Court rules person’s registered mobile phone number forms part of their “digital identity”

Three detained over Sh10 million theft from Safaricom Sacco bank account

The High Court Thursday ruled that a person’s registered mobile phone number forms part of their “digital identity” and is entitled to constitutional protection.

In a judgment delivered virtually on Thursday, Justice Lawrence Mugambi held that the routine deactivation and reassignment of mobile phone numbers after 90 days of inactivity, without regard to the reason for non-use, poses a real threat to the right to privacy under Article 31 of the Constitution.

The case was brought by two prisoners, including Erastus Ngura Odhiambo, who argued that inmates involuntarily lose access to their registered phone numbers while serving prison sentences because mobile service providers deactivate and later reassign them after prolonged inactivity.

Justice Mugambi found that although the Constitution does not expressly refer to digital identity, a registered mobile number has become a key personal identifier because it is linked to SIM registration records and is widely used for authentication in online and financial transactions.

The judge said the modern use of mobile numbers for one-time passwords, verification codes and access to personal accounts means they are tied to sensitive personal data deserving constitutional protection.

Reassigning such numbers without first considering the reasons for inactivity, the court found, risks exposing private information, including family and financial matters, to third parties.

The court also ruled that prisoners retain all rights and fundamental freedoms except those that are clearly incompatible with imprisonment, as provided under Article 51 of the Constitution.

“There has been no demonstration in this petition that allowing a prisoner to keep or maintain his or her digital identity acquired upon registration of the SIM card is incompatible with the fact that the prisoner is imprisoned or detained,” the judge held, adding that imprisonment should not amount to the extinction of a prisoner’s digital identity.

The petitioners told the court that losing their phone numbers had severe personal and economic consequences.

Odhiambo, who is serving a 20-year sentence for murder and is a father of six, said he could no longer receive updates from his children’s schools, while his business collapsed because he lost contact with employees and associates.

In the ruling, the court faulted Regulation 17 of the Kenya Information and Communications (Registration of Telecommunication Service Subscribers) Regulations, saying it operates too mechanically by permitting deactivation after 90 days of non-use without considering whether the inactivity is justified.

Justice Mugambi said the law fails to account for circumstances such as imprisonment and does not provide for public notice or an opportunity for a subscriber to explain their inability to use the line before reassignment.

However, the court declined to grant the prisoners’ request to be allowed to possess and use personal mobile phones while in custody, finding that restrictions on inmates’ access to phones under the Prisons Act and the Persons Deprived of Liberty Act are lawful and justified on security grounds.

The judge held that uncontrolled communication by prisoners could expose victims and the public to threats, intimidation or other risks.

He said that inmates already have access to structured and supervised communication channels.

The court issued a series of orders, including a declaration that registered mobile phone numbers are digital identifiers protected by the right to privacy.

Mugambi directed the Attorney General to develop, within six months, measures to ensure that reassignment of deactivated numbers only happens with the informed consent of the previous holder, after public notice, and with technical safeguards to prevent unauthorized disclosure of personal data.

Court also ordered the Kenya Prison Service, in consultation with relevant authorities, to establish a mechanism for preserving prisoners’ digital identity during incarceration, either through notification to mobile operators upon sentencing or through supervised activation under existing law.

The court further ruled that if no action is taken within six months, the reassignment of deactivated numbers must cease by September 19.