High Court Bars Telcos From Reassigning Mobile Numbers in Landmark Digital Identity Ruling

The High Court sitting at Milimani has delivered a significant ruling that reclassifies registered mobile telephone numbers as digital identifiers, placing them under the same constitutional protections as other sensitive personal data. Justice Lawrence Mugambi held that a mobile number is no longer merely a communication tool but a gateway to an individual’s private life, including banking, tax records, and family affairs.

This judicial intervention follows a petition by Erastus Ngura Odhiambo, who challenged the industry practice of reassigning mobile numbers after a period of inactivity. The court found that the automatic recycling of SIM cards by telecommunications firms without the verifiable consent of the original subscriber violates the right to privacy as guaranteed under Article 31 of the Constitution.

Justice Mugambi noted that when a mobile digital identity is lost through reallocation or recycling without interrogating the reasons behind long periods of non-use, it creates an avenue for unauthorized disclosure of delicate information. The ruling specifically highlighted the risks to third parties who may receive confidential messages, such as bank notifications or Kenya Revenue Authority alerts, intended for the previous owner of the number.

The judgment has particular weight for individuals who are unable to maintain active use of their lines due to circumstances beyond their control. The court observed that imprisonment should not translate to the extinction of a prisoner’s digital identity. In many cases, inmates have seen their numbers deactivated and reassigned while serving sentences, leaving them digitally erased and cut off from essential services upon their release.

To address these systemic gaps, the court has issued a mandatory directive to the Attorney General. Working in consultation with the Kenya Prisons Service, the Communication Authority of Kenya, and the Office of the Data Protection Commissioner, the government has six months to establish a robust regulatory framework. This framework must safeguard digital identities associated with registered numbers against arbitrary deactivation.

Telecommunication operators are now restricted from killing off SIM cards based solely on a 90-day inactivity rule. Under the new requirements, companies must establish the reasons for a subscriber's inactivity and obtain informed consent before any reassignment can occur. This shift moves the burden of proof to the service providers, who must ensure that the recycling of a number does not compromise the personal and financial security of the original holder.

The ruling comes as the sector moves toward greater data privacy, with major players already implementing measures such as masking phone numbers in mobile money transaction notifications. The High Court has set a deadline of September 19, 2026, for the government to have the new protective measures and legislative anchors fully operational.

For the construction and infrastructure sectors, where mobile-linked digital identities are increasingly used for site management, payroll, and government procurement portals, the ruling provides a new layer of security. It ensures that the digital footprint of professionals and contractors remains tied to their verified identity, preventing the accidental transfer of sensitive corporate access to unauthorized third parties through recycled SIM cards.