On March 19, 2026, Justice Lawrence Mugambi of the High Court of Kenya delivered a landmark judgment affirming that mobile phone numbers form an integral part of an individual’s digital identity and are protected under the constitutional right to privacy. The decision arose from a petition filed by Erastus Ngura Odhiambo, an inmate who challenged the practice of reallocating SIM cards during periods of involuntary inactivity. Odhiambo argued that such reassignments exposed former users to risks of unauthorized access to personal, financial, and social data. The court agreed, holding that registered phone numbers are not mere communication tools but constitute sensitive personal data deserving robust legal protection.
The court expressly prohibited telecommunications companies, including Safaricom, from automatically recycling inactive or dormant phone numbers without the consent of the original subscriber. It found that the longstanding industry practice of reassigning numbers created a real and immediate risk of privacy breaches, as new users could gain access to residual data linked to mobile banking, messaging platforms, and online accounts. In reaching its decision, the court emphasized that such exposure amounts to an unjustifiable infringement of the right to privacy as guaranteed under the Constitution of Kenya.
Importantly, the court issued structural orders directed at the Office of the Attorney General, granting it six months to develop comprehensive regulations governing the management of inactive mobile numbers. These regulations are expected to include mandatory notification to original subscribers, clear consent mechanisms, and the implementation of technical safeguards to prevent the transfer or leakage of personal data upon reassignment. This directive signals a shift from reactive adjudication to proactive regulatory governance in Kenya’s digital space.
The implications of this ruling for the rule of law are significant. First, it reinforces constitutional supremacy by subjecting private sector practices to strict compliance with fundamental rights. Second, it expands the jurisprudence on privacy by recognizing digital identifiers as extensions of personhood in the modern age. Third, it enhances accountability by compelling both state and corporate actors to adopt rights-based frameworks in technological and commercial operations. The decision also reflects judicial responsiveness to evolving societal realities, particularly the centrality of mobile technology in financial and social life in Kenya.
Public reaction among Kenyans has been largely positive, with many welcoming the ruling as a long-overdue safeguard against fraud and identity theft. Mobile money users, in particular, have expressed relief at the prospect of enhanced protection for platforms such as M-Pesa, where phone numbers are directly tied to financial transactions. However, some stakeholders in the telecommunications sector have raised concerns about the operational and economic implications of the ban, including the management of finite numbering resources. Overall, the judgment marks a decisive step toward strengthening digital rights and aligning Kenya’s legal framework with contemporary technological realities.
