Case No. HCCHRPET/E290/2024 | Justice Lawrence N. Mugambi | Milimani High Court, Nairobi | 19 March 2026
Petitioner: Erastus Ngura Odhiambo & Another
Respondents: Attorney General & Kenya Prisons Service
Constitutional Provisions: Article 31(c) & (d), Constitution of Kenya
Compliance Deadline: 19 September 2026 (six months from judgment)
Background on the High Court Kenya Ruling 2026:
The petition was filed by Erastus Ngura Odhiambo, who argued that a mobile number functions as far more than a communication device, it is a portal to an individual’s most sensitive personal information, spanning banking, tax, and social data. He contended that his number was deactivated while he was incarcerated, enabling unintended third parties to intercept private correspondence directed at him, including communications from financial institutions and the Kenya Revenue Authority.
The petition challenged the common practice by Mobile Network Operators (MNOs) of deactivating mobile phone numbers after periods of inactivity and reassigning them to entirely new subscribers without procuring express consent from the original registered owner.
The Court’s Finding:
Justice Mugambi held that registered mobile phone numbers are digital identifiers that connect to personal information about a person’s private life, attracting protection under Article 31(c) (the right not to have information relating to one’s family or private affairs unnecessarily required or disclosed) and Article 31(d) (the right to privacy of communications).
The judgment stated that:
“When mobile digital identity is lost through reallocation or recycling without interrogating the reasons behind the long period of non-use or inactivity, it creates an avenue for unauthorized disclosure of delicate information such as the person’s family or financial affairs to third parties.”
The court further held that automatic deactivation policies are arbitrary because they do not account for subscribers with legitimate reasons for inactivity specifically identifying prisoners, students in restrictive institutions, and Kenyans living abroad without roaming access. Justice Mugambi reminded the respondents that under Article 51 of the Constitution, incarceration removes freedom of movement not constitutional privacy rights.
The case was treated as public interest litigation and no order as to costs was made.
Orders Made:
The Attorney General was directed, within six months (by 19 September 2026), in coordination with the Communications Authority of Kenya (CA) and the Office of the Data Protection Commissioner (ODPC), to establish safeguards that include:
- Consent: Informed and verifiable consent from the previous registered owner before any reassignment takes place
- Verification process: Reassignment may only occur after a reasonable waiting period following public notice, and after a documented process confirming the original owner cannot be located or has unequivocally relinquished the number
- Technical safeguards: Measures to prevent a new holder from accessing personal data, OTPs, financial alerts, or messages belonging to the previous owner
Automatic moratorium: If the required framework is not gazetted by 19 September 2026, all recycling and reassignment of deactivated numbers ceases automatically until constitutional requirements are satisfied.
Implications to Ecosystem
Mobile Network Operator (MNOs):
The ruling directly challenges existing deactivation practices amongst MNOs. Safaricom’s (SCOM: NSE) current policy deactivates lines after 120 days of inactivity following expiry of the last top-up while Airtel’s on the similar conditions is 90 days. The SCOM’s paid Daima service preserves dormant lines but the court’s ruling signals that consent-based protection must be a default right and not a commercial product.
The ruling introduces notable cost implications for MNOs, primarily driven by compliance and system upgrades. Operators will need to invest in consent management systems, verification processes, and coordination frameworks with regulators such as the CA and the ODPC
Operators must now engage with the CA on the incoming regulatory framework and review deactivation workflows.
Subscribers:
The ruling establishes that a mobile number is a digital identity rather than a temporary utility, shielding consumers from the digital death of their financial and social records. It ends the “use it or lose it” risk to subscribers by requiring informed consent and a documented verification process before a number can be reassigned to a new user. This shift protects subscribers from losing access to critical services like banking and KRA portals during periods of inactivity.
Ultimately, this decision mitigates identity theft by ensuring that sensitive data and OTPs belonging to the original owner are not accessible to the next subscriber.
Prisoners and vulnerable groups:
For prisoners and other vulnerable groups, the decision affirms that incarceration cannot be treated as voluntary inactivity and requires preservation of their mobile-linked digital identities. The State, in coordination with the CA, must ensure safeguards against reassignment and unauthorised data access. It also mandates clear reactivation mechanisms upon release to restore access to essential services. More broadly, the ruling protects vulnerable groups from arbitrary number recycling and resulting privacy violations.
In summary, this landmark ruling by the High Court of Kenya sets a new precedent for the protection of digital identity and privacy rights,particularly concerning mobile phone number recycling. It mandates significant changes in practices for Mobile Network Operators and offers greater security and control to subscribers, especially vulnerable groups.The implementation of the Court’s directives will be crucial in safeguarding personal data and ensuring constitutional rights are upheld in the digital age.
