In a groundbreaking judgment delivered on 19th March 2026, the High Court of Kenya at Milimani in Erastus Ngura Odhiambo v State Law Office & Others (Constitutional Petition No. E290 of 2024) fundamentally redefined the contours of privacy and identity in the digital age. The Court held that a registered mobile phone number is not merely a tool of communication, but a central component of an individual’s digital identity, deserving of constitutional protection under Article 31. This decision marks a decisive evolution in Kenya’s data protection framework, situating telecommunications practices within the broader architecture of fundamental rights.
The Core Dispute
The petition arose from the long-standing practice by telecommunications providers of deactivating and reassigning mobile numbers after periods of inactivity. The Petitioners, led by Erastus Ngura Odhiambo, a prisoner serving a custodial sentence, challenged this practice as constitutionally infirm.
They contended that a mobile phone number functions as a digital identifier, deeply embedded within the architecture of contemporary life. It links individuals to financial systems such as MPESA, government services such as e-citizen which has become practically mandatory for access to public services in Kenya, and other intimate personal communications. Its loss, therefore, transcends mere technical inconvenience, amounting instead to a form of digital death, particularly acute for prisoners who, by reason of incarceration, are unable to sustain active usage.
At the heart of the claim was the contention that the unfettered reassignment of such numbers exposes sensitive personal data to third parties, thereby violating the right to privacy guaranteed under Article 31(c) and (d) of the Constitution.
The Court’s Verdict
In a carefully reasoned judgment, Justice Lawrence N. Mugambi affirmed that a registered mobile phone number constitutes a core element of personal digital identity. In doing so, the Court elevated what was previously treated as a contractual or regulatory matter into the realm of constitutional protection.
The Court further held that the existing regulatory framework, particularly the 90-day deactivation rule, was mechanical, unreasonable, and arbitrary. It failed to account for legitimate circumstances of non-use, such as incarceration, illness, or absence from the country, and did not provide subscribers with notice or an opportunity to preserve their digital identity.
Crucially, any reassignment of a deactivated and previously registered mobile number shall only occur under the following conditions:
- Informed Consent: Reassignment is permissible only if the previous registered owner has provided informed and verifiable consent.
- Public Notice and Verification: Reassignment may occur after the expiry of a reasonable period following the issuance of a public notice. Such notice must be preceded by a thorough documented verification process aimed at confirming that the original registered owner cannot be located or has unequivocally revoked their rights to the number.
Significance of the Decision
The decision’s most enduring significance lies in its contribution to Kenya’s data protection regime. It introduces a requirement of procedural fairness into telecommunications practices. Operators are now obligated to notify subscribers and afford them an opportunity to explain inactivity or reclaim their numbers before reassignment. Further, operators must put technical safeguards in place to prevent authorized exposure of personal data linked to previous registered owner to third parties upon re-assignment of the phone number.
The Attorney General, together with relevant departments, including the Office of the Data Protection Commissioner and the Communication Authority of Kenya, have been tasked with, within six months, implementing measures to protect digital identities from arbitrary deactivation and reassignment. This is significant for the growth of data protection in Kenya, as it strengthens procedural safeguards, reinforces individuals’ privacy rights, and signals a maturing regulatory environment that aligns telecommunications practices with constitutional and global data protection standards.
Conclusion
The decision, therefore, marks a paradigmatic shift in Kenyan law, from treating mobile numbers as expendable contractual assets to recognizing them as enduring elements of personal identity. In doing so, it exemplifies a growing judicial willingness to recalibrate constitutional principles in response to the realities of a digitized society.
This article is provided free of charge for information purposes only; it does not constitute legal advice and should be relied on as such. No responsibility for the accuracy and/or correctness of the information and commentary as set in the article should be held without seeking specific legal advice on the subject matter. If you have any query regarding the same, please do not hesitate to contact our Data Protection & ICT Law Department vide WAICTLaw@wamaeallen.com
About the author
Virginiah is a seasoned Advocate with great expertise of more than three years in Real Estate, Banking and Finance, Commercial and Corporate Law. She is a focused and self-motivated advocate successful at strategically managing operations with proven team performance.
Flavious is an Associate in the Real Estate and Securitization Department.
She has vast knowledge and hands on experience in Real Estate, Securitization, Banking, Finance, Company Law, Corporate Governance, Insolvency and Commercial Law. She also has keen interest in policy making and emerging legal commercial issues in general.
She is a promising transactional advocate with exemplary interpersonal skills and exudes diligence, integrity, resilience, confidence and great enthusiasm in all her tasks.
