NAIROBI, Kenya — The High Court of Kenya has ruled that mobile phone numbers are personal digital identifiers and cannot be deactivated or reassigned without the informed consent of the subscriber. The ruling underscores constitutional protections for privacy and directs regulators to implement safeguards to protect users’ data.
Delivering the judgment virtually on Thursday, Justice Lawrence Mugambi ordered the Attorney General and relevant agencies to establish a regulatory framework by September 19 to govern the reassignment of deactivated numbers. The framework must also ensure that prisoners’ contacts are preserved during incarceration.
Justice Mugambi’s ruling stems from Constitutional Petition No. E290 of 2024, filed by two petitioners, including a long-term prisoner, against the Attorney General and the Kenya Prisons Service.
The petition challenged the automatic deactivation and reassignment of mobile numbers after 90 days of inactivity, arguing that such practices risked exposing sensitive personal data, including banking notifications and family communications, to third parties.
Legal Notice 90 of 2025, which allows deactivation after periods of non-use, was described by the court as “unreasonable and arbitrary.”
Justice Mugambi emphasized that exceptions must account for individuals unable to use their numbers for legitimate reasons, such as prisoners, students in restricted environments, or citizens abroad without roaming access.
The court highlighted the potential for data breaches resulting from unrestricted number recycling.
“When mobile digital identity is lost through reallocation or recycling without interrogating the reasons behind the long period of non-use or inactivity, it creates an avenue for unauthorized disclosure of delicate information such as the person’s family or financial affairs to third parties,” the judgment states.
Also Read: Lawyer petitions NITA-U, citing Airtel for failing to uphold data privacy and fraud concerns
Justice Mugambi also referenced Article 51 of the Constitution of Kenya, which guarantees prisoners all rights in the Bill of Rights except where incompatible with detention.
“Imprisonment should not translate to extinction of a prisoner’s digital identity,” he said. “Automatic loss of the digital identity risks infringing on their right to privacy as their personal information linked and shared through digital identity may spill over to third parties without their consent or approval.”
The High Court issued a binding directive requiring the Attorney General, in consultation with the Kenya Prisons Service, the Communication Authority of Kenya, and the Office of the Data Protection Commissioner to implement measures protecting digital identities against arbitrary deactivation.
The order mandates that prisoners’ mobile numbers be preserved during incarceration and technical safeguards be put in place to prevent unauthorized exposure of personal data linked to recycled numbers.
