That question is no longer hypothetical.  Today, many of us have received repeated alerts sent by unfamiliar vendors and service providers. They seem like spam messages hence why we quickly delete them from our phones but here is another reality: the phone number you have once belonged to someone else who freely subscribed to those vendors/service providers.

In Kenya today, a phone number is more than a contact, it is a digital identity. It underpins banking, M-Pesa, e-Citizen (government services), tax, land registration systems and even healthcare access. Every sign up and login access to these systems creates a permanent link between a person and their number, but that link can quietly be compromised.

When your SIM card remains inactive for a number of months, it is eventually reassigned by the mobile network operator you are on. The number moves on, but the data tied to it often does not. Alerts, records, verification codes and confirmations for various payments continue to flow, now reaching the new holder, who begins receiving fragments of transactions that are not theirs. This is not just an inconvenience; it is a structural risk.

The High Court confronted this reality in Erastus Ngura Odhiambo v State Law, where a Kenyan lost access to his number after it was reassigned, cutting him off from financial updates and communication, while his sensitive information continued to be sent elsewhere. The Court recognized a phone number as a protected digital identifier and exposed a deeper flaw, the reassignment/recycling of numbers operates without adequate consent, notice or technical safeguards to separate identity from data.

The High Court ordered reforms, requiring informed consent, proper notification, and technical protections to prevent data leakage failing which the practice itself would have to stop.

Systems continue to treat phone numbers as permanent identifiers, even as mobile network operators treat them as reusable resources. The result is a dangerous gap where identity lingers long after ownership has changed.

The real risk goes beyond stray messages. If a recycled number remains linked to banking or government platforms, verification codes may be sent to the wrong person, opening the door to serious data breaches with far reaching consequences.

The High Court’s decision is a welcome warning, a signal that the law is beginning to catch up with the realities of a phone-driven society. But it is not, on its own, a solution. Until systems are redesigned and identity is treated as something more than a reusable number, the risk of losing your personal data and receiving someone else’s personal data remains very real. Somewhere, even now, another message is being delivered to the wrong recipient, putting mobile network operators on the spot, a spot we are watching keenly following the High Court decision.

This publication is meant for general information only and does not constitute legal advice, nor does it create an advocate-client relationship between any reader and Mboya Wangong’u & Waiyaki Advocates. For particular expert advice on any matter dealt with above, please contact us on advocate@lexgroupafrica.com for tailored legal support.

Authored:

Mary Ndung’u and Serah Kamau

Linus

The post The Hidden Cost of a Recycled Phone Number: Reclaiming Digital Identity appeared first on Mboya Wangongu & Waiyaki.

The PBO Act, which came into force on 14^th May 2024 via Legal Notice No. 60 of 2024, revoked the previous NGO Coordination Act.  The PBO Act was designed to establish a transparent regulatory framework for organizations serving the public good. However, the petitioners argued that key provisions of the Act undermined the autonomy of Public Benefit Organizations (PBOs), entrenched state control, and suppressed civil society participation.

Among the contested provisions were requirements for mandatory re-registration, compulsory membership in a national federation, disclosure of personal data, and the structure of the PBO Authority and Disputes Tribunal. The petitioners contended that these provisions violated constitutional guarantees including the freedom of association, the right to privacy, the right to fair administrative action, and the right to a fair hearing. The key findings of the court were as follows:

     a. Mandatory Registration

Justice Mwamuye, presiding over the matter, found the requirement for fresh registration of NGOs as PBOs unreasonable and unjustified limitation on the freedom of association and administrative justice. The court held that the blanket re-registration requirement imposed unnecessary regulatory hurdles on already compliant entities, without demonstrating a pressing public need or exploring less restrictive alternatives.

     b. Disclosure of personal data

Section 32 of the Act, which required PBOs to disclose personal details of their governing members, was found to infringe the right to privacy under Article 31 of the Constitution. The provision lacked adequate safeguards for the protection of personal data and was overly broad in scope.

     c. Compulsory membership in a National Federation

Sections 21(1) and 21(9) of the Act, which mandated membership in the National Federation of PBOs, were struck down for unjustifiably limiting the freedom of association. The court emphasized that forced affiliation to a single umbrella body was neither necessary nor proportionate in a democratic society.

Similarly, Section 23(2), which restricted recognition of PBO forums to those representing a “significant number” of organizations as prescribed by the Cabinet Secretary, was found to be vague, exclusionary, and unconstitutional.

     d. Right to fair hearing

Sections 18(1)–(3) and 19(1)(b) of the Act, which empowered the PBO Authority to suspend or cancel registration based on subjective criteria, were declared unconstitutional for failing to guarantee fair hearing and administrative justice.

Implications

As a result of the Court’s decision, NGOs previously registered under the repealed NGO Coordination Act are not required to re-register as PBOs. The PBO Authority must automatically transition these organizations into the new framework. PBOs are no longer compelled to join the National Federation, nor are they required to disclose sensitive personal data without proper safeguards. Enforcement actions must now adhere to principles of fair hearing and due process.

Conclusion

This decision marks a significant victory for civil society in Kenya, reaffirming the constitutional protections that safeguard organizational autonomy, privacy, and procedural fairness. It sets a strong precedent for future regulatory reforms and underscores the judiciary’s role in upholding democratic values.

This publication is meant for general information only and does not constitute legal advice, nor does it create an advocate-client relationship between any reader and Mboya Wangong’u & Waiyaki Advocates. For particular expert advice on any matter dealt with above, please contact us on advocate@lexgroupafrica.com for tailored legal support.

Authored:

Fridah Gatwiri and Glory Kang’oria

admin

lexgroupafrica.com

The post High Court Declares Key Provisions of the Public Benefits Organizations Act Unconstitutional appeared first on Mboya Wangongu & Waiyaki.