards
The Court mandated that the Office of the Attorney General, in consultation with relevant agencies—including the Communication Authority of Kenya and the Office of the Data Protection Commissioner—develop and implement a regulatory framework within six months to safeguard digital identities associated with mobile numbers. This framework must protect against arbitrary deactivation, reassignment, and the exposure of personal data linked to recycled numbers.
Key Legal and Practical Implications
The ruling has significant implications across several areas of law and practice in Kenya:
A. Strengthening Data Protection and Privacy Rights
By recognizing mobile numbers as digital identifiers protected under Article 31, the Court has expanded the scope of privacy rights in Kenya’s constitutional and data protection regime. This aligns with the principles of the Data Protection Act, 2019, which emphasizes lawful, transparent processing of personal data and requires user consent for data handling.
B. Telecommunications Compliance Obligations
Telecommunications operators must now review and adjust SIM lifecycle policies to ensure compliance with the Court’s requirements for consent, notice, and data safeguards. Failure to comply could expose operators to constitutional challenges and regulatory action.
C. Digital Inclusion and Consumer Protection
In a mobile‑first economy like Kenya, where mobile numbers serve as primary identifiers for financial services, government portals, and digital platforms, the ruling enhances consumer protection and supports digital inclusion, ensuring that individuals are not stripped of their digital identities without due process.
D. Rights of Persons Deprived of Liberty
The judgment underscores that constitutional rights—particularly privacy rights—do not cease upon incarceration. The Court’s directive specifically protects prisoners’ registered numbers from arbitrary loss due to inactivity, emphasizing the ongoing importance of digital connectivity and identity.
Conclusion
The High Court’s decision in Constitutional Petition No. E290 of 2024 represents a significant judicial advancement in the protection of digital identity and privacy rights in Kenya. By elevating mobile numbers to the status of protected digital identifiers, the ruling reinforces constitutional guarantees and reshapes obligations for telecommunications providers and regulators. As Kenya continues its rapid digital transformation, this judgment serves as a critical legal precedent for safeguarding personal data and upholding individual rights in the digital age.
This publication is provided for general information purposes only and does not constitute legal advice. Specific legal advice should be sought in relation to particular circumstances.