Government surveillance ambitions have been dealt a decisive blow after the High Court dismantled a controversial plan that would have forced every mobile phone user in the country to register their device’s IMEI in a national database or face disconnection from cellular networks.
Justice Chacha Mwita delivered the ruling on Friday, declaring the government’s mobile IMEI registration directive unconstitutional and warning it could enable mass state surveillance without oversight.
The judgment effectively kills a scheme that privacy advocates described as building blocks for an Orwellian surveillance state. The now-defunct directive, announced through public notices in October and November of last year, would have fundamentally changed how Kenyans use their mobile phones.
Under the proposed system, everyone from device importers to ordinary travelers entering the country would have been required to declare the IMEI numbers of their mobile phones to authorities.
IMEI numbers serve as unique digital fingerprints for mobile devices. When combined with subscriber information, they can pinpoint a device’s location within 100 meters and link users to their entire communication history.
The government’s plan would have created a master database of these identifiers, with mobile service providers only allowed to connect devices that appeared on the official list.
Communications Authority of Kenya and Kenya Revenue Authority positioned the initiative as an anti-counterfeit and tax compliance measure.
However, critics quickly recognized its surveillance potential, expressing that such a database would give the state unprecedented power to track citizens’ movements and communications.
The Katiba Institute, supported by the Data Privacy and Governance Society of Kenya and the Law Society of Kenya, mounted a legal case that exposed fundamental flaws in the government’s claim.
Their petition revealed that the directive violated multiple constitutional protections and procedural requirements.
Justice Mwita found that the notices lacked any legal foundation, violating constitutional articles that guarantee privacy rights.
The court determined that the government had attempted to implement a far-reaching surveillance system through executive orders rather than proper legislation, usurping Parliament’s exclusive authority to make laws affecting fundamental rights.
Despite being framed as regulatory instruments, the notices were never presented to Parliament as required by the Statutory Instruments Act. This oversight stripped the directive of any legitimate legal authority and demonstrated what the court viewed as executive overreach.
READ: New Proposal to Give DCI KES 150M to Track Social Media Users
This ruling addressed modern concerns about digital privacy and data protection. The petitioners successfully argued that Kenyans would have faced a coercive choice between registering their devices or being excluded from mobile services.
This scenario violated data protection principles requiring freely given consent, as refusal would have resulted in disconnection from essential communication networks. The government’s failure to conduct a mandatory data protection impact assessment further undermined its position.
Such assessments are required under Kenyan law when personal data processing poses high risks to individual rights, yet neither the Communications Authority nor the Kenya Revenue Authority disclosed any evaluation of the scheme’s privacy implications.
Even the requirement for visitors to declare their devices at the border came under judicial scrutiny. The court found this obligation disproportionate and poorly designed, lacking the procedural safeguards necessary for such an intrusive measure.
Furthermore, the court’s judgment revealed that less invasive solutions already exist for combating counterfeit devices. International best practices rely on anonymized blacklists of stolen or non-compliant phones, which achieve anti-counterfeit goals without collecting personal data from law-abiding users.
READ: Counterfeit Goods Flood Kenyan Online Shops Like Jumia and Facebook
This proposed whitelist approach from the government would have inverted this model, requiring data collection from all legitimate users and tying network access to state-controlled databases.
The Kenya High Court’s decision establishes important precedents for digital-era governance in the country. By recognizing IMEI numbers as personal data capable of enabling mass surveillance, the ruling strengthens privacy protections in an increasingly connected world.
The ruling also reinforces Parliament’s role as the proper venue for debating and drafting laws that affect fundamental rights. Transparency, public consultation, and evidence-based assessments must accompany any government action involving personal data and civil liberties.
