REPUBLIC OF KENYA
IN THE HIGH COURT OF KENYA AT NAIROBI
MILIMANI LAW COURTS
CONSTITUTIONAL AND HUMAN RIGHTS DIVISION
PETITION NO. E647 OF 2024
KATIBA INSTITUTE………………………………………………PETITIONER
VERSUS
COMMUNICATIONS AUTHORITY OF KENYA……………. 1 ST RESPONDENT
KENYA REVENUE AUTHORITY……………………………2 ND RESPONDENT
ATTORNEY GENERAL………………………………………3 RD RESPONDENT
AND
DATA PRIVACY AND GOVERNANCE SOCIETY OF KENYA………………………………………………….1 ST INTERESTED PARTY
INTERNATIONAL COMMISSION
OF JURISTS(KENYA)…………………………………2 ND INTERESTED PARTY
LAW SOCIETY OF KENYA…………………………..3 RD INTERESTED PARTY
THE CONSUMERS FEDERATION OF KENYA (through Ephraim Kanake, Stephen Mutoro and Henry Ochieng) …………….4 TH INTERESTED PARTY
AND
IDEATE POLICY AFRICA LIMITED (ITPA)…………………AMICUS CURIAE
JUDGMENT
Background
On 24 th October 2024, the 1 st respondent issued a public notice through its official X account and website titled “Public Notice on Enhancing the Integrity and Tax Compliance of the Mobile Devices in Kenya.” The notice was to notify all stakeholders, including mobile network operators involved in local assembly, importation, distribution and connection of mobile devices to the local networks, of new requirements that were to take effect on 1 st January 2025.
The notice required all local device assemblers to upload International Mobile Equipment Identity (IMEI) Numbers of each assembled device to the Kenya Revenue Authority(KRA) Portal; all mobile phone importers to disclose IMEI Numbers in their respective import documents submitted to the KRA; all retailers and wholesalers of mobile devices ensure that they only retail or distribute mobile devices that are tax compliant and mobile network operators to only connect devices to their networks after verifying the tax compliance status through a whitelist database of compliant devices, provided by KRA. Operators were also required to provide for grey-listing non-compliant devices.
Following the above, on 5 th November 2024, the 2 nd respondent posted a public notice on its X account and website requiring all importers to submit detailed import entries that include accurate quantities, comprehensive model descriptions, and the respective IMEI numbers for each mobile device. Device assemblers and manufacturers to register on the KRA Customs Portal and submit a report of all devices assembled for the local market along with their respective IMEI numbers. Passengers entering Kenya were to declare their mobile devices on the F88 passenger declaration from, providing necessary details and IMEI numbers of the devices intended for use during their stay in the country.
Petitioner
The petitioner, a public interest litigant, filed this petition to challenge the notices as violative of the right to privacy, a fundamental freedom guaranteed in the Bill of Rights. The petition is supported by affidavits of Nora Mbagathi and Anand Venkatanarayanan.
The petition was brought against the Communications Authority of Kenya, KRA and The Attorney General as the 1 st , 2 nd and 3 rd respondents respectively. Data Privacy and Governance Society Kenya; International Commission of Jurists (Kenya); Law Society of Kenya and The Consumers Federation of Kenya were joined as the 1 st to 4 th interested parties while Ideate Tech Policy Africa Limited was joined as amicus curiae.
The petitioner took issue with the new requirement that individuals declare IMEI numbers of their mobile devices. According to the petitioner, upon registration of mobile phones IMEI numbers constitute personal data and when read in connection with certain data held by mobile service providers, IMEI numbers can easily identify a person’s sensitive personal information.
The petitioner asserted that the new practice of whitelisting devices means that only a device whose IMEI is registered on the CAK and KRA databases can connect to mobile networks thus, anyone who does not register IMEI number cannot buy a SIM-card from mobile network providers in Kenya. The petitioner again asserted that creation of a master database to give comprehensive access to personal IMEI numbers to government authorities threatens the right to privacy and is the first step towards possible mass surveillance.
The petitioner took the view, that whitelisting is unnecessary because there exists blacklist where information on stolen phones is shared and intended to achieve the same goal of ensuring that phones improperly in circulation can be identified. The petitioner averred that the notices have further ramifications on the realisation of the entire constitutional framework. When individuals know that they may be monitored, they may become more cautious about what they say, write or do which may lead to self-censorship, especially on political, religious or controversial topics.
The petitioner stated that the impugned notices violate the principle of separation of powers and usurp the mandate of Parliament in article 94 of the Constitution since the notices were not tabled in Parliament for scrutiny as required by the Statutory Instruments Act.
According to the petitioner, to the extent that the impugned notices require mandatory disclosure of IMEI numbers by individuals and importers, the right to privacy guaranteed under article 31 of the Constitution is threatened. The notices further violate the Data Protection Act on the premise that there is lack a genuine consent as required by regulation 4(3) and 4(4) of the Data Protection (General) Regulations, 2021 and failure to conduct a Data Impact Assessment as required by section 31 of the Data Protection Act and regulation 49 of the Regulations.
The petitioner asserts that the respondents’ actions further violate articles 10, 24, 27, 28, 35(3) and 47 of the Constitution and that in coming up with the notice, CAK acted ultra vires its mandate. According to the petitioner, IMEI numbers are unique and are tied to a mobile device irrespective of whether they are classified as smart phones or not. IMEI number provides information about the phone, such as the brand, the year of production and some other technical specifications. IMEI numbers of devices owned by individuals fit the definition of personally identifiable information when combined with other information such as the person’s name, SIM Card information, or phone number, hence the need for protection.
