Erastus Ngura Odhiambo & 1 other v Attorney General & 1 other

4. The Petitioners further contend this contravenes the right to equality as no law in Kenya prohibits anyone from having a phone or depriving them their digital identity. 5. Consequently, the Petitioners seek the following remedies against the Respondents: i. A declaration that there exists a personal digital identity and a person's registered phone number forms part of his/her digital identity just like the physical national ID., Passport or Driving license. ii. A declaration that every person has a fundamental right to protection of his/her privacy and digital identity. iii. A declaration that prisoners/persons deprived of liberty retain the right to enjoy the digital identity through continued use of their mobile numbers while serving their prison terms. iv. An order that persons deprived of liberty through imprisonment be allowed to have and use their mobile phones together with their registered numbers so as to prevent the loss of their digital identities. v. A declaration that any law or policy that prohibit a prisoner from using a mobile phone does not pass the threshold of acceptable limitation envisaged in Article 24(1) and therefore unconstitutional. vi. An order that the Kenya Prison Service facilitate prisoners to acquire mobile phones or digital devices for the purpose of staying updated and enjoying the right to digital identity. Petitioner’s Case 6. The 1st Petitioner, a prisoner serving 20-year sentence for the offence of murder avers that digital identity has become an integral component in today's economy and this has opened new opportunities in all sectors that now offer service through digitized processes. 7. He states that in Kenya, digital identity is widely embraced in the form of mobile identity wherein one is required to verify their identity through a One Time Password (OTP) or One Time Call (OTC) which is shared via a text message to a person’s mobile phone. For this reason, the Petitioner emphasizes that there is need to enhance digital ID protection in the digital space since mishandling of a digital asset can result in data breach. 8. The Petitioner states that once a person is convicted in Kenya, they automatically become ‘digitally dead’ as the Kenya Prisons Service does not allow prisoners to possess personal phones or other digital devices within the prison walls. As a result, many prisoners, have end up losing their phone numbers which comprise their digital identity because their mobile numbers are repossessed by mobile operators due to prolonged inactivity. The repossessed phone number is subsequently issued to a new client. 9. In his case, he stated that upon his conviction, he lost his phone number due to lengthy duration on non-use. He stated that he has six children who require his advice, mentorship and presence as a father. He adds that their schools had his mobile number through which they would share regular updates concerning the children’s progress but he is now unable to access that information. 10. He further depones that his business collapsed after he was convicted because he is no longer able to communicate with his employees. Further, he contended that his number was registered with institutions such banks, social organizations, Kenya Revenue Authority, insurance companies, among others. He states regular updates from those institutions and other sensitive information is now being received by third parties in breach of his right to privacy. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 2

page 2 of 22

11. The Petitioner is aggrieved that various institutions which are unaware of this shift, continue to send the previous owner’s classified and sensitive information to the new owners, which is in violation of their right to privacy under Article 31 of the Constitution as read with the Data Protection Act. 12. The Petitioner states that recently, the Communication Authority of Kenya (CAK) in a bid to strengthen digital identity and eliminate digital crimes, conducted sim registration countrywide where, all active mobile numbers were registered and verified. 13. He thus contends that it is now safe for everyone to be allowed to own a phone or digital service in keeping with Article 27 of the Constitution. He as well points out that there is no law in Kenya that currently prohibits anyone from owning a phone and having a digital identity. 14. On the contrary, he avers that the Kenya Prison Service does not allow prisoners to own phones thus denying them the right to communicate, right to equality and non-discrimination, freedom of expression and the right to identity. 15. On this basis, he maintains that it is discriminatory to have prison policies that prevent prisoners from keeping and using their phones. As such, he seeks this Court’s intervention to issue the necessary orders to the Kenya Prison Service prisoners acquire phones and maintain their digital identities. 1st Respondent’s Case 16. Opposing the Petition, the Respondents filed its Grounds of Opposition dated 9th July 2024 on the premise that: i. Whereas the Petitioner/imprisoned is entitled to the protection of all his fundamental rights and freedoms, the same is subject to reasonable and justifiable limitations taking into account the nature of the right or fundamental freedom, the importance of the purpose of the limitation, the nature and extent of the limitation, and the need to ensure that the enjoyment of rights and fundamental freedoms by the Petitioner/imprisoned does not prejudice the rights and fundamental freedoms of the public. ii. By dint of Section 4 of the Persons Deprived of Liberty Act (PDLA), the right to privacy of the Petitioner/imprisoned may be limited for reasons inter-alia: iii. If the limitation is for the purposes of maintenance and preservation of national security to the extent provided for in the Constitution. iv. If the limitation is for the purposes of security and safety of law enforcement officials and the persons deprived of liberty under their care. v. Where the enjoyment of that right prejudices or is likely to prejudice the rights and fundamental freedoms of others. vi. By dint of Section 8 of the PDLA, the Petitioner/imprisoned at the facilitation of the 2nd Respondent, has the right to communicate whether by telephone or other means with any person of their choice only upon the first instance of detention, being held in custody or imprisonment, and upon transfer or movement from one institution to another, without charge. vii. The right to family of the Petitioner/imprisoned is adequately protected under Section 24 of the PDLA which provides for visitation of such persons. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 3

