Court Suspends Gov’t Requirement for Travelers to Declare Phone IMEI Numbers

The High Court Friday stopped the government from implementing orders requiring travellers entering Kenya to declare the International Mobile Equipment Identity (IMEI) numbers of any mobile devices they intend to use while in the country.

Justice Chacha Mwita issued the conservatory orders pending the hearing of a petition filed by Katiba Institute.

“That in the meantime, a conservatory is hereby issued suspending implementation of the notice issued by Communication Authority of Kenya on 24th October 2024 titled “Public Notice on enhancing tax compliance of mobile Devices in Kenya” as well as the subsequent notice by Kenya Revenue authority on 5th November 2024…,” reads the court order.

The matter will be heard on December 18, 2024.

The Kenya Revenue Authority (KRA) introduced the policy on November 5, stating that the measure is part of an initiative to enhance tax compliance.

In its petition, however, the Katiba Institute argues that the mandatory disclosure of IMEI numbers poses a significant risk to individuals’ fundamental rights and freedoms. It contends that this requirement could enable unwarranted state surveillance.

“When combined with additional personal information, such as names or flight and customs details, IMEI numbers can be used to identify individuals and thus constitute personal data,” the petition reads.

The institute also raises concerns over the lack of transparency regarding safeguards for the collected data. It questions who will control and access the IMEI database, what security measures are in place, and whether effective remedies will be available for individuals aggrieved by the collection of this data.

Katiba warns of the potential dangers of collecting IMEI numbers without proper oversight, emphasizing the urgency to halt what it describes as a “terrible trend.”

“The threat to fundamental rights and freedoms is apparent, and there is an urgent need to address the risks and harms posed by this directive,” the institute stated.

The notice had been posted on CA website last month under the headline “Public notice on enhancing the integrity and tax compliance of the mobile devices in Kenya”.

It stated that all local assemblers, importers, retailers and wholesalers as well as mobile network operators must upload the International Mobile Equipment Identity (IMEI) number of each assembled or imported mobile device to KRA portal to facilitate the tax compliance monitoring.

“The notice issued by CA and referred to as regulations were neither tabled in Parliament nor subjected to public participation as required by the constitution,” says Katiba.

The move they said went against Article 35 of the Constitution which requires all relevant facts to be published prior to formulating important policies and announcing decisions impacting the public.

“The respondents were under a duty to proactively disclose the Data Protection Impact Assessment conducted on the collection of IMEI data,” read their documents in part.

Based on these, they asked the court to suspend both notices.

“Without a data impact assessment, the risk of violating the right to privacy and other fundamental rights and freedoms remains unmitigated,” they said.

They told the Judge that “contrary to the requirement that free and informed consent must be obtained prior to the collection of personal data, the respondents have resorted to duress by threatening to deregister any mobile phone device whose IMEI number is not disclosed”.

Katiba informed that the court that without sufficient safeguards and guardrails to the collection of IMEI numbers, there is a real risk that Kenya will easily be turned into a surveillance state.