The petitioner stated regarding fraud and cybercrime, that a commonly shared IMEI blacklist is sufficient and there exist systems to identify and prevent circulation of stolen or improper phones on the Kenyan and international markets. A whitelist containing all IMEI numbers tied to individual’s resident is excessive, unnecessary and a building block of a surveillance state.
It was asserted that mobile phone operators have information on which SIM card is tied to which IMEI. When the phone rings to the closest cell phone tower, the mobile company can locate the phone within a 100m radius depending on the tower density and technology used. If the government’s whitelist IMEI database is linked to mobile phone operators they can access information directly without a warrant, by running simple queries.
It is the petitioner’s view, that collection of IMEI information required by the impugned notices is excessive and the risks associated with collection; processing and storage of IMEI numbers override the legitimate aims of reducing revenue loss and combating fraud and cybercrime.
The petitioner sought the following relief:
A declaration that the Impugned notices are unconstitutional, null and void for failure to comply with Articles 94 and 95 of the Constitution and Statutory Instruments Act Cap. 2A.
An order of certiorari quashing the respondents’ notices to collect, process and store IMEI Numbers in Kenya without undertaking and proactively publishing a Data Protection Impact Assessment contrary to Section 31 of the Data Protection Act, 2019 Cap. 411C and Access to Information Act CAP 7M.
An order of mandamus compelling the respondents to conduct and/or make public a compliant Data Protection Impact Assessment.
A declaration that the establishment of a whitelist register is discriminatory and contrary to Article 27 of the Constitution.
A declaration that the regulation requiring individuals to disclose the IMEI numbers after registering their phones violates their right to privacy and is contrary to article 31 of the Constitution.
A declaration that the respondents’ actions violate Articles 10, 19, 20, 21, 27, 28, 31 47, 94 and 95 of the Constitution of Kenya.
An order of prohibition prohibiting the respondents and any other state agency from implementing or acting upon the impugned notices.
Any other prayers this Court deems fit.
1 st respondent’s response
The 1 st respondent opposed the petition through a preliminary objection; grounds of opposition and a replying affidavit sworn by Liston Cheruiyot Kirui.
Preliminary objection
In the preliminary objection, the 1 st respondent contended that the jurisdiction of this court has been invoked wrongly and prematurely because the issues raised in the petition fall within the mandate of the Communications and Multimedia Appeals Tribunal established under the Kenya Information and Communications Act (Cap 411A). Other issues fall within the mandate of the Commission on Administrative Justice (CAJ). Additionally, the petition offends the provisions of section 9(4) of the Fair Administrative Action Act, 2015.
Grounds of opposition
The 1 st respondent contended through the grounds of opposition that granting the relief sought would contravene the provisions of article 34 of the Constitution on its mandate; that the petition violates the doctrine of issue estoppel because the Court of Appeal in Communications Authority of Kenya v Okiya Omtatah Okoiti & Others [2020] KECA 754 (KLR) already determined the issues raised.
It is the 1 st respondent’s position that the petitioner has misunderstood the IMEI system. The IMEI number is a technical identifier for the device itself and does not disclose or track the personal identity of the user. Ownership changes of a mobile device do not affect the IMEI number hence it does not infringe on the right to privacy.
The 1 st respondent stated that under Kenya Information and Communications (Registration of SIM cards) Regulations, 2015, Mobile Network Operators are required to maintain a database containing detailed personal information of all registered SIM card users. This information directly ties the SIM card to the individual, ensuring a verifiable connection between the users and their communications. In contrast, IMEI numbers are device specific technical identifiers that distinguish one mobile device from another. They are further used for managing network access, preventing theft and identifying and distinguishing devices but do not store or reveal information about the user thus, cannot be used for any form of surveillance.
The 1 st respondent maintained that the alleged violations in relation to privacy fall within the jurisdiction of the Office of the Data Protection Commissioner.
Replying affidavit
In the replying affidavit, it was stated that the notice is collaborative in nature and is meant to compensate for lack of the 1 st respondent’s physical presence at the ports of entry. It therefore establishes a framework whereby the 2 nd respondent’s officials coordinate closely with their counterparts at the 1 st respondent to facilitate thorough verification and physical processes of imported electronic devices.
The 1 st respondent asserted that the notice requires importers to upload IMEI numbers of all devices to the 2 nd respondent’s approved portal. The 2 nd respondent will then verify that the imported devices match those declared by the importer, thereby preventing tax evasion. At the same time, the 1 st respondent will ensure that only devices conforming to a type-approved model are permitted, by checking and confirming that each device has a valid IMEI in accordance with the type approved model.
The 1 st respondent contended that IMEI number is a globally standardized, 15-digit identifier assigned to mobile communication devices such as phones, tablets and data cards. Only devices that connect to GSM network possess an IMEI which identifies the mobile device by conveying details such as its identity, model, manufacturer, and a unique serial number assigned by the manufacturer. Consequently, every imported or locally manufactured mobile device comes with IMEI number.
The 1 st respondent maintained that issuance and management of IMEI numbers is governed by the Global System for Mobile Communications Association and IMEI number uniquely identifies mobile devices and enables regulators, manufacturers, and service providers to address issues such as theft, counterfeiting and unauthorized network access.
