Judgment set to force telcos, banks and government agencies to overhaul how dormant SIM numbers are reassigned
By The Weekly Vision Reporter |
The High Court has delivered a landmark judgment set to reshape Kenya’s telecommunications and data protection landscape, ruling that a registered mobile phone number forms an integral part of a person’s digital identity and is protected under the constitutional right to privacy.
In Erastus Ngura Odhiambo v State Law Office & Another, Constitutional Petition No. HCCHRPET/E290/2024, the Milimani High Court found that the routine reassignment, or “recycling,” of inactive mobile numbers by service providers without adequate safeguards exposes Kenyans to serious privacy risks and violates their constitutional rights.
The case was brought by Erastus Ngura Odhiambo, a prisoner who challenged the practice of deactivating and reallocating mobile numbers after prolonged periods of inactivity. He argued that inmates serving lengthy sentences often lose access to their registered numbers, which telecommunications companies subsequently reassign to new subscribers without their knowledge or consent.
The petitioner maintained that a mobile number is no longer merely a communication tool but a key digital identifier linked to banking services, mobile money accounts, government portals, tax records, healthcare information and numerous other online platforms. Once a number is reassigned, its new holder may receive confidential messages and gain access to sensitive personal information intended for the previous owner.
Justice Lawrence Mugambi agreed with that argument, holding that mobile phone numbers have evolved into an essential component of an individual’s digital identity. The court found that unrestricted recycling of such numbers creates a substantial risk of exposing personal information to third parties, contrary to the privacy protections guaranteed under Article 31(c) and (d) of the Constitution.
The judgment further recognised that imprisonment does not extinguish an individual’s constitutional rights to privacy and protection of personal data. While acknowledging that prisoners are barred from possessing mobile phones for security reasons, the court held that the State nonetheless retains a duty to protect their digital identities.
In a far-reaching order, the court directed the Attorney General, together with relevant government agencies and telecommunications regulators, to develop an appropriate legal and regulatory framework governing the deactivation and reassignment of mobile phone numbers. It further ordered that adequate safeguards be introduced before any inactive number is reassigned, including reasonable efforts to notify the previous registered owner and measures to protect sensitive personal data linked to that number from unauthorised access.
The ruling carries significant implications for mobile network operators, banks, financial institutions, government agencies, and digital service providers that rely on mobile phone numbers as the primary means of customer authentication and service delivery.
Millions of Kenyans use their mobile numbers to access M-Pesa, internet banking, eCitizen services, the Kenya Revenue Authority’s online platforms, the Social Health Authority, pension services and a wide range of other digital applications. Privacy experts have long warned that recycled numbers could inadvertently expose former subscribers’ confidential information to strangers, with attendant risks for fraud and identity theft.
The decision is expected to prompt telecommunications companies to review their policies on inactive SIM cards, strengthen customer notification procedures and implement more robust safeguards before reallocating dormant mobile numbers, changes that are likely to carry compliance and operational costs for operators and the institutions that depend on mobile-based authentication.
Legal analysts describe the judgment as one of Kenya’s most significant decisions on digital rights since the enactment of the Data Protection Act, reinforcing the principle that technological advances must not erode constitutional protections.