page 3 of 22

viii. Further to the visitation rights provided for under section 24 of the PDLA, Section 25 of the Act also guarantees the right to family by requiring the 2nd Respondent to designate certain days as family days during which the Petitioner/imprisoned may be visited by and interact with their family members at least once every three months. ix. Whereas by dint of Article 51 of the Constitution the Petitioner/imprisoned retains all the rights and fundamental freedoms in the Bill of Rights, the rights sought in the Petition cannot issue as the same are clearly incompatible with the fact that the Petitioner/imprisoned is serving a lawful sentence and cannot therefore be granted as sought. x. No evidence has been adduced before the Court demonstrating that the Petitioner/imprisoned has and continues to suffer prejudice, damages or violation of his rights and freedoms under the Constitution so as to warrant the intervention by grant of the reliefs sought. xi. The rights alleged to have been violated are not absolute and have to be balanced in order to ensure that the enjoyment of rights and fundamental freedoms by the Petitioner/imprisoned does not prejudice the safety of the public. xii. Grant of the reliefs sought would negate the purpose of incarceration which includes deterrence, incapacitation and rehabilitation, bearing in mind that the Petitioner/imprisoned is serving a lawful sentence, consequently the same would not advance the rule of law. 2nd Respondent’s Case 17. The 2nd Respondent in opposition to the Petition filed his Replying Affidavit on 23rd July 2024. 18. Denying the 1st Petitioner’s averments, he states that his duty is to ensure that offenders are contained in humane safe conditions in order to facilitate responsive administration of justice, rehabilitation, social integration and community protection. 19. He avers that under Section 68 of the Prisons Act, personal mobile phones and digital devices belonging to inmates are classified as prohibited articles since pose a threat to national security through potential recruitment and participation in planning, financing and furtherance of terrorism related activities and other criminal offences. As such, he argues that if inmates are allowed to have personal mobile phones, they may continue committing crimes through extortion, intimidation of witnesses and facilitation of criminal gang activities. He adds that by virtue of being in prison, some of the inmates’ rights such as this are limited since not all fundamental rights are absolute. 20. He points out that contrary to the 1st Petitioner’s averment, all inmates are accorded the right to communicate with the outside world through supervised use of mobile phones, letters, and receipt of other personal items through other permitted channels. Equally, in compliance with Chapter 61 of the Prison Standing Orders and Rule 37 of the United Nations Standard Minimum Rules for the Treatment of Prisoners (UNSMR), inmates are allowed to communicate with their family and reputable friends at regular intervals, which is done through the Directorate of Rehabilitation and Welfare. 21. Additionally, inmates are accorded visitation rights so as to interact with their family and friends and likewise a family day, once every three months. This is done in accordance with Section 25 of the Persons Deprived of Liberty Act which is in line with Rule 58(b) of the UNSMR. 22. He avers that in relation to loss of inmates’ phone numbers and preservation of digital identity, they ought to liaise with CAK and the relevant bodies in seeking redress. Considering this, he argues that https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 4

page 4 of 22

the Petition which is adjudged as misconceived presents no cause of action against the Respondents and thus vexatious, scandalous and an abuse of the Court process. 23. The 2nd Respondent in light of this prays as follows: a. A declaration that the grant of use of personal mobile phones or digital devices by inmates is incompatible with the fact that they are detained. b. The suit be dismissed in its entirety and the Petitioner to bear the costs. c. The Respondents be provided by any other relief that this Court may deem fit to grant. 1st Petitioner’s Submissions 24. The 1st Petitioner in support of the Petition filed undated submissions wherein he sought to discuss: whether this Court has competent jurisdiction to hear and determine the instant matter, whether there exists a human right to digital identity and that individual registered mobile phone numbers forms the primary source of the digital identity, whether persons deprived of liberty retain all rights upon detention; particularly the enjoyment of the right to digital identity through the regular usage of their registered phone numbers while in detention, whether the denial to enjoy the right to digital identity for persons deprived of liberty is consistent with provisions of Article 24 of the Constitution and whether that blatant denial of the enjoyment of this right affects the right of other persons of interest. 25. The 1st Petitioner relying in Article 22, 23 and 165(3)(d) of the Constitution submitted that this Court has jurisdiction to entertain this matter since revolves around the alleged violation of prisoners’ rights under the Constitution and the Persons Deprived of Liberty Act. Reliance was placed in AOO and 6 Others v Attorney General and Another [2017] eKLR where it was held that: “ Article 165(3)(d)(i) and (ii) of the Constitution vest powers in the high court to hear any question respecting the interpretation of the Constitution including the determination of the question whether or not any law is inconsistent with or in contravention of the Constitution and also the question whether anything said to be done under the authority of the Constitution or any other law is inconsistent with or in contravention of the Constitution. An unconstitutional statute is not law and more important judicial function includes the power to determine and apply the law, and this necessarily includes the power to determine the legality of statutes. The judiciary has special role in our system with respect to constitutional interpretation. Court are bound by the Constitution and must interpret it when a dispute so requires.” 26. In the second issue, the 1st Petitioner submitted that in this digital age, digital identity is primarily sourced in the registered mobile number of every individual. As such, he argued that digital identity should be declared a human right and fundamental freedoms within the purview of Article 12 on identification issued by state, Article 33 on freedom of expression and impacting of ideas, under Article 45 (1) (c) and Article 53(1) (e)(2) of the Constitution. 27. Referring to Wikipedia, he noted that digital identity is defined as a digital identity is data stored on computer systems relating to an individual, organization, application, or device. For individuals, it involves the collection of personal data that is essential for facilitating automated access to digital services, confirming one's identity on the internet, and allowing digital systems to manage interactions between different parties. It is a component of a person's social identity in the digital realm, often referred to as their online identity. Likewise, he highlighted that in an Article by Taylor Graham https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 5

page 5 of 22

titled ‘Mobile Phone Numbers Become the Primary Source of Identity’, it was underscored that ‘the widespread adoption of digital technology in both personal and professional spheres, ranging from mobile banking to healthcare to e-commerce, heavily relies on individuals’ digital identities. This has led to a crucial demand for solutions safeguarding both consumers and businesses. At the core of digital identity lies the phone number. When it comes to verifying a digital identity, the phone number is the single most important piece of data that businesses use to verify a person or company.’ 28. Accordingly, the 1st Petitioner argued that a person’s digital identity is directly attached to his or her phone number and when a person loses the phone number, they automatically lose their identity in the digital space. He submitted thus that one’s registered phone number is their identity. Without this, a person misses out on essential government and private sector services such as KRA. Further, without the phone number prisoners’ rights to express themselves and receive information are curtailed under Article 33(1) and 35 of the Constitution. 29. Turning to the third issue, the 1st Petitioner argued that contrary to the Respondents assertion, prisoners retain all their rights and fundamental freedoms as envisaged under Article 51(1) of the Constitution except to the extent that any particular right of fundamental freedom in the bill of right is clearly incompatible with the fact that the person is detained, held in custody or imprisoned. In this case, the 1st Petitioner contended that no law prohibits prisoners from owning and using their phones. Such denial therefore is argued to be in breach of Articles 25(a), 29(d) and (f) 33(1) and 47 of the Constitution as read with Section 8(3) of the Persons Deprived of Liberty Act. He added that active communication is an important aspect in the rehabilitation process. 30. For this reason, the 1st Petitioner in the following issue, submitted that the Respondents denial to enjoy their digital identity does not conform with Article 24 (2) (e) of the Constitution as read with Section 4 of the Persons deprived of liberty Act. The 1st Petitioner stressed that the Respondents are under an obligation to prove how using registered mobile phone by persons deprived of liberty is a threat to security. In his view, such security threats, should be treated as exceptional cases and be dealt with on a case-by-case basis instead of blanket denial of the usage of such mobile phone. 31. To buttress this point reliance was placed in Kenya Human Rights Commission v Communications Authority of Kenya & 4 others [2018] eKLR where it was held that: “ A limitation of a constitutional right will be constitutionally permissible if (i) it is designated for a proper purpose; (ii) the measures undertaken to effectuate such a limitation are rationally connected to the fulfilment of that purpose; (iii) the measures undertaken are necessary in that there are no alternative measures that may similarly achieve that same purpose with a lesser degree of limitation; and finally (iv) there needs to be a proper relation (“proportionality stricto sensu” or “balancing”) between the importance of achieving the proper purpose and the special importance of preventing the limitation on the constitutional right.” 32. Moving on, the 1st Petitioner answering the fifth issue in the affirmative argued that the denial of the right to enjoyment of the digital identity has violated the rights of other persons of interest particularly the children and family members who depend on them for care and protection in violation of Article 43,45 and 53(1) of the Constitution. Further prisoners are unable to alert the relevant institutions such as KRA of their status and eventually due to dormancy, their phone numbers are deactivated and issued to a third party who continues to receive their sensitive information. This he argues is contrary to Article 31 of the Constitution and provisions of the Computer Misuse and Cybercrime Act. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 6