The 1 st respondent asserted that when a mobile device is switched on, it transmits its IMEI to the network even in the absence of a sim card. Without a sim card, IMEI number alone cannot be linked to personal information. Only mobile network operators can associate a sim card with a device’s IMEI number
The 1 st respondent maintained that IMEI is a technical identifier confined to the device itself. It is not linked to user behaviour or activities nor does it contain or collect personal data. Its role is to verify the authenticity or hardware and ensure that devices comply with established standards without enabling surveillance or user monitoring.
The 1 st respondent asserted that the impugned notice requires that IMEI number be uploaded into a database at specific stages during local assembly, importation, or prior to sale by retailers or wholesalers-before they are sold to end users. At these stages, the IMEI can only be used to verify compliance with type approval standards, confirms that devices are neither counterfeit nor stolen, and ensure that customs duties have been collected. In this context, it does not pose any risk of violating privacy or enabling surveillance.
The 1 st respondent stated that under the Kenya Information and Communications (Importation, Type Approval and Distribution of Communications Equipment) Regulations, any device used to connect to public networks must be type-approved by the authority. At points of entry, importers are required to provide evidence that the devices being imported had been type-approved by attaching a type-approval certificate to the import declaration form. In order to ensure that the devices being imported conform to the declaration, such importers are now required by the impugned notice to key in the IMEI numbers of all mobile devices in that consignment.
The 1 st respondent refuted the claim that the notice is a statutory Instrument so as to require compliance with the Statutory Instruments Act. The 1 st respondent denied the petitioner’s assertion that blacklists for stolen phones are sufficient. That argument disregards the GSM standard’s deliberate three-tiered design which serves distinct and complementary regulatory purposes. The whitelist, grey list and blacklist all serve distinct roles to ensure that the integrity in the communication sector is maintained.
The 1 st respondent contended that IMEI numbers do not constitute personal data as defined under section 2 of the Data Protection Act. The purpose, scope and context of collecting IMEI numbers do not pose any risks to the rights and freedoms of data subjects as the data remains anonymized and unrelated to personal information. The 1 st respondent is therefore under no obligation to conduct a data protection impact assessment. The 1 st respondent maintained that the petitioner’s allegations on violation of article 35 of the Constitution is premature and there is also no basis for the argument regarding mass surveillance.
2 nd respondent’s response
The 2 nd respondent opposed the petition through a replying affidavit (sworn by Peter Olali.) The 2 nd respondent stated that it has authority under articles 209 and 210 of the Constitution to ensure it effectively assesses, collects and accounts for all tax revenues due under various tax laws. In order ensure that everybody pays their fair share of taxes and within reasonable recovery measures, the Constitution, the Excise Duty Act (Cap 472), the Value Added Tax Act (Cap 476), the Miscellaneous Fees and Levies Act (Cap 469C), the East African Community Customs Management Act (2004) and other relevant laws have provisions that enable it to demand tax, investigate tax evasions and ensure that tax due is paid by parties responsible.
The 2 nd respondent asserted that it is dedicated to fostering tax compliance and enhancing revenue collection as part of its commitment to national development and in collaboration with the 1 st respondent in regulating importation of mobile devices. The impugned notice is an initiative to ensures proper tax declaration, payment and verification of mobile devices imported into or assembled within Kenya.
The 2 nd respondent contended that the impugned notice is aimed at enhancing revenue collection, promote fair tax practices, support national development, enhance transparency and reduce tax evasion. The 2 nd respondent asserted that it has no powers or mechanisms to monitor or engage in any form of surveillance. The IMEI is a phone identifier and has nothing to do with tracking and surveillance. Its goal is to ensure that all mobile devices in use are legitimate and meet the necessary tax obligations and regulatory requirements.
Regarding violation of privacy, the 2 nd respondent stated that all information and data received is for tax purposes and is solely handled in line with the provisions of the Constitution, the Excise Duty Act, the Value Added Tax, the East African Community Customs Management Act and the Miscellaneous Fees and Levies Act, among other relevant tax laws.
According to the 2 nd respondent, the information sought regarding registration of IMEI does not violate the Data Protection Act. It is done at the point of importation by importers and assemblers and the details of the end user are not captured anywhere. In any event, the 2 nd respondent asserts, it is compliant with the requirements of the Data Protection Act and the General Data Protection Regulations.
The 2 nd respondent maintained that data collected is limited to what is required to ensure compliance with applicable tax laws as and system access to data is role-based. Its data accountability framework holds staff accountable for proper data use. The 2 nd respondent urged that the right to privacy under article 31 of the Constitution is not absolute. Further, provision of IMEI numbers meets the constitutional and statutory threshold. According to the 2 nd respondent, sections 5(4), 9(2) and 191 of the East African Community Customs Management Act and section 6(1) of the Tax Procedures Act ensure protection of the citizen’s personal information from disclosure.
The 2 nd respondent denied the claim of discrimination against any citizen or violation of the right to dignity. The 2 nd respondent asserted that information registered in its Customs Declaration System is general in nature and does not capture personal information. It has a duty under section 18(2) of the East African Community Customs Management Act, 2004 to ensure that all goods importation of which is for the time being regulated by the Act or by any written law and the conditions or guidelines for their importation are complied with.
3 rd respondent’s response
The 3 rd respondent opposed the petition through grounds of opposition. The 3 rd respondent asserted that IMEI registration framework is grounded on the statutory and constitutional mandate of the 1 st and 2 nd respondents as stipulated in the Kenya Information and Communications Act and Kenya Revenue Authority Act.
According to the 3 rd respondent, IMEI registration framework resonates with the provisions of articles 201 and 209 of the Constitution. Collection of IMEI numbers is limited to a legitimate regulatory purpose and does not constitute arbitrary or unlawful interference with privacy; the right to privacy is not absolute and can be limited within the dictates of article 24. The framework aligns with the objectives of article 35 of the Constitution and the respondents issued public notices on the IMEI framework, ensuring stakeholder awareness and participation.
