Court strikes down IMEI collection orders issued by CA, KRA

The High Court has quashed directives requiring all mobile phone users and importers to disclose their devices' IMEI numbers to the government. 

Justice Chacha Mwita held that the public notices issued by the Communications Authority of Kenya (CA) and the Kenya Revenue Authority (KRA) were not anchored in any law and were therefore unconstitutional.

Most notably, the court found the requirement to submit IMEI numbers to be in violation of Articles 24 and 31 of the constitution.

Article 24 permits the limitation of rights only through clearly defined laws that satisfy proportionality and necessity tests, while Article 31 enshrines the right to privacy, protecting individuals against unnecessary or unwarranted state intrusions.

The case centred on public notices published in October and November 2024.

The notices sought to enforce, from January 1, 2025, the compulsory registration and submission of IMEI numbers for all mobile devices in use in Kenya, including those imported by individuals.

The court found that the directives infringed on the right to privacy and enabled potential state surveillance. 

The case was brought by Katiba Institute.

The petitioners argued that an IMEI number uniquely identifies a phone and connects it to a particular user.

When linked to other data, authorities can track an individual’s movements within a very narrow radius.

Katiba Institute warned that this data could be misused by the state, opening the door to illegal surveillance and putting fundamental freedoms at risk.

Furthermore, the Institute strongly asserted that the CA and KRA acted outside their legislative mandate.

Under Article 94 of the constitution, only Parliament can enact laws limiting constitutional rights, and any delegated legislation must be scrutinised and approved by Parliament with ample public participation.

The notices, however, were neither tabled in Parliament nor subjected to any public consultation. 

Justice Mwita agreed with the Institute's argument that mandatory IMEI collection would facilitate unchecked state surveillance.

By creating a comprehensive master database of mobile devices tied to individuals, the state would have vastly expanded powers to track and monitor citizens’ movements and communications.

The court found that such potential for surveillance posed a grave threat to the rights and freedoms of all Kenyans.

Based on these grounds, Justice Mwita issued an order quashing the CA and KRA notices in their entirety.

He also prohibited the government and its agents from implementing or acting upon the notices or any measure requiring individuals to disclose their IMEI numbers as originally proposed.

This decision is a major win for privacy rights in Kenya and limits the government’s power to collect data without public approval or legal backing.

The High Court reaffirmed adherence to the constitution and the necessity of legislative oversight and due process in matters affecting the digital rights of Kenyan citizens.