page 6 of 22

33. In sum, the 1st Petitioner contended that the 2nd Respondent’s directive to prohibit prisoners from owning and using dedicated phones registered with their identities is inconsistent with the laws of Kenya and hence unconstitutional. 2nd Petitioner’s Submissions 34. The 2nd Petitioner in like manner filed undated submissions in support of the Petition. He depones that he was sentenced to death on 12th October 2011 for the offence of murder wherein he was later on resentenced to 20 years. 35. He depones that following his arrest on 24th January 2009, he never accessed his mobile phone and phone number 072xxxxx48, again. He informs that this line was registered to Safaricom M-pesa services, Cooperative Bank, Kenya Commercial Bank, Equity Bank, KRA, Nairobi Hospital among many others. He depones that his line has since been issued to another person, one Everline Ngarum. He avers that his information continues to be shared on this line. 36. The 2nd Petitioner in light of these highlighted the issues for discussion as: whether there exists digital identity and whether this digital identity is primarily associated to individual registered mobile number?, whether a person deprived of liberty enjoys all rights under the Constitution and hence entitled to enjoy this digital identity as a right under the Bill of right and fundamental freedoms, whether taking away the 2nd Petitioner’s phone and registered line amount to the limitation allowed under Article 24 of the Constitution which speaks of limitation as opposed to total denial of a right and other fundamental freedoms, whether the digital identity which primarily associated with one’s mobile line should be enjoyed by prisoners by allowing them to use their registered mobile line while in custody and whether families of a deceased person should be given a priority in retaining the number of their demised kin. 37. On the first issue, the 2nd Petitioner argued that there cannot be doubt as to the existence of digital identity. He stated that this forms the personal unique identity that is consistent and reliable in the digital space and which in turn allows an individual to conduct online transactions online or otherwise in absence of physical presence in the institution of interest. In his view, the centrality of this identity is a person’s registered mobile number. He states that this number is used to register with e-citizen, Social Health Authority (SHA) among others. He pointed out that while the national identity card is a primary identity key, it is not sufficient to conduct online transactions without a mobile number. 38. Considering this, he contends that it is impossible for a Kenyan to operate efficiently without a digital identity and the existence of the same cannot be denied. In equal measure, he asserted that digital identity is a human right as one cannot access any online services without it. As such he stressed that this Court should protect this right under Article 19 and 20 of the Constitution. 39. On the second issue, the 2nd Petitioner echoed that a person deprived of liberty, retains all human rights and freedoms. He submitted that their rights can only be limited within the meaning of Article 24 of the Constitution. In the circumstances of this case, he argued that when he was deprived of his liberty, his right to digital identity was not limited as envisaged by Section 4 of the Persons Deprived of Liberty Act and by extension provisions of Article 24 but that the right was absolutely denied. 40. He as well submitted that while the Respondents purport that prisoners can communicate with ease with their families, this is not the case as the same is limited to the extent it lacks a meaningful purpose. In essence, he stated that the key issue in this matter is the prisoners’ right to access individual digital identity and receive information from institutions of interest through their designated registered mobile phone lines. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 7

page 7 of 22

41. Accordingly, the 2nd Petitioner in the next issue, stressed that the act of taking away their mobile phones and registered lines does not conform with the limitation provided under Article 24 of the Constitution as such denial is not explicitly provided for by law. He underscored thus that the Respondents were required to demonstrate that the restriction is reasonable and justifiable in an open democratic society, which they have not done. 42. On the fourth issue, the 2nd Petitioner submitted that the gist of the matter is their communication with the outside world which is sparingly and reluctantly done in prison once a month for 3 minutes. In his opinion, this affirms that there is total denial of the right to digital identity that is attached to their mobile numbers. He argued that there are lesser ways to restrict the enjoyment of the right to digital identity. He pointed out that the Respondents argument on security was not corroborated and issue of terrorism dubbed a matter of conjecture. 43. Relying on a comparable matter in Odhiambo v Officer in Charge, Kamiti Medium Prison & another [2024] KEHC 14379 (KLR), the 2nd Petitioner underscored that the Court held that: “ For the reasons I have given, I allow the applicant’s application, and further, by the powers conferred upon this Court under section 11(1) of the Fair Administrative Action Act and, for the avoidance of doubt, I hereby specifically order as follows: A declaration is hereby made that the respondents’ decision to deny the applicant access to the infrastructure, study materials and such tools as are necessary for the applicant to continue and pursue a post-graduate Masters of Science in Project Management program at Mount Kenya University is unconstitutional and, therefore, null and void, to the extent that it is contrary to articles 29(f), 43(1)(f) and 51(1) of the Constitution; A declaration is hereby made that the respondents’ decision to deny the applicant access to the infrastructure, study materials and such tools as are necessary for the applicant to continue and pursue a post-graduate Masters of Science in Project Management program at Mount Kenya University is illegal or unlawful to the extent that it is contrary section 18 of the Persons Deprived of Liberty Act, cap. 90A and article 13 (2) (c) of the International Covenant on Economic, Social and Cultural Rights. A mandatory order or an order in the nature of mandamus is hereby granted compelling the respondents to, forthwith and, in any event, not later than seven days of the date of this judgment, allow the applicant access the infrastructure, study materials and such tools as are necessary, including the tools handed over to Kamiti medium prison upon the applicant’s transfer to that prison, for the applicant to continue and pursue a post-graduate Masters of Science in Project Management program at Mount Kenya University. An order of prohibition is hereby issued prohibiting the respondents from barring the applicant, or in any other way interfering with the applicant’s access to the infrastructure, study materials and such tools as are necessary for the applicant to continue and pursue postgraduate Masters of Science in Project Management program at Mount Kenya University.” 44. Turning to the next issue, the 2nd Petitioner submitted that the mobile numbers of the demised family members must be preserved as property of the deceased and be dealt with under the law of succession. In the alternative, he submitted that family members must be allowed to make an application as to whether they surrender such numbers to the service providers. This is because once the mobile number is bought by a customer it becomes the property of the customer and service providers cannot resell that property without the authority of the family of the deceased relative. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 8