It was the 3 rd respondent’s position that articles 94 and 95 of the Constitution are wrongly invoked because the impugned notices are not legislative acts but administrative actions issued under the statutory mandate of the respondents. They did not require parliamentary approval under the Statutory Instruments Act.
The 3 rd respondent asserted that the whitelisting mechanism is proportionate and non-discriminatory and that the dignity of individuals is not violated by registration of IMEI numbers. The 3 rd respondent maintained that the relief to prohibit implementation of the notices is unwarranted as the measures being taken are integral to fulfilling Kenya’s obligation under both domestic laws and international commitments to combat tax evasion, counterfeit goods and illicit trade.
The 3 rd respondent stated that the Data Protection Act permits data processing where it is necessary and authorized for compliance with legal obligations or in the public interest under section 25(b). The 3 rd respondent maintained that the framework adheres to the Constitution and statutory laws, striking a balance between individual rights and public interest.
The 3 rd respondent took the view, that the existing blacklist system does not sufficiently address the challenges of counterfeit devices and tax evasion, and the whitelist system provides a more robust solution by proactively ensuring compliance before devices are connected to mobile networks. IMEI registration framework contributes to consumer protection in line with article 46 of the Constitution.
1 st interested party’s response
The 1 st interested party supported the petition through a replying affidavit sworn by Mugambi Laibuta (Mr. Laibuta). It was stated an IMEI number is a unique identifier assigned to every mobile device with cellular capabilities; it creates the connection between a mobile phone device and a cell phone tower allowing mobile providers to pinpoint a phone’s location within a defined radius; allows cellular networks to identify the device being used on their network, ensuring that each device is distinguishable; it can be used to locate a lost or stolen phone, or mobile phone device that has been used to commit a crime; it can be used to identify and prevent the sale or use of counterfeit devices and may be used verify mobile device ownership.
According to the 1 st interested party, due to the uniqueness and use, an IMEI number raises privacy concerns, namely; it can be used for tracking a device’s location through cellular networks which in effect could infringe on a user’s right to privacy under article 31 of the Constitution and the Data Protection Act if conducted without consent or legal authorization. Mobile applications and third-party services can access it using them for analysis, targeted advertising or creating user profiles across devices.
The 1 st interested party stated that when combined with other data points such as location, mobile application usage, phone number, flight and customer information, name, age, sex and other identifiable personal information, an IMEI number can contribute to user profiling, behavioural tracking and surveillance by state agents.
In the view of the 1 st interested party, since an IMEI number can easily identify an individual, it is personal data within the definition in section 2 of the Data Protection Act. If databases containing IMEI numbers are compromised, they could be linked with personal data, leading to potential misuse.
The 1 st interested party asserted that pursuant to section 25 of the Data Protection Act, the respondents ought to have valid legal basis for requiring disclosure and collection of IMEI numbers but have not shown the inefficiency of other methods of enforcing tax compliance. Using IMEI numbers to secure tax compliance is unjustified and leads to potential violation of fundamental rights and freedoms.
The 1 st interested party maintained that submitting a buyer of a mobile device to surveillance for purposes of tax compliance amounts to shifting the burden of compliance to a purchaser who is not the taxpayer for purposes of tax compliance. The public was not also involved before the impugned notices were issued. According to the 1 st interested party, the respondents are obligated to inform mobile phone device users on how their IMEI numbers will be used, stored and shared. The respondents further have not met their disclosure requirements under section 29 of the Data Protection Act.
The 1 st interested party asserted that IMEI numbers should only be collected and used for specific, explicit and legitimate purposes which the respondents have not demonstrated. Being personal data, it should only be retained as long as necessary for the intended purpose, which period has not been indicated contrary to section 25 of the Data Protection Act. The respondents had also not provided proof of security of the IMEI data that they want disclosed; disclose all third parties that will have access to the IMEI data and how they will use the data and the safeguards they have put in place for processing or publishing a Data Protection Impact Assessment as required under section 31 of the Data Protection Act.
The 1 st interested party maintained that handling of IMEI numbers could lead to a violation of the right to freedom of expression, movement and freedom from discrimination. Operational costs will be unbearable for small scale business owners and local assemblers as a result of an added administrative layer due to tax compliance and registration of IMEI numbers at the port of entry. The investment in compliance systems by small-scale players and local assemblers would push them out of the market space and allow larger and more aggressive players to dominate the industry.
The 1 st interested party asserted that the threat of blacklisting IMEI numbers or blocking non-registered devices may prevent users from accessing essential services, such as mobile banking, affecting the marginalized groups. It could also lead to undermining the progress of the country in areas such as digital inclusion, online education, access to internet powered phones and technological growth and advancements.
The 1 st interested party posited that in the absence of a cogent legislative support under which the respondents anchored the impugned notices, there is likely to be a hurdle in implementation of the directive, which will have far reaching consequences to businesses and consumers.
4 th interested party’s case
The 4 th interested party supported the petition through an affidavit sworn by Stephen Mutoro. The 1 st interested party stated that disclosure and registration of mobile device IMEI numbers is an affront on the right to privacy and data protection; exposes individuals to the risk of unjustifiable access to their personal data and communication.
