Court suspends provisions of newly assented cybercrime law

Three detained over Sh10 million theft from Safaricom Sacco bank account

The High Court on Wednesday temporarily suspended the enforcement of the controversial Computer Misuse and Cybercrime (Amendment) Act, 2024.

The new law was assented to by President William Ruto on October 15, 2025.

Justice Lawrence Mugambi issued the orders pending the hearing and determination of a petition filed by gospel musician Reuben Kigame and the Kenya Human Rights Commission (KHRC), who argue that the law violates multiple constitutional rights, including freedom of expression, privacy, and digital anonymity.

The petitioners contend that the Act’s vague provisions criminalizing false, misleading, or “mischievous” information, mandatory government-verified social media accounts, and obligations on platforms to remove flagged content preemptively effectively grant the state excessive power to police online speech, threaten whistleblowers, journalists, and regime critics, and weaken protections under the Data Protection Act of 2019, while also challenging the legislative process as unconstitutional for bypassing Senate approval under Article 110.

The judge said the application and submissions to the application be physically served within three days, and a return of service be filed.

“Pending the hearing and determination of this application a conservatory order is hereby issued suspending the enforcement, implementation and operation of Section 27(1)(b), (c) and (2) of the Computer Misuse and Cybercrimes (Amendment) Act, 2025,” the order said.

He ordered that responses and submissions to the application be filed and served within seven days from the date of service.

Human rights activist Reuben Kigame Lichete and the Kenya Human Rights Commission (KHRC) filed a constitutional petition challenging the Computer Misuse and Cybercrimes (Amendment) Act, 2024.

They argued that its unconstitutional and a direct assault on fundamental freedoms, including the right to privacy, freedom of expression, and media independence.

In the petition filed against the Attorney General and the Speaker of the National Assembly, the petitioners argue that the new law, which was signed by President William Ruto on October 15, 2025, introduces vague and overbroad provisions that undermine the Data Protection Act, 2019, and violate several provisions of the Constitution of Kenya, 2010.

The petition lists the Kenya Union of Journalists (KUJ), Media Council of Kenya (MCK), Law Society of Kenya (LSK), and the Office of the Data Protection Commissioner (ODPC) as interested parties.

Kigame and KHRC say that the amendment criminalizes “false, misleading, and mischievous” information without clear definitions, opening the door to abuse by law enforcement agencies and creating a chilling effect on free speech.

They further faulted the law for introducing mandatory verification of social media accounts, requiring users to link their online profiles to government-issued legal names, a move they describe as a “severe, blanket infringement” on the right to privacy.

“The mandatory social media verification mandate constitutes an unnecessary and disproportionate intrusion into the private affairs of Kenyans,” the petition stated.

“It violates the principle of data minimization and fairness under the Data Protection Act.”

The petitioners also argued that the amendment to Section 27 of the Principal Act which criminalizes communications that may cause another person to commit suicide is unconstitutionally vague, lacking clear legal standards or intent requirements, and therefore open to arbitrary enforcement.

They contend that the legislative process leading to the enactment of the amendment law was procedurally defective, as Parliament failed to refer the Bill to the Senate, despite it affecting county functions under Part 2 of the Fourth Schedule of the Constitution.

They argued that this failure violated Articles 110(1), 110(3), and 110(4) of the Constitution, which require Senate participation in legislation concerning counties.

According to the petition, the amendments also undermine the Data Protection Commissioner’s oversight role by creating “parallel, overlapping and less rigorous” procedures for data handling, contrary to the spirit of the Data Protection Act, 2019, which was enacted to give effect to Article 31 of the Constitution.

The petitioners asked the court to declare the 2024 amendments null and void, arguing that they contravene Articles 10, 24, 31, 33, 34, 35, 36 and 47 of the Constitution.

They also sought a permanent order restraining the government from enforcing the contested provisions.

“The impugned law represents a glaring abuse of constitutional guarantees and threatens to erode Kenya’s hard-won freedoms,” the petition reads in part.

“Unless this Honourable Court intervenes, the violation and contravention of constitutional rights will continue to the detriment of the sovereign people of Kenya.”

Interior Affairs Principal Secretary Dr. Raymond Omollo Wednesday defended the signing of the Cybercrime (Amendment) Bill into law by President William Ruto.

He said much of the criticism circulating in the public domain is based on misinformation.

Dr. Omollo said the public has been misled about the contents and intent of the new law by both mainstream and social media, which have distorted its provisions.

“Much of what is currently circulating online about the Computer Misuse and Cybercrimes (Amendment) Act, 2024 is misleading or entirely inaccurate,” the PS said in a statement.