Court Stops Government from Forcing Kenyans to Register Their Phone IMEI Numbers

In a major ruling, the High Court in Nairobi has halted the government’s plan to collect mobile phone IMEI numbers from Kenyans and visitors, deeming it unconstitutional and a threat to the right to privacy. The case was filed by Katiba Institute against the Communications Authority of Kenya, the Kenya Revenue Authority, and the Attorney General.

What the Government Wanted to Do

In October 2024, the Communications Authority and the Kenya Revenue Authority issued public notices that required mobile phone importers, assemblers, and even travellers arriving in Kenya to declare their mobile device IMEI numbers. Retailers and network operators were also directed to only sell or connect phones that were listed in a government-controlled whitelist database.

This meant that anyone using a mobile phone would be forced to register its IMEI number, or risk being blocked from using the network. Even people visiting Kenya were to declare their phone details, including the IMEI number, at the airport using a customs declaration form.

Why Katiba Institute Went to Court

Katiba Institute filed the case arguing that IMEI numbers, although technical, can be used to trace or identify people when linked with other information like phone numbers, names, and SIM card details. They said this was a threat to the right to privacy under Article 31 of the Constitution and could lead to unnecessary surveillance.

They also pointed out that the notices were issued without public participation, had no backing in law passed by Parliament, and had not been subjected to a data protection impact assessment as required by the Data Protection Act.

How the Government Responded

The government defended its decision by saying the notices were meant to stop tax evasion, stop counterfeit devices, and protect public revenue. They argued that IMEI numbers are technical codes tied to devices, not individuals, and do not count as personal data. They also said the information would be collected at the point of importation, before the devices are sold, and would not affect individual privacy.

They further claimed that the case should have been heard first by other bodies like the Communications and Multimedia Appeals Tribunal or the Data Protection Commissioner, and that a similar case had already been decided earlier.

The Court’s Decision on Jurisdiction

The court rejected the claim that the matter should have gone to other bodies first. It ruled that when someone alleges that constitutional rights are under threat, the High Court has the power to hear the case directly. It also found that the earlier case mentioned by the government was different and did not deal with the current issues of mandatory IMEI registration and whitelisting.

Did the IMEI Numbers Count as Personal Data?

The court explained that while IMEI numbers are technical, they become personal when combined with other details like the owner’s name, phone number, or passport. This means they are protected under the Constitution and the Data Protection Act.

Because of that, any collection of this data must be handled carefully. There must be a clear legal basis, and people must be informed about how their data will be used. In this case, none of that had been done.

Why the Court Found the Notices Unlawful

The court ruled that the notices by the Communications Authority and the Kenya Revenue Authority were unlawful. They had the effect of changing the law but had not been approved by Parliament as required under the Statutory Instruments Act. There was no public consultation or legal assessment of their impact on people’s rights.

The court also found that the process would likely lead to discrimination, especially against poor people who may not afford compliant devices. It would also limit access to essential services such as mobile banking, communication, and digital services for anyone who could not register their device.

Final Orders by the Court

The court declared the notices unconstitutional, null, and void. It barred the government from implementing them. It also ordered that before any future collection of IMEI data or rollout of a similar system, the government must conduct a data protection impact assessment and follow all constitutional and legal requirements.

What this Ruling means for Kenyans

This case is a major win for privacy and digital freedom in Kenya. It sends a strong message that government agencies cannot collect people’s data without clear legal authority and public involvement. It also sets a precedent that even technical information like IMEI numbers can qualify as personal data if it is connected to individuals.