According to the 4 th interested party, the disclosure requirements imposed do not meet the limitation test under article 24 of the Constitution. Through the imposed measures (notices) the respondents do not demonstrate elaborate mechanisms for oversight and monitoring to ensure that handling of personal data by KRA and mobile network operators is done in an accountable manner and safeguarded from exploitative use for other purposes other than the tax purpose.
The 4 th interested party was of the view, that in seeking to adopt measures that might expose individual’s data and communications to exploitative use, the respondents have not demonstrated adequate measures to safeguard against surveillance and unauthorized interceptions.
Amicus Brief
The amicus cited an article ‘ Analysing of Security Risks Associated with IMEIs and Unwiped Data of Disposed Mobile Handsets, Vol.3, Issue 11, International Research Journal of Modernization in Engineering Technology and Science’, Raja Sharma and Krishan Kumar and Prabhpreet Kaur, ‘ Vulnerability Detection of International Mobile Equipment Identity Number of Smartphone and Automated Reporting of Changed IMEI Number’ on the meaning of an IMEI number.
The amicus submitted that IMEI number constitutes personal data as it is obtained and linked to an individual immediately an individual purchase a mobile device. The Amicus relied on comparative analysis considered from, Paragraph 1.3 (xix) of the Nigerian Data Protection Regulations, 2019 and Paragraphs 171 and 172 of the European Data Protection Board (EDPB) Guidelines on processing personal data in the context of connected vehicles and mobility related applications.
The amicus again relied on article 5(3) of the European Union Data Protection Directive, The Privacy Directive (2002/58/EC, as Revised by 2009/136/EC), Section 2 of the Data Protection Act and a Report prepared by European Union Directorate General Justice Department Working Party; article 29 Data Protection Working Party Opinion02/2013 on Apps on Smart Devices, 00461/13/EN-WP 202 on the guiding principles for storage, processing and access to personal data.
The amicus submitted that based on the foregoing characterization of IMEI, it follows that it ought to be processed in line with the provisions of articles 31 of the Constitution and sections 25, 26, 30 and 31 of the Data Protection Act. The requirement to disclose IMEI numbers poses a threat to violation of the right to privacy guaranteed under article 3
[...truncated]
IN THE HIGH COURT OF KENYA AT NAIROBI
MILIMANI LAW COURTS
CONSTITUTIONAL AND HUMAN RIGHTS DIVISION
PETITION NO. E647 OF 2024
KATIBA INSTITUTE………………………………………………PETITIONER
VERSUS
COMMUNICATIONS AUTHORITY OF KENYA……………. 1 ST RESPONDENT
KENYA REVENUE AUTHORITY……………………………2 ND RESPONDENT
ATTORNEY GENERAL………………………………………3 RD RESPONDENT
AND
DATA PRIVACY AND GOVERNANCE SOCIETY OF KENYA………………………………………………….1 ST INTERESTED PARTY
INTERNATIONAL COMMISSION
OF JURISTS(KENYA)…………………………………2 ND INTERESTED PARTY
LAW SOCIETY OF KENYA…………………………..3 RD INTERESTED PARTY
THE CONSUMERS FEDERATION OF KENYA (through Ephraim Kanake, Stephen Mutoro and Henry Ochieng) …………….4 TH INTERESTED PARTY
AND
IDEATE POLICY AFRICA LIMITED (ITPA)…………………AMICUS CURIAE
JUDGMENT
Background
On 24 th October 2024, the 1 st respondent issued a public notice through its official X account and website titled “Public Notice on Enhancing the Integrity and Tax Compliance of the Mobile Devices in Kenya.” The notice was to notify all stakeholders, including mobile network operators involved in local assembly, importation, distribution and connection of mobile devices to the local networks, of new requirements that were to take effect on 1 st January 2025.
The notice required all local device assemblers to upload International Mobile Equipment Identity (IMEI) Numbers of each assembled device to the Kenya Revenue Authority(KRA) Portal; all mobile phone importers to disclose IMEI Numbers in their respective import documents submitted to the KRA; all retailers and wholesalers of mobile devices ensure that they only retail or distribute mobile devices that are tax compliant and mobile network operators to only connect devices to their networks after verifying the tax compliance status through a whitelist database of compliant devices, provided by KRA. Operators were also required to provide for grey-listing non-compliant devices.
Following the above, on 5 th November 2024, the 2 nd respondent posted a public notice on its X account and website requiring all importers to submit detailed import entries that include accurate quantities, comprehensive model descriptions, and the respective IMEI numbers for each mobile device. Device assemblers and manufacturers to register on the KRA Customs Portal and submit a report of all devices assembled for the local market along with their respective IMEI numbers. Passengers entering Kenya were to declare their mobile devices on the F88 passenger declaration from, providing necessary details and IMEI numbers of the devices intended for use during their stay in the country.
Petitioner
The petitioner, a public interest litigant, filed this petition to challenge the notices as violative of the right to privacy, a fundamental freedom guaranteed in the Bill of Rights. The petition is supported by affidavits of Nora Mbagathi and Anand Venkatanarayanan.
The petition was brought against the Communications Authority of Kenya, KRA and The Attorney General as the 1 st , 2 nd and 3 rd respondents respectively. Data Privacy and Governance Society Kenya; International Commission of Jurists (Kenya); Law Society of Kenya and The Consumers Federation of Kenya were joined as the 1 st to 4 th interested parties while Ideate Tech Policy Africa Limited was joined as amicus curiae.
The petitioner took issue with the new requirement that individuals declare IMEI numbers of their mobile devices. According to the petitioner, upon registration of mobile phones IMEI numbers constitute personal data and when read in connection with certain data held by mobile service providers, IMEI numbers can easily identify a person’s sensitive personal information.
