Kenya Court Rules Mobile Numbers Are Private Data

The High Court of Kenya has ruled that registered mobile phone numbers constitute digital identifiers linked to personal data, and are therefore protected under Article 31 (c) and (d) of the Constitution, which guarantees the right to privacy.

The judgment, delivered at the Milimani High Court in the case of Erastus Ngura Odhiambo vs State Law, stems from a petition challenging the reassignment and recycling of deactivated mobile numbers after extended periods of inactivity. The court found that such numbers are closely tied to individuals’ private affairs and may expose sensitive personal information when reassigned without safeguards.

The court directed the Office of the Attorney General to implement appropriate measures within six months to protect digital identities associated with mobile numbers from arbitrary deactivation and reassignment.

It further ruled that mobile numbers may only be reassigned under strict conditions, including obtaining the informed and verifiable consent of the previous owner, issuing public notice after a reasonable period, and conducting a documented verification process to confirm that the original owner cannot be traced or has relinquished the number. In addition, technical safeguards must be put in place to prevent unauthorized access to or transfer of personal data linked to previous users.

The court noted that the reassignment of mobile numbers without such protections creates a significant risk of exposure to third parties, potentially leading to privacy breaches, fraud, and misuse of personal information.

The ruling is expected to have far-reaching implications for telecommunications providers and digital platforms in Kenya, where mobile numbers are widely used for mobile money, banking, and identity verification, reinforcing their status as critical components of digital identity.