ATIBA INSTITUTE V COMMUNICATIONS AUTHORITY OF KENYA-Legal

COURT; High Court Of  Kenya at Nairobi 

DATE OF JUDGEMENT; 18 JULY 2025

JUDGE; EC Mwita 

PARTIES ;

KATIBA INSTITUTE- PETITIONER

V

COMMUNICATIONS AUTHORITY OF KENYA – 1ST RESPONDENT

KENYA REVENUE AUTHORITY- 2ND RESPONDENT

ATTORNEY GENERAL- 3RD RESPONDENT

AND

DATA PRIVACY AND GOVERNANCE SOCIETY OF KENYA – INTERESTED PARTY

INTERNATIONAL COMMISSION OF JURISTS (KENYA)- INTERESTED PARTY

LAW SOCIETY OF KENYA- INTERESTED PARTY

THE CONSUMERS FEDERATION OF KENYA (THROUGH EPHRAIM KANAKE, STEPHEN MUTORO AND HENRY OCHIENG)-  INTERESTED PARTY

AND

IDEATE POLICY AFRICA LIMITED (ITPA)- AMICUS CURIAE

FACTS 

1. The 1st respondent, the Communications Authority of Kenya issued a public notice introducing new requirements effective January 1, 2025. The notice  implicated that all mobile operators as well as local assemblers, importers and wholesalers  to upload IMEI numbers of mobile devices to the 2nd respondent, Kenya Revenue Authority, portal to verify tax compliance. 
2. The notice also stated that mobile operators were to connect devices to their networks only after verifying compliance through a whitelist database provided the 2nd respondent. 
3. Following suit, the 2nd respondent issued its own public notice requiring all mobile device importers to declare IMEI numbers in import documents and for assemblers and manufacturers to register on its customs portal, submitting reports of all devices assembled for the local market. 
4. Passengers entering Kenya were required to declare their mobile devices, including the IMEI numbers of phones intended for use in Kenya.

   ISSUES

1. Whether IMEI numbers were personal data and thus subject to protection under article 31 of the Constitution on the right to privacy and that individuals disclose IMEI numbers after registering their phones violated their right to privacy. 
2. Whether alternative dispute resolution mechanisms could oust the jurisdiction of the High Court where there were claims of threats to violation of rights and fundamental freedoms. 

ARGUMENTS OF THE PARTIES 

PETIONER 

The petitioner took issue with the new requirement that individuals declare IMEI numbers of their mobile devices. According to the petitioner, IMEI numbers constitute personal data and when read in connection with certain data held by mobile service providers, IMEI numbers can easily identify a person’s sensitive personal information. therefore, one cannot buy a SIM- card from network providers in Kenya if the IMEI number is not registered The petitioner also took issue with the creation of a master database to give comprehensive access to personal IMEI numbers to government authorities because it threatens the right to privacy and is the first step towards possible mass surveillance. The petitioner also stated that if the government’s whitelist of IMEI numbers existed then they can access information directly without a warrant The petitioner stated that the  notices further violate article 31 in two ways, namely; lack of genuine consent and failure to conduct a data impact assessment. Relying on Section 31 of the Data Protection Act and Republic V Joe Mucheru, Cabinet Secretary Ministry of Information Communication and Technology & 2 others [2021] KEHC 122 (KLR)

The petitioner relying on the judgement in Seventh Day Adventist Church (East Africa) Limited v Minister for Education & 3 others [2017] KECA 751 (KLR) also highlighted that no Law in Kenya allows for the limitation of privacy rights by the respondents as per the notice. This is because the limitations as highlighted in Article 24 of the constitution do not suffice in this argument.

On the second Issue the petitioner argued that Alternative forms of dispute resolution in this case the Communications and Multimedia Appeals Tribunal, Commission on Administrative Justice and  the Office of the Data Protection Commissioner, could not ousts the High court because this matter determined human rights and freedoms. The petitioner relied on Nicholus v Attorney General & 7 others [2023] KESC 113 (KLR)

SUMMARY OF RESPONDENTS ARGUMENTS

The respondents argued that the notice does not limit the right to privcy because the IMEI numbers do not constitute personal data as defined under section 2 of the Data Protection Act. The respondents also upheld that the time the local assembler is uploading IMEI numbers to the data base, the mobile device has not been sold to anyone and therefore there is no personal information. This is similar to importers, retailers and wholesalers when uploading IMEI numbers. 