The petitioner asserted that the new practice of whitelisting devices means that only a device whose IMEI is registered on the CAK and KRA databases can connect to mobile networks thus, anyone who does not register IMEI number cannot buy a SIM-card from mobile network providers in Kenya. The petitioner again asserted that creation of a master database to give comprehensive access to personal IMEI numbers to government authorities threatens the right to privacy and is the first step towards possible mass surveillance.
The petitioner took the view, that whitelisting is unnecessary because there exists blacklist where information on stolen phones is shared and intended to achieve the same goal of ensuring that phones improperly in circulation can be identified. The petitioner averred that the notices have further ramifications on the realisation of the entire constitutional framework. When individuals know that they may be monitored, they may become more cautious about what they say, write or do which may lead to self-censorship, especially on political, religious or controversial topics.
The petitioner stated that the impugned notices violate the principle of separation of powers and usurp the mandate of Parliament in article 94 of the Constitution since the notices were not tabled in Parliament for scrutiny as required by the Statutory Instruments Act.
According to the petitioner, to the extent that the impugned notices require mandatory disclosure of IMEI numbers by individuals and importers, the right to privacy guaranteed under article 31 of the Constitution is threatened. The notices further violate the Data Protection Act on the premise that there is lack a genuine consent as required by regulation 4(3) and 4(4) of the Data Protection (General) Regulations, 2021 and failure to conduct a Data Impact Assessment as required by section 31 of the Data Protection Act and regulation 49 of the Regulations.
The petitioner asserts that the respondents’ actions further violate articles 10, 24, 27, 28, 35(3) and 47 of the Constitution and that in coming up with the notice, CAK acted ultra vires its mandate. According to the petitioner, IMEI numbers are unique and are tied to a mobile device irrespective of whether they are classified as smart phones or not. IMEI number provides information about the phone, such as the brand, the year of production and some other technical specifications. IMEI numbers of devices owned by individuals fit the definition of personally identifiable information when combined with other information such as the person’s name, SIM Card information, or phone number, hence the need for protection.
The petitioner stated regarding fraud and cybercrime, that a commonly shared IMEI blacklist is sufficient and there exist systems to identify and prevent circulation of stolen or improper phones on the Kenyan and international markets. A whitelist containing all IMEI numbers tied to individual’s resident is excessive, unnecessary and a building block of a surveillance state.
It was asserted that mobile phone operators have information on which SIM card is tied to which IMEI. When the phone rings to the closest cell phone tower, the mobile company can locate the phone within a 100m radius depending on the tower density and technology used. If the government’s whitelist IMEI database is linked to mobile phone operators they can access information directly without a warrant, by running simple queries.
It is the petitioner’s view, that collection of IMEI information required by the impugned notices is excessive and the risks associated with collection; processing and storage of IMEI numbers override the legitimate aims of reducing revenue loss and combating fraud and cybercrime.
The petitioner sought the following relief:
A declaration that the Impugned notices are unconstitutional, null and void for failure to comply with Articles 94 and 95 of the Constitution and Statutory Instruments Act Cap. 2A.
An order of certiorari quashing the respondents’ notices to collect, process and store IMEI Numbers in Kenya without undertaking and proactively publishing a Data Protection Impact Assessment contrary to Section 31 of the Data Protection Act, 2019 Cap. 411C and Access to Information Act CAP 7M.
An order of mandamus compelling the respondents to conduct and/or make public a compliant Data Protection Impact Assessment.
A declaration that the establishment of a whitelist register is discriminatory and contrary to Article 27 of the Constitution.
A declaration that the regulation requiring individuals to disclose the IMEI numbers after registering their phones violates their right to privacy and is contrary to article 31 of the Constitution.
A declaration that the respondents’ actions violate Articles 10, 19, 20, 21, 27, 28, 31 47, 94 and 95 of the Constitution of Kenya.
An order of prohibition prohibiting the respondents and any other state agency from implementing or acting upon the impugned notices.
Any other prayers this Court deems fit.
1 st respondent’s response
The 1 st respondent opposed the petition through a preliminary objection; grounds of opposition and a replying affidavit sworn by Liston Cheruiyot Kirui.
Preliminary objection
In the preliminary objection, the 1 st respondent contended that the jurisdiction of this court has been invoked wrongly and prematurely because the issues raised in the petition fall within the mandate of the Communications and Multimedia Appeals Tribunal established under the Kenya Information and Communications Act (Cap 411A). Other issues fall within the mandate of the Commission on Administrative Justice (CAJ). Additionally, the petition offends the provisions of section 9(4) of the Fair Administrative Action Act, 2015.
Grounds of opposition
The 1 st respondent contended through the grounds of opposition that granting the relief sought would contravene the provisions of article 34 of the Constitution on its mandate; that the petition violates the doctrine of issue estoppel because the Court of Appeal in Communications Authority of Kenya v Okiya Omtatah Okoiti & Others [2020] KECA 754 (KLR) already determined the issues raised.
It is the 1 st respondent’s position that the petitioner has misunderstood the IMEI system. The IMEI number is a technical identifier for the device itself and does not disclose or track the personal identity of the user. Ownership changes of a mobile device do not affect the IMEI number hence it does not infringe on the right to privacy.