page 8 of 22

Respondents’ Submissions 45. These Respondents through Deputy Chief State Counsel, Kaumba S.O. filed submissions dated 14th February 2025. 46. Counsel recapping the averments in the 2nd Respondent’s affidavit maintained that all detained persons are facilitated to have communication with the outside world except that the facilitation is through use of scrutinized and designated communication channels and gadgets, and which communication is facilitated by the Prisons Service. 47. Counsel underscored that Article 25 of the Constitution, the right of a prisoner under Article 51(1) of the Constitution to communicate with family members using personal devices is not and cannot be an absolute right as advanced. 48. Counsel submitted that Article 24 of the Constitution, provides that any restrictions on the rights or fundamental freedoms, in this case the prisoners, must be by law and be reasonable and justifiable in an open and democratic society. Counsel submitted that Article 24(1) (d) of the Constitution decrees that the limitation of fundamental rights and freedoms may conclude the need to ensure that the enjoyment of rights and fundamental freedoms by any individual does not prejudice the rights and fundamental freedoms of others. 49. In this matter, Counsel contended that the scrutiny of the communication channels, and the mode and manner of facilitating communication is informed by the Prisons Act, the Persons Deprived of Liberty Act and the UNSMR. Counsel submitted that Section 58 of the Prisons Act criminalizes conveying or causing to convey any means of communication including letter or document without lawful authority. Section 8 of the Persons Deprived of Liberty Act provides for right of detained to communicate however, the same is not absolute save for the first instance of detention, being held in custody or imprisonment and upon transfer or movement from one institution to another. 50. To buttress their case, Counsel relied in Otieno v Ministry of Interior & Co-ordination of National Government (State Department for Correctional Services) & 2 others [2024] KEHC 1639 (KLR) where it was held that: “ My humble view is that the United Nations Standard Minimum rules for Treatment of Offenders are neither general rules of International law nor are they a treaty or a convention to be applied automatically as if they were the laws of Kenya even in absence of any particular legislation directly addressing the subject matter raised by the petitioner. This is not to say these rules have relevance to Kenya whatsoever. The rules may not be legally binding but they are universally accepted standards designed as the good practice or model guide on treatment of offenders. Kenya forms part of the civilized world and cannot therefore remain oblivious about the existence of these rules...” 51. Counsel submitted that the UNSMR contemplates reasonable and justifiable restriction under Rule 3 and provides for communication under Rule 58. 52. In a nutshell, Counsel submitted that supervised communication is informed by law and therefore justifiable, reasonable and proportionate in the circumstances of this case. Reliance was placed in https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 9

page 9 of 22

Andama v Director of Public Prosecutions & 2 others; Article 19 East Africa (Interested Party) [2021] KEHC 12538 (KLR) where it was held that: “ Two central criteria must be satisfied to establish that a limit is reasonable and demonstrably justified in a free and democratic society. First, the objective to be served by the measures limiting a charter right must be sufficiently important to warrant overriding a constitutionally protected right or freedom. The standard must be high to ensure that trivial objectives or those discordant with the principles of a free and democratic society do not gain protection. At a minimum, an objective must relate to societal concerns which are pressing and substantial in a free and democratic society before it can be characterized as sufficiently important. Second, the party invoking s.1 must show the means to be reasonable and demonstrably justified. This involves a form of proportionality test involving three important components. To begin, the measures must be fair and not arbitrary, carefully designed to achieve the objective in question and rationally connected to that objective. In addition, the means should impair the right in question as little as possible. Lastly, there must be a proportionality between the effects of the limiting measure and the objective?? the more severe the deleterious effects of a measure, the more important the objective must be.” 53. Comparable reliance was placed in Otieno v Ministry of Interior & Co-ordination of National Government (supra). Analysis and Determination 54. It is my considered view, that the issues that arise for determination are: i. Whether a person’s phone number constitutes digital identity. ii. Whether re-assignment of a person’s phone number due to an extended period of inactivity violates the right to privacy under Article 31 of the Constitution. iii. Whether it is unconstitutional for the Respondents to limit access to and/or use of phones by prisoners while in custody. iv. Whether the Petitioners are entitled to the reliefs sought. Whether a Person’s Phone Number Constitutes Digital Identity 55. As a starting point, it is important to set out what the law says about digital identity before delving into its significance in relation to the right to privacy under Article 31 of the Constitution. 56. Under the Data Protection Act, 2019; the following terms are defined in Section 2: “ Identifiable natural person" means a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity; "Personal data" means any information relating to an identified or identifiable natural person; "Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed; https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 10