The respondents also maintained that because the notice does not violate the Data Protection Act and all the implications the petitioner seems to deduce are merely hypothetical then there was no need for a data impact assessment before being issued. On the above the respondents relied on Wanjiru Gikonyo & 2 others v National Assembly of Kenya & 4 others [2016] eKLR.

The respondents stated the notice was not an avenue of the infringements of human rights but an avenue to ensure tax compliance. They argued that the law provides a comprehensive framework for the protection of personal data during tax enforcement. The counsel relied on the Tax Procedure Act and the case of Samura Engineering Limited and 10 others v Kenya Revenue Authority [2012] eKLR 

Lastly, the 1st respondent submitted that the petition offends the doctrine of exhaustion because the issues raised can be determined through alternative forums; In this case,  Communications and Multimedia Appeals Tribunal, Commission on Administrative Justice and Office of the Data Protection Commissioner. The respondent heavily relied on Counsel relied on the decisions in Wafula v Safaricom Limited & 4 others [2025] KEHC 229 (KLR) and  Tv Africa- Kenya Holding Limited v Communications Authority of Kenya [2023] KEHC 26848 (KLR). 

JUDGEMENT 

This Court held  the view, that where the controversy is a debate on whether a right or freedom has been infringed or violated or whether the is contentious debate on the interpretation of the same, the matter can only be decided in court and not dismissed. This is also granted and supported under article 22 of the constitution of Kenya The Court also held that the idea of IMEI numbers being the digital fingerprint of mobile devices thus being linked to SIM card is a violation privacy rights in that the creation of such a whitelist even after the IMEI numbers have been registered. 

RATIO DECIDENDI 

Jurisdiction 

The Data Protection Act and Commission on Administrative Justice do indeed provide for alternative forms of dispute resolution and therefore, having power to grant remedy under  section 9(2) of the Fair Administrative Action Act . However, the idea for the existence of alternative forms was not the issue neither was the contention of article 159 of the Constitution of Kenya. Indeed, these offices have the mandate to determine disputes falling within their perspective institutions but they can only do so on matters that can adequately be determined by those bodies. Hence their remedies must be effective.  

Therefore,  this brought the question as to whether the doctrine of efficacious remedy in Alternative dispute resolution should suffice for this case. The Courts applied the determination in In Union of India v. T.R. Vermai, 1957 AIR 882, 1958 SCR 499 that stated established that an alternative remedy should be efficacious and effective. 

 This court held the view that the alternative remedy was insufficient as the matter dealt with the fundamental rights and freedoms under the Bill of Rights hence a major public interest concern. The constitution being the Apex cardinal for the Laws of Kenya provides that this court has a mandate to hear and determine matters of human rights where as any fundamental freedom or right has been violated infringed or is open to interpretation debates as per  article 165(3) (b). Conclusively , supportive evidence state that indeed the court had Jurisdiction because the alternative remedy did not prove to be efficacious. 

Violation of Right to Privacy 

The court held that indeed IMEI numbers do qualify as numbers under Section two of the Data Protection Act. Even though the IMEI data does not explicitly provide detailed information of personal quality, their linkage with the mobile user through the SIM card provides an avenue at which personal data can be extracted. Additionally, the notice implied that any person entering Kenya was required to fill in such information for the mobile phone they intended to use in Kenya. A transaction of such information also thus qualifies to some degree an extension of personal data. 

The court held that the IMEI numbers become personal data when one purchases a mobile device and activates it at which point it would often provide personal details such as name, email address, password or biometrics, should a person opt for face ID or finger print biometrics for unlocking the device therefore granting protection under Article 31. 

In order to determine whether this right is limiting, the court applied a two -step approach. First, if the limitation is justifiable and lastly if the limitation negated the core function of the right. The respondents failed to provide sufficient proof of a justifiable cause in order to fully exercise the limitation. Judge Mwita stated that “…above principles in the circumstances of this petition, the right to privacy being a fundamental right, if the respondents had their way and took control of IMEI numbers of mobile devices in the country, the State would most likely completely dominate the citizens and alter the relationship between citizens and the State so that no person can conduct routine activities through a mobile phone without the State knowing about his activities.” This in itself provides that the limitation was not justifiable and it would denote the core function original right as per the bill of rights. 

In conclusion, In as much as in the digital realm with various data protection guidelines  evolves, the core principles of Human rights and dignity are still upheld and to some extent the constitutional fundamental principles where Public interest and sovereignty of the people still override alternative administrative decision exists.