The 1 st respondent stated that under Kenya Information and Communications (Registration of SIM cards) Regulations, 2015, Mobile Network Operators are required to maintain a database containing detailed personal information of all registered SIM card users. This information directly ties the SIM card to the individual, ensuring a verifiable connection between the users and their communications. In contrast, IMEI numbers are device specific technical identifiers that distinguish one mobile device from another. They are further used for managing network access, preventing theft and identifying and distinguishing devices but do not store or reveal information about the user thus, cannot be used for any form of surveillance.
The 1 st respondent maintained that the alleged violations in relation to privacy fall within the jurisdiction of the Office of the Data Protection Commissioner.
Replying affidavit
In the replying affidavit, it was stated that the notice is collaborative in nature and is meant to compensate for lack of the 1 st respondent’s physical presence at the ports of entry. It therefore establishes a framework whereby the 2 nd respondent’s officials coordinate closely with their counterparts at the 1 st respondent to facilitate thorough verification and physical processes of imported electronic devices.
The 1 st respondent asserted that the notice requires importers to upload IMEI numbers of all devices to the 2 nd respondent’s approved portal. The 2 nd respondent will then verify that the imported devices match those declared by the importer, thereby preventing tax evasion. At the same time, the 1 st respondent will ensure that only devices conforming to a type-approved model are permitted, by checking and confirming that each device has a valid IMEI in accordance with the type approved model.
The 1 st respondent contended that IMEI number is a globally standardized, 15-digit identifier assigned to mobile communication devices such as phones, tablets and data cards. Only devices that connect to GSM network possess an IMEI which identifies the mobile device by conveying details such as its identity, model, manufacturer, and a unique serial number assigned by the manufacturer. Consequently, every imported or locally manufactured mobile device comes with IMEI number.
The 1 st respondent maintained that issuance and management of IMEI numbers is governed by the Global System for Mobile Communications Association and IMEI number uniquely identifies mobile devices and enables regulators, manufacturers, and service providers to address issues such as theft, counterfeiting and unauthorized network access.
The 1 st respondent asserted that when a mobile device is switched on, it transmits its IMEI to the network even in the absence of a sim card. Without a sim card, IMEI number alone cannot be linked to personal information. Only mobile network operators can associate a sim card with a device’s IMEI number
The 1 st respondent maintained that IMEI is a technical identifier confined to the device itself. It is not linked to user behaviour or activities nor does it contain or collect personal data. Its role is to verify the authenticity or hardware and ensure that devices comply with established standards without enabling surveillance or user monitoring.
The 1 st respondent asserted that the impugned notice requires that IMEI number be uploaded into a database at specific stages during local assembly, importation, or prior to sale by retailers or wholesalers-before they are sold to end users. At these stages, the IMEI can only be used to verify compliance with type approval standards, confirms that devices are neither counterfeit nor stolen, and ensure that customs duties have been collected. In this context, it does not pose any risk of violating privacy or enabling surveillance.
The 1 st respondent stated that under the Kenya Information and Communications (Importation, Type Approval and Distribution of Communications Equipment) Regulations, any device used to connect to public networks must be type-approved by the authority. At points of entry, importers are required to provide evidence that the devices being imported had been type-approved by attaching a type-approval certificate to the import declaration form. In order to ensure that the devices being imported conform to the declaration, such importers are now required by the impugned notice to key in the IMEI numbers of all mobile devices in that consignment.
The 1 st respondent refuted the claim that the notice is a statutory Instrument so as to require compliance with the Statutory Instruments Act. The 1 st respondent denied the petitioner’s assertion that blacklists for stolen phones are sufficient. That argument disregards the GSM standard’s deliberate three-tiered design which serves distinct and complementary regulatory purposes. The whitelist, grey list and blacklist all serve distinct roles to ensure that the integrity in the communication sector is maintained.
The 1 st respondent contended that IMEI numbers do not constitute personal data as defined under section 2 of the Data Protection Act. The purpose, scope and context of collecting IMEI numbers do not pose any risks to the rights and freedoms of data subjects as the data remains anonymized and unrelated to personal information. The 1 st respondent is therefore under no obligation to conduct a data protection impact assessment. The 1 st respondent maintained that the petitioner’s allegations on violation of article 35 of the Constitution is premature and there is also no basis for the argument regarding mass surveillance.
2 nd respondent’s response
The 2 nd respondent opposed the petition through a replying affidavit (sworn by Peter Olali.) The 2 nd respondent stated that it has authority under articles 209 and 210 of the Constitution to ensure it effectively assesses, collects and accounts for all tax revenues due under various tax laws. In order ensure that everybody pays their fair share of taxes and within reasonable recovery measures, the Constitution, the Excise Duty Act (Cap 472), the Value Added Tax Act (Cap 476), the Miscellaneous Fees and Levies Act (Cap 469C), the East African Community Customs Management Act (2004) and other relevant laws have provisions that enable it to demand tax, investigate tax evasions and ensure that tax due is paid by parties responsible.
The 2 nd respondent asserted that it is dedicated to fostering tax compliance and enhancing revenue collection as part of its commitment to national development and in collaboration with the 1 st respondent in regulating importation of mobile devices. The impugned notice is an initiative to ensures proper tax declaration, payment and verification of mobile devices imported into or assembled within Kenya.
The 2 nd respondent contended that the impugned notice is aimed at enhancing revenue collection, promote fair tax practices, support national development, enhance transparency and reduce tax evasion. The 2 nd respondent asserted that it has no powers or mechanisms to monitor or engage in any form of surveillance. The IMEI is a phone identifier and has nothing to do with tracking and surveillance. Its goal is to ensure that all mobile devices in use are legitimate and meet the necessary tax obligations and regulatory requirements.