page 10 of 22

57. The Kenya Information and Communications Act define a SIM card under Section 2 as follows: “ SIM-card" means the Subscriber Identity Module which is an independent electronicallyactivated device designed for use in conjunction with a telecommunication apparatus to enable the user of the telecommunication apparatus to transmit and receive indirect communications by providing access to telecommunication systems and enabling such telecommunication systems to identify the particular Subscriber Identity Module and its installed information. 58. The Act provides the duties of a telecommunications operator as follows under Section 27A: 1. Before a telecommunications operator sells a SIM- card or otherwise provides telecommunication services to a person, it shall obtain— a. from natural persons, the person's full name, identity card number, date of birth, gender, physical and postal address; b. from corporate persons or statutory bodies, official name, postal and physical address, particulars of registration, incorporation, enabling legislation or Gazette notice, as the case may be; and c. 2. such other information as may be prescribed from time to time. A telecommunication operator shall ensure that— existing subscribers register their SIM-cards within such time period as may be prescribed; proper physical or electronic records are kept of the information referred to in subsection (1) and any change in such information; the registration details of a subscriber are kept in a secure and confidential manner, and shall not be disclosed without the written consent of the subscriber. 3. Notwithstanding the provisions of subsection (2)(c), a telecommunications operator may disclose the registration particulars of a subscriber— for the purpose of facilitating the performance of any statutory functions of the Authority; in connection with the investigation of any criminal offence or for the purpose of any criminal proceedings; or for the purpose of any civil proceedings under the Act. 59. (3A) Subject to subsection (3B), a telecommunication operator shall, before levying or allowing to be levied, any specific charge relating to a premium rate service provided to a subscriber, disclose the fact, amount, and frequency of the charge to the subscriber. (3B) Subsection (3A) shall not apply to services rendered by a telecommunications operator on behalf of a public body. (4) Any telecommunications operator who contravenes this section commits an offence and shall be liable on conviction to a fine not exceeding five million shillings. On the other hand, the duties of a subscriber is provided under Section 27C as follows: 1. A subscriber of telecommunications services shall— provide the registration details required under section 27A; https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 11

page 11 of 22

report to a telecommunications operator or a police station when his or her SIM-card is lost or stolen, within forty-eight hours of being lost or stolen or such other period as may be prescribed; report any change in any identification details to a telecommunications operator within thirty days of the change taking place. 60. 2. A subscriber shall be prima facie liable for activities or transactions carried out using a SIMcard, registered under the subscriber's name. 3. Notwithstanding subsection (2), a subscriber shall not be held liable if the subscriber can prove that he or she was not in control of the SIM-card at the time a particular activity or transaction was carried out. 4. A person who contravenes this section, or knowingly provides false information to a telecommunications operator or registration agent commits an offence and shall be liable on conviction a fine not exceeding one hundred thousand shillings or to imprisonment for a term not exceeding six months, or both. The Kenya Information and Communications (Registration of Telecommunications Service Subscribers) Regulations- Legal Notice 90 of 2025- Regulations 5, 6, 7 and 8 provide as follows: 5. Registration of telecommunication subscribers A telecommunications operator or registration agent shall, prior to registration of a subscriber, seek the production of original identification documents which include— 6. a. for Kenyan citizens who have attained the age of majority, any recognized identification documents issued by the Government of Kenya; b. for a child, the birth certificate of the child and the identification documents of the parent or guardian; c. for members of the Kenya Defence Forces, an original Service Card; d. for a foreigner, a valid Passport or Foreign National Registration Certificate; (e) for a refugee, a valid Refugee Identity Card; (f) for a stateless person, a birth certificate or a valid identification document issued under the Kenya Citizenship and Immigration Act ( Cap. 170); and (g) for a company, the Certificate of incorporation of the company incorporated under the Companies Act (Cap. 486). SIM-card registration requirements for a child (1) A parent or a guardian who intends to register a SIM-card on behalf of a child shall provide the documents specified under regulation 5 (b). (2) The parent or guardian shall be registered as the subscriber of that particular SIM-card until the child attains the age of majority. (3) The child’s birth certificate number, name and age, shall be indicated on the registration form. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 12

page 12 of 22

7. 8. (4) The telecommunications operator shall periodically inspect the list of SIM cards registered on behalf of children and issue a notification on the parent or guardian on the requirement to provide their personal identification details once they attain the age of majority. (5) Upon the child attaining the age of majority, they shall be required to register their personal identification details within a period of ninety days in accordance with these Regulations. (6) The telecommunications operator shall, upon the lapse of the ninety-day period, suspend SIM-cards registered on behalf of a child who has attained the age of majority but has not updated their registration details as required under these Regulations. Verification (1) A telecommunications operator or registration agent shall, when registering a person, verify the information provided for registration purposes. (2) The verification process by the telecommunication operator or agents shall involve authentication of the documents with the existing relevant Government database. (3) A person who registers a subscriber without verifying the provided registration details commits an offence. Registration process A telecommunications operator or registration agent shall— 61. a. enter the registration particulars provided by a person in electronic or print form as provided in Form 1 set out in the Schedule and may require the subscriber to appear in person for registration; b. verify documents and identification information presented by a person seeking registration against the relevant Government database; c. where necessary, update any information pursuant to regulation 11 into the telecommunications operator’s database; and(d)maintain the registration particulars obtained in a secure and confidential manner On assignment of numbers, the Kenya Information and Communications (Numbering) Regulations under Regulation 9 states as follows: Assignment of communications numbers Where an application for communication numbers or addresses is submitted to the Commission, the Commission shall, after taking into account the National Communication Numbering and Address Plan and availability of the numbers and addresses, assign and issue a certificate of assignment together with the conditions attached to the use of the communication numbers the numbers required for the communication numbers or addresses, upon payment of the prescribed fee. 62. The Constitution does not expressly single out digital identity as a fundamental right. However, given the elaborate legislative registration scheme that connects SIM registration to the official personal identification records of the subscriber, the mobile number is for all purposes a digital identifier that record provides a ‘means a person can be identified directly or indirectly’. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 13

page 13 of 22

63. Further, as ably argued by the Petitioners in the undisputed contention. A registered phone number has now become the means for authentication and verification credentials for online transactions where security codes such as OTPs are sent to authenticate transactions. The registered mobile number thus provides link to delicate ‘personal data’ that qualifies for protection under the right to privacy under Article 31 of the Constitution. 64. Elaborating on the right to privacy, the Court in Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 8 others (Interested Parties) [2020] KEHC 8772 (KLR) observed thus: “ 741. In addressing these two related limbs, this Court is mindful of the provisions of Article 31 of the Constitution on the right to privacy, which provide as follows: “Every person has the right to privacy, which includes the right not to have— 742. a. their person, home or property searched; b. their possessions seized; c. information relating to their family or private affairs unnecessarily required or revealed; or d. the privacy of their communications infringed.” The Article therefore guarantees a general right to privacy, and in addition also guards against specific infringements of privacy, including unnecessary revelation of information relating to family or private affairs, which is the bone of contention in the consolidated petitions herein. The South African Constitutional Court discussed the elements and scope of the general right to privacy in Bernstein v Bester NO (1996) 2 SA 751 (CC), wherein Ackermann J. held as follows in the majority judgment in paragraph 67: “(67) …..The truism that no right is to be considered absolute, implies that from the outset of interpretation each right is always already limited by every other right accruing to another citizen. In the context of privacy this would mean that it is only the inner sanctum of a person, such as his/her family life, sexual preference and home environment, which is shielded from erosion by conflicting rights of the community. This implies that community rights and the rights of fellow members place a corresponding obligation on a citizen, thereby shaping the abstract notion of individualism towards identifying a concrete member of civil society. Privacy is acknowledged in the truly personal realm, but as a person moves into communal relations and activities such as business and social interaction, the scope of personal space shrinks accordingly.” 65. In my view, when mobile digital identity is lost through reallocation or recycling without interrogating the reasons behind the long period of non-use or inactivity or giving the affected person the opportunity to redeem their digital identity as in the case of prisoners, where the SIM card is assigned to another person, it creates an avenue for unauthorized disclosure delicate information such as the person’s family or his financial affairs to the 3rd Parties. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 14

