Following a recent judgment that reinforces Kenya’s constitutional protections on privacy and state surveillance, Justice Chacha Mwita has ruled in favour of the petition filed by Katiba Institute challenging the legality of public notices by the Communications Authority of Kenya (CA) and the Kenya Revenue Authority (KRA). These notices had required Kenyans to disclose the International Mobile Equipment Identity (IMEI) numbers of their mobile phones a directive that has now been rejected by the court.
The IMEI number is a unique identifier assigned to every mobile phone, making it possible to track and monitor individual devices. In 2023, the CA and KRA issued notices demanding that mobile phone users submit their IMEI numbers under the guise of national security and combating counterfeits and illegal devices. However, the notices sparked alarm among digital rights advocates, civil society groups, and legal experts who feared that the move opened the door to mass surveillance without legal safeguards.
In response to this, Katiba Institute filed a petition arguing that the directive lacked legal grounding and posed serious threats to fundamental rights particularly the right to privacy as enshrined in Article 31 of the Constitution. The petition also referenced Article 24, which outlines the parameters for limiting rights and freedoms, requiring any such limitation to be based on clear law and be reasonable and justifiable in a democratic society.
In his ruling, Justice Mwita affirmed the petitioners’ concerns, holding that the notices by the CA and KRA had no basis in law. He categorically stated that they were unconstitutional. The court determined that the notices violated the Constitution in three key ways that include:
-
Lack of Legal Foundation: The judge ruled that the requirement to submit IMEI numbers was not anchored in any legislation. In a constitutional democracy, any directive by a state organ that infringes on individual rights must be clearly supported by law. The notices failed this test.
-
Violation of Privacy: Justice Mwita found that compelling individuals to disclose their IMEI numbers amounted to a breach of their right to privacy. By linking individuals to specific devices, the government would gain the ability to monitor mobile use and movements—actions that must be tightly controlled and legally sanctioned if at all permitted.
-
Enabling State Surveillance: The court observed that collecting IMEI numbers would enable continuous and unchecked surveillance by the state, turning every mobile phone into a potential tracking device. This, the court found, was contrary to constitutional protections and democratic norms.
As a result of these findings, the court further issued two significant reliefs:
-
An order revoking the public notices issued by the CA and KRA, rendering them null and void.
-
A permanent prohibition restraining the state from implementing or acting upon the notices, ensuring that Kenyans cannot be compelled to submit their IMEI numbers through any similar future directive.
This ruling marks a significant victory for digital rights in Kenya. It reaffirms the principle that surveillance and data collection by the state must be strictly governed by law, proportional to the objective being pursued, and subject to oversight. It also aligns with global trends where courts are increasingly scrutinizing the balance between national security and individual privacy.
The judgment sets a strong precedent that will likely influence how future digital regulation, surveillance, and data collection efforts are conducted in Kenya. In an era where data is power and privacy is constantly under threat, this decision is a reminder that constitutional safeguards remain the first line of defence for Kenyan citizens.