The High Court has delivered a landmark ruling affirming that registered mobile phone numbers are part of an individual’s personal data and cannot be reassigned without the owner’s consent, in a decision set to reshape digital privacy protections in Kenya.
In the judgment delivered on Thursday, March 19, Justice Lawrence Mugambi declared that mobile phone numbers serve as critical digital identifiers, linking individuals to sensitive personal information. He emphasised that such data is protected under Articles 31(c) and (d) of the Constitution, which guarantee the right to privacy.
“Mobile numbers are digital identifiers that link information to an individual’s private affairs,” Justice Mugambi ruled, underscoring the growing significance of data protection in an increasingly digital society.
The case arose from a petition filed in June 2024, which challenged the widespread practice by telecommunication companies of recycling inactive phone numbers. Petitioners argued that reassigning such numbers exposes previous users to serious privacy risks, including unauthorised access to financial, social, and personal data.
According to court filings, mobile numbers are often tied to mobile banking, social media accounts, and official records, making them a central component of a person’s digital identity. “Reassigning the phone numbers could expose users’ personal information to third parties without their explicit consent,” the petitioner stated.
The petition also brought attention to the plight of incarcerated individuals, who may lose access to their phone numbers due to prolonged inactivity. This, the court noted, increases the likelihood of their personal data being exposed if the numbers are reassigned.
In its ruling, the court imposed strict conditions for any future reassignment of mobile numbers. Telecommunication companies must first obtain the “informed and verifiable consent” of the original owner. Additionally, a reasonable waiting period must be observed, accompanied by public notice and a thorough verification process to confirm that the owner cannot be reached or has relinquished their rights.
The court further directed the Office of the Attorney General to develop and implement safeguards within six months to protect digital identities associated with registered phone numbers.
Justice Mugambi also ordered the introduction of robust technical measures to prevent unauthorised transfer or exposure of personal data during any reassignment process.
The decision marks a significant step in strengthening Kenya’s data protection framework, particularly amid rising concerns over digital fraud and identity theft linked to recycled phone numbers.
