The High Court of Kenya has ruled that telecom operators (telcos) must notify and obtain user consent before reclaiming phone numbers. This ruling responds to a lawsuit filed in 2024 that questioned the practice of telecom companies reclaiming phone numbers without authorization.
The High Court stated in a declaration on Thursday that registered mobile numbers serve as digital identifiers linked to personal data related to individuals' private matters. The court further emphasized that mobile numbers are considered protected personal data under Articles 31(c) and (d) of the Kenyan Constitution.
While the issue primarily focuses on the risks associated with SIM card reclamation, it has also raised concerns about the potential for sensitive data leaks and economic losses when this process is not properly managed.
The court's ruling mandates that prior to reallocating mobile numbers, telecom companies must notify and obtain consent from the original registered users.
In cases where registered users cannot be contacted through official publications, telecom companies may only reclaim these phone numbers after taking other necessary measures.
Once such numbers are reallocated to other users, the court requires telecom companies to implement technical security measures to prevent unauthorized exposure or transfer of personal data to new users or other parties.
In addition to the responsibilities of telecom companies during the SIM reclamation process, the court also directed the Office of the Attorney General to implement digital identity protection measures nationwide.
Users on the Kenyan social media platform X welcomed the ruling, noting that telecom companies like Safaricom have reallocated their phone numbers without authorization when users are not actively using them.
Additionally, some users mentioned receiving strange messages on newly purchased phone numbers, indicating vulnerabilities in the SIM reallocation process.
Litigation: The Truth of the Matter
Firstly, the lawsuit challenged the reclamation of phone numbers without prior notification to users. Secondly, it claimed that vulnerabilities in the reallocation process allowed individuals' digital identities to be transferred to other users, posing risks.
Specifically, the lawsuit highlighted that due to inactivity during incarceration, prisoners' phone numbers and information were transferred and leaked to others, resulting in their digital identities being acquired and becoming the property of third parties.
Among various requests, the lawsuit sought a ruling that a person's digital identity and phone number constitute part of their digital identity, akin to a national ID, passport, or driver's license.
Furthermore, the lawsuit requested the court to affirm that prisoners have the right to retain their digital identity and phone numbers during incarceration.
To prevent the deprivation of phone number protection rights during periods of inactivity/unuse, the lawsuit called for a ruling from the court.