Regarding violation of privacy, the 2 nd respondent stated that all information and data received is for tax purposes and is solely handled in line with the provisions of the Constitution, the Excise Duty Act, the Value Added Tax, the East African Community Customs Management Act and the Miscellaneous Fees and Levies Act, among other relevant tax laws.
According to the 2 nd respondent, the information sought regarding registration of IMEI does not violate the Data Protection Act. It is done at the point of importation by importers and assemblers and the details of the end user are not captured anywhere. In any event, the 2 nd respondent asserts, it is compliant with the requirements of the Data Protection Act and the General Data Protection Regulations.
The 2 nd respondent maintained that data collected is limited to what is required to ensure compliance with applicable tax laws as and system access to data is role-based. Its data accountability framework holds staff accountable for proper data use. The 2 nd respondent urged that the right to privacy under article 31 of the Constitution is not absolute. Further, provision of IMEI numbers meets the constitutional and statutory threshold. According to the 2 nd respondent, sections 5(4), 9(2) and 191 of the East African Community Customs Management Act and section 6(1) of the Tax Procedures Act ensure protection of the citizen’s personal information from disclosure.
The 2 nd respondent denied the claim of discrimination against any citizen or violation of the right to dignity. The 2 nd respondent asserted that information registered in its Customs Declaration System is general in nature and does not capture personal information. It has a duty under section 18(2) of the East African Community Customs Management Act, 2004 to ensure that all goods importation of which is for the time being regulated by the Act or by any written law and the conditions or guidelines for their importation are complied with.
3 rd respondent’s response
The 3 rd respondent opposed the petition through grounds of opposition. The 3 rd respondent asserted that IMEI registration framework is grounded on the statutory and constitutional mandate of the 1 st and 2 nd respondents as stipulated in the Kenya Information and Communications Act and Kenya Revenue Authority Act.
According to the 3 rd respondent, IMEI registration framework resonates with the provisions of articles 201 and 209 of the Constitution. Collection of IMEI numbers is limited to a legitimate regulatory purpose and does not constitute arbitrary or unlawful interference with privacy; the right to privacy is not absolute and can be limited within the dictates of article 24. The framework aligns with the objectives of article 35 of the Constitution and the respondents issued public notices on the IMEI framework, ensuring stakeholder awareness and participation.
It was the 3 rd respondent’s position that articles 94 and 95 of the Constitution are wrongly invoked because the impugned notices are not legislative acts but administrative actions issued under the statutory mandate of the respondents. They did not require parliamentary approval under the Statutory Instruments Act.
The 3 rd respondent asserted that the whitelisting mechanism is proportionate and non-discriminatory and that the dignity of individuals is not violated by registration of IMEI numbers. The 3 rd respondent maintained that the relief to prohibit implementation of the notices is unwarranted as the measures being taken are integral to fulfilling Kenya’s obligation under both domestic laws and international commitments to combat tax evasion, counterfeit goods and illicit trade.
The 3 rd respondent stated that the Data Protection Act permits data processing where it is necessary and authorized for compliance with legal obligations or in the public interest under section 25(b). The 3 rd respondent maintained that the framework adheres to the Constitution and statutory laws, striking a balance between individual rights and public interest.
The 3 rd respondent took the view, that the existing blacklist system does not sufficiently address the challenges of counterfeit devices and tax evasion, and the whitelist system provides a more robust solution by proactively ensuring compliance before devices are connected to mobile networks. IMEI registration framework contributes to consumer protection in line with article 46 of the Constitution.
1 st interested party’s response
The 1 st interested party supported the petition through a replying affidavit sworn by Mugambi Laibuta (Mr. Laibuta). It was stated an IMEI number is a unique identifier assigned to every mobile device with cellular capabilities; it creates the connection between a mobile phone device and a cell phone tower allowing mobile providers to pinpoint a phone’s location within a defined radius; allows cellular networks to identify the device being used on their network, ensuring that each device is distinguishable; it can be used to locate a lost or stolen phone, or mobile phone device that has been used to commit a crime; it can be used to identify and prevent the sale or use of counterfeit devices and may be used verify mobile device ownership.
According to the 1 st interested party, due to the uniqueness and use, an IMEI number raises privacy concerns, namely; it can be used for tracking a device’s location through cellular networks which in effect could infringe on a user’s right to privacy under article 31 of the Constitution and the Data Protection Act if conducted without consent or legal authorization. Mobile applications and third-party services can access it using them for analysis, targeted advertising or creating user profiles across devices.
The 1 st interested party stated that when combined with other data points such as location, mobile application usage, phone number, flight and customer information, name, age, sex and other identifiable personal information, an IMEI number can contribute to user profiling, behavioural tracking and surveillance by state agents.
In the view of the 1 st interested party, since an IMEI number can easily identify an individual, it is personal data within the definition in section 2 of the Data Protection Act. If databases containing IMEI numbers are compromised, they could be linked with personal data, leading to potential misuse.
The 1 st interested party asserted that pursuant to section 25 of the Data Protection Act, the respondents ought to have valid legal basis for requiring disclosure and collection of IMEI numbers but have not shown the inefficiency of other methods of enforcing tax compliance. Using IMEI numbers to secure tax compliance is unjustified and leads to potential violation of fundamental rights and freedoms.
The 1 st interested party maintained that submitting a buyer of a mobile device to surveillance for purposes of tax compliance amounts to shifting the burden of compliance to a purchaser who is not the taxpayer for purposes of tax compliance. The public was not also involved before the impugned notices were issued. According to the 1 st interested party, the respondents are obligated to inform mