Parliament and President William Ruto barely had a week to celebrate the new cybercrime law before it ran straight into a courtroom wall.
Today, Justice Lawrence Mugambi of the High Court in Nairobi suspended key sections of the Computer Misuse and Cybercrimes (Amendment) Act, 2025, just seven days after Ruto signed it into law on October 15.
The suspended provisions won’t be enforced until the court can properly examine whether they’re even constitutional. The legal challenge comes from gospel musician and activist Reuben Kigame, working alongside the Kenya Human Rights Commission.
They argue that the cybercrime law is fundamentally broken, both in what it says and how it got passed.
Sections Being Contested
The court specifically suspended Section 27, which deals with cyber harassment. This part of the law makes it a crime to send electronic communications that could detrimentally affect another person or contain content that’s indecent or grossly offensive.
Get convicted under this section, and you’re looking at up to KES 20 million in fines, ten years in prison, or both.
The petitioners say this language is so vague it’s dangerous. What exactly counts as communication that detrimentally affects someone? The law doesn’t say.
There’s also a clause about communication that causes someone to commit suicide, but again, no clear definition of what that means or how you’d prove causation.
According to Kigame and KHRC, this vagueness opens the door to arbitrary prosecutions where authorities can essentially decide on the fly what crosses the line.
A Messy Legislative Process
Beyond the content issues, the petitioners claim Parliament botched the entire process of passing this law. They argue the bill should have gone to the Senate because it affects devolved functions like information management and community policing, which fall under county government responsibilities.
According to Article 110 of the Constitution, bills concerning county governments need Senate approval. But the National Assembly apparently skipped that step entirely, making the whole thing procedurally defective from the start.
There’s also a complaint about the cybercrime law creating its own data collection and oversight system that sidesteps the Office of the Data Protection Commissioner.
The petitioners say this undermines existing data protection safeguards and weakens the independence of the official body that’s supposed to prevent personal data misuse.
What Will Happen Next?
Justice Mugambi has set a tight schedule. The parties have three days to serve documents, respondents get seven days to file their responses, and the petitioners can file a rejoinder within seven days after that. The case returns to court for directions on November 5.
The Media Council of Kenya, the Kenya Union of Journalists, and the Law Society of Kenya have all joined as interested parties, which gives you a sense of how big the stakes are for press freedom and digital rights in the country.
Kigame and KHRC want the entire amendment declared unconstitutional, null, and void, with a permanent order blocking the government from enforcing any of it.
For now, at least, those controversial sections are on ice while the court figures out whether they have any business existing in the first place.