page 14 of 22

66. The Constitution protects not just the actual breach of fundamental freedoms but also ‘actual threat’ to a right or fundamental freedom. Article 22(1) provides that “ Every person has the right to institute Court proceedings claiming that a right or fundamental freedom in the Bill of Rights has been denied, violated or infringed, or is threatened.” 67. To answer the question therefore as to whether a person’s registered phone number constitutes digital identity, the finding of this Court is in the affirmative. Whether unfettered re-assignment of a person’s phone number due to an extended period of inactivity violates the right to privacy to privacy under Article 31 of the Constitution 68. The Petitioner contended that as Prisoner serving long term sentence, and indeed many other prisoners, he lost his digital identity after his mobile number was deactivated unilaterally without any notice. He expressed fears that his private information relating to family, bank alerts which were being availed to him through his digital identity may have landed and continue to be exposed to 3rd Parties assigned his previously number in violation of the right to privacy under Article 31 (c) and (d) of the Constitution. 69. The question thus becomes, are there legal safeguards in place to ensure that the deactivation and subsequent re-assignment and/or recycling of the registered telephone numbers does not lead to arbitrary violation of the right to privacy under Article 31? 70. Under regulation 17 of the Kenya Information & Communication (Registration of Telecommunication Service Subscribers) Regulation Legal Notice 90 of 2025, deactivation is provided for. It states as follows: 17. Deactivation ‘A telecommunications operator shall deactivate a telecommunications service— (a) where telecommunications services to the subscriber have been suspended for a period of ninety days; (b) upon request by a subscriber; or (c) where the telecommunications operator or the Authority establishes that the subscriber has provided false information for registration 71. Though deactivation is provided after prolonged period of non-use or inactivity, specifically 90 days, the regulations are silent on how the reassignment or recycling of the deactivated telephone number is undertaken. It is left to the unregulated discretion of the Network Providers. Further, the deactivation of the registered telephone numbers for non-use is done without any regard as whether there exists any reasonable justification for the non-use. It does not give the subscriber the opportunity to explain or retain the digital identity once the 90 days of non-use have been confirmed, yet the registered phone number as a digital identifier, already provides vital link to delicate personal data. The provision is so mechanical that it fails to appreciate that a non-use may in fact be justified, like in the case of prisoners serving a sentence as in the instant case. A person may also have left the country for treatment in a country that does not have ‘roaming services.’ A student in a boarding school where the use of phones is prohibited could similarly suffer the same fate. 72. In regard to imprisonment, the Constitution provides that an imprisoned person, or person deprived of liberty, retains all the rights and fundamental freedoms in the Bill of Rights except to the extent that https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 15

page 15 of 22

any particular right is incompatible with the imprisonment. Prisoners are also entitled to protection of their privacy. Imprisonment does not give the latitude to trample of their other rights guaranteed under the Bill of Rights. Automatic loss of the digital identity risks infringing on their right to privacy as their personal information that is linked and shared through digital identity may be spill over to 3rd Parties without their consent or approval. Article 51 provides that ‘ A person who is detained, held in custody or imprisoned under the law, retains all the rights and fundamental freedoms in the Bill of Rights, except to the extent that any particular right or fundamental freedom is clearly incompatible with the fact that the person is detained, held in custody or imprisoned’ 73. There has been no demonstration in this Petition that allowing a prisoner to keep or maintain his or her digital identity acquired upon registration of the SIM card is incompatible with the fact that the prisoner is imprisoned or detained. Imprisonment should not translate to extinction of a prisoner’s digital digital identity. 74. This Court finds that the provision in the existing regulations that allows deactivation of registered telephone numbers without interrogating if there exists a valid reason for non-use is unreasonable and arbitrary. It does not meet the constitutional standards of Article 24 or 47 of the Constitution. There no public notices issued whether in newspapers, electronic media or websites indicating any intention to deactivate and/or reassign mobile numbers and no opportunity is given for providing explanation for non-use. 75. As for the prisoners, not even the Kenya Prison Service is given the opportunity to liaise with the Network Operators so that prisoners desirous of maintaining their digital identity with a view to protecting the privacy of their personal data linked to this particular digital identity is provided. There is no room for preservation of these numbers. Alternatively, the Prison service has not demonstrated that there exists any scheme that enables the prisoners to regularly activate their registered telephone numbers in order to preserve their digital identity during the time of imprisonment. 76. As was held by this Court in Otieno v Ministry of Interior & Co-ordination of National Government (supra): “ 36. 37. Article 20(3) requires that in applying the Bill of rights, the court should be guided by the following principles among others: a. to develop the law to the extent that it does not give effect to a right or fundamental freedom. b) adopt an interpretation that most favours the enforcement of a right or fundamental freedom. The phrase to ‘develop the law to the extent that it does not give effect to a right or fundamental freedom’ in my view means that in developing the judge made law or jurisprudence on the law relating to human right, the court must be cautious and resist the temptation of arrogating upon itself the law-making the power under in the pretext of developing the law. Nevertheless, it is given the latitude to adopt an interpretation that mostly favours or embraces the enforcement of a recognized right or fundamental freedom.” https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 16

page 16 of 22

77. In my view, the interpretation that most favours the enforcement of Bill of Rights is this case is that which protects the digital identifier to ensure personal data is safeguarded from risks associated with mechanical deactivation action and re-assignment of the rehistered telephone numbers without regard to any subscriber personal circumstances. There are thus obvious gaps in the current statutory and regulatory scheme which make it fall short of meeting the constitutional protection on privacy under Article 31 of the Constitution or guarantees on fair administrative action under Article 47 of the Constitution. The unfettered deactivation and reassignment/recycling of telephone numbers poses a real threat to privacy of information linked to the registered telephone number (digital identifier). Whether it is unconstitutional for the Respondents to limit access to and/or use of phones by prisoners while in custody. 78. The 2nd Petitioner contended that the act of not permitting the prisoners to use mobile phones denies them the use of their registered lines does not meet the limitation requirements provided for under Article 24 of the Constitution. He underscored thus that the Respondents are required to demonstrate that the restriction is reasonable and justifiable in an open democratic society, which they did not. He argued that the gist of the matter is their communication with the outside world is severely restricted as one is only given a chance once a month and for only 3 minutes. He thus argued that there is total denial total denial of the right to digital identity attached to the mobile number yet there are lesser ways to restrict the enjoyment of the right to digital identity. He pointed out that the Respondents argument that this is done for security reasons was not proved and the mention of terrorism was a mere conjecture. 79. The Respondent reiterated the averments in 2nd Respondent’s affidavit that all detained persons are facilitated by the Kenya Prisons Service to have communication with the outside world save that the facilitation is done through use of scrutinized and designated communication channels and gadgets. Mr. Kaumba S.O – the Deputy Chief State Counsel contended that the right of a prisoner to communicate with family members using personal devices is not and cannot be an absolute right as advanced. He submitted that Article 24 of the Constitution, provides that any restrictions on the rights or fundamental freedoms, in this case the prisoners, must be by law and be reasonable and justifiable in an open and democratic society and in particular cited Article 24(1) (d) that the enjoyment of rights and fundamental freedoms by any individual shall not prejudice the rights and fundamental freedoms of others. 80. Mr. Kaumba argued that the scrutiny of the communication channels, and the mode and manner of facilitating communication is informed by the Prisons Act, the Persons Deprived of Liberty Act and the United Nations Standard Minimum Rules (UNSMR). He submitted that Section 58 of the Prisons Act criminalizes conveying or causing to convey any means of communication including letter or document without lawful authority while Section 8 of the Persons Deprived of Liberty Act provides for right of detained to communicate, but the same is not absolute save for the first instance when one is being held in detention, custody or imprisonment and upon transfer or movement from one institution to another. 81. The starting point is the examination of the constitutional and legal regime that governs the rights of persons detained held in custody or imprisoned. the Constitution in Article 51 states: 51 (1) A person who is detained, held in custody or imprisoned under the Law, retains all the rights and fundamental freedoms in the Bill of Rights, except to the extent that any https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 17

page 17 of 22

right or fundamental freedom is clearly incompatible with the fact that the person is detained, held in custody or imprisoned. 82. 2) A person who is detained or held in custody is entitled to Petition for an order of habeas corpus 3) Parliament shall enact legislation thata. provides for the humane treatment of persons detained, held in custody or imprisoned; and b) takes into account the relevant international human rights instruments. To give effect to this Article, Parliament enacted the Persons Deprived of Liberty Act, Cap 90A. Section 4 of the Act lists instances where the limitation of the right to privacy is permitted in respect of persons deprived of liberty. It states: Limitation of right to privacy The right to privacy set out in Article 31 of the Constitution, may be limited in respect of a person deprived of liberty— a. if the limitation is for the purposes of maintenance and preservation of national security to the extent provided for in the Constitution; b. if the limitation is for the purposes of security and safety of law enforcement officials and the persons deprived of liberty under their care; c. where the enjoyment of those right prejudices or is likely to prejudice the rights and fundamental freedoms of others; d. where there is need for humanitarian assistance of migrants, refugees, asylum or refugees’ status seekers, stateless and undocumented persons; e. where there is need for psychiatric treatment of persons with mental, or sensory disabilities; or (f) if the limitation of the right is for the purposes of the security and safety of children, elderly persons and persons with disability. 8. Right to communicate 1. A person deprived of liberty shall have the right to communicate whether by telephone or other means with any person of his or her choice in any of the following circumstances— a. upon the first instance of detention, being held in custody or imprisonment; and b. upon transfer or movement from one institution to another. 2. The person in charge of a facility at which the person deprived of liberty is held shall facilitate the communication specified in subsection (1) without charge. (3) Nothing in this section shall limit the right of any person deprived of any liberty to communicate with any other person except in such circumstances as may be specified in Regulations. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 18

page 18 of 22

83. Section 58, 59 and 60 of the Prisons Act, Cap 90 specify the prohibitions that must be observed by the prisoners. Although no specific mention is made of mobile phones, Section 58 expressly bans all unauthorized communication with the prisoner, including letters or documents, and proceeds to ban supply or conveying of ‘any other Article whatsoever.’ It does not therefore leave any room for possession of mobile phones or free communication by prisoners through them unless authorized. Section 58 of the Prisons Act Cap 90 States: 58. Trafficking Any person without lawful authority who— a. conveys, supplies or causes to be supplied or conveyed to any prisoner, whether within or without a prison, or hides or places for the use of any prisoner, any letter or document, or any intoxicating liquor, tobacco, bhang or hemp, drug, opiate, money, clothing, provisions or any other articles whatsoever; or b. brings or attempts to bring by any means whatsoever into any prison, or places or attempts to place where prisoners shall labour, any letter or document, or any intoxicating liquor, tobacco, bhang or hemp, drug, opiate, money, clothing or provisions; or c. brings or attempts to bring out of any prison or conveys from any prison any letter or document; or d. communicates with any prisoner without lawful authority, shall be guilty of an offence and liable to imprisonment for a term not exceeding one year or to a fine not exceeding four thousand shillings or to both such fine and such imprisonment. 84. From the foregoing, it is manifest that there are legal limitations placed on the right of the prisoner or persons deprived of liberty in regard to the right to privacy and the right and the freedom of expression by the specific provisions in legislation- The Prisons Act, Cap 90 and the Persons Deprived of Liberty Act Cap 90A. 85. This being the case, these are lawful limitations and unless the Petitioner can demonstrate that the limitations are unconstitutional for not conforming constitutional threshold set out by Article 24 (1) by showing they are unreasonable and unjustifiable in an open and democratic society, the Court has no reason to fault the law. No specific challenge was mounted by the Petitioners on the unconstitutionality of the statutory provisions. 86. In any case, it is this Court’s view that the limitations imposed by the do not entirely derogate from the core or essential content of the right to privacy or the right of expression/communication as the prisoners are provided with structured scheduled communication appropriate to their circumstance to ensure the objective of the imprisonment is realized as allowing uncontrolled access to communication by those incarcerated could create greater harm to the society or victims though threats and intimidation to victims of offences or provide medium for coordination to commit further is crimes. 87. In my humble opinion, the limitations that have been provided for in legislation are measured hence constitutional, proportionate and necessary to facilitate the enjoyment of the Bill Rights by prisoners in a manner appropriate to their circumstances. the Constitution does not give unbridled privacy or communication rights to persons lawfully deprived of liberty and it thus the finding of this Court that the limitation that have been put in place to regulate the privacy and freedom of expression for persons in prison and those deprived of liberty are legitimate and not violate the Constitution. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 19

page 19 of 22

88. The finding of this Honourable Court therefore is that it is not unconstitutional for the Respondents to limit access to and/or use of mobile phones by prisoners while in custody. Whether the Petitioners are Entitled to the Reliefs Sought. 89. The Petition has partially succeeded. The Petitioners have demonstrated that deactivation and unfettered reassignment and/or recycling of the registered mobile telephone numbers due to prolonged period of inactivity constitutes a real threat to the right to privacy that is protected under Article 31 (c) of the Constitution. Prisoners who are serving long sentences have invariably been subjected to the loss of the phone digital identification following involuntarily loss of their registered mobile telephone numbers upon expiry of 90 days of non-use or inactivity. This risks the exposure of their sensitive personal data to unauthorized disclosure. 90. This Honourable Court is of the view that this state of affairs has been largely contributed to by regulatory gaps which require judicial intervention to remedy so as to ensure steps are taken to seal the loophole of unregulated recycling and/or reassignment of the deactivated mobile telephone numbers to 3rd Parties guarantee the right to privacy afforded by Article 31 (c) of the Constitution. 91. Article 23 (3) of the Constitution specifies the reliefs that this Court may grant in Constitutional Petitions but proceeds to give the Court the liberty to consider appropriate relief by stating thus: “ in any proceedings brought under Article 22, a may grant appropriate relief, including” 92. The use of the word ‘appropriate relief and including’ makes the list non-exhaustive provided nonexhaustive and empowers the Court to consider what in its view is the appropriate relief, meaning that the Court may not be restricted to the list provided for in the Constitution or what is pleaded by the Parties, it can in appropriate cases decide on the relief that suits the circumstances of the case. 93. In L A W & 2 others v Marura Maternity & Nursing Home & 3 others; International Community of Women Living with HIV (ICW) (Interested Party); Secretariat of the Joint United Nations Programme on HIV/AIDS & 2 others (Amicus Curiae) [2022] KEHC 17132 (KLR) the Court affirmed this approach by holding thus: “ 244. As is the case in constitutional petitions, there are arrays of available remedies. what a court endeavours to do upon confirming of any infringement is to grant an appropriate remedy. Even in instances where a party fails to ask for a specific relief, a court, depending on the nature of the matter ought to craft an appropriate relief…” 94. In the circumstances, I am of the view that there is need to consider appropriate proportionate remedies that would bring to an end the risk of continued violation of Article 31 (c) and (d) that is manifest from the weak regulatory scheme currently in place. 95. This Court thus considers the following remedies as commending themselves for issuance: 1. For avoidance of doubt, a declaration is hereby issued that the denial or refusal to allow prisoners or persons deprived of liberty access to mobile phones during their incarceration is a justifiable and proportionate limitation on the right to privacy under Article 31 and the right to communication/expression under Article 33 as the limitations conform to the principles stipulated under Article 24 (1) of the Constitution. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 20

page 20 of 22

2. A declaration is hereby issued that registered mobile phone number constitutes a digital identifier linking personal data that relates to an individual’s private affairs hence qualifies for protection under Article 31 (c) & (d) of the Constitution to safeguard the right not have information relating to private affairs unnecessarily required or disclosed. 3. A mandatory order is hereby issued, directing the Attorney General, within six months from the date of this Judgment, and in collaboration with all relevant Departments (Including but not limited to the Office of the Data Protection Commissioner, the Communication Authority of Kenya and the relevant Ministry) to take all necessary and appropriate measures to safeguard digital identity associated with the registered mobile telephone number against unfettered deactivation, and subsequent arbitrary reassignment or recycling. The measures shall ensure reassignment of any deactivated and previously registered number shall only be possible: a. If there is the previous registered owner’s informed and verifiable consent. b. After expiry of reasonable period following issuance of public notice which must be preceded by through documented verification process aimed at confirming the original registered owner cannot be located or has unequivocally revoked the rights to the number. c. Technical safeguards be put in place and implemented to prevent unauthorized exposure or transfer of personal data linked to previous registered owner to 3rd Parties upon reassignment or recycling of the number. 4. That is relation to prisoners, the Attorney General, in conjunction with the Kenya Prisons Service through the Commissioner General of Correctional Services, ( in liaison with the Office of the Data Protection Commissioner, the Communication Authority of Kenya and the relevant Ministry) shall within 6 months from the date of this Judgment, formulate and gazette internal regulatory scheme that ensures the preservation of digital identity of the prisoners or persons deprived of liberty which has already been acquired through the registration of the mobile telephone number until the lawful incarceration is served. In particular, formulate a mechanism for notification of the mobile network operators by providing through the Kenya Prison Service details of the prisoner upon sentence so to facilitate the preservation of the digital identity of the registered mobile number by ensuring that it is not reassigned or recycled to enable the Prisoner continue using it upon completion of the sentence. 5. In the alternative to order No. 4 above, the Kenya Prison Service, within six months from the date of this Judgment, formulate and gazette regulations that provide for supervised and regulates access, strictly in accordance with the provisions of Section 8 of Persons Deprived of Liberty Act, thereby enabling prisoners or persons deprived of liberty to activate or update their registered telephone numbers as and when necessary, so as to safeguard personal data linked to those numbers. 6. In default of implementing the above orders, at the expiry of the 6th month, in particular, the midnight of 19/9/2026, the reassignment and/or recycling of deactivated previous registered mobile numbers shall automatically cease to safeguard constitutional protection afforded by Article 31 (c) and (d) of the Constitution. 7. This being Public Interest Litigation, I make no orders as to costs. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 21

page 21 of 22

DATED, SIGNED AND DELIVERED VIRTUALLY AT NAIROBI THIS 19TH DAY OF MARCH, 2026. ………………………………….. L N MUGAMBI JUDGE https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3809/eng@2026-03-19 22

page 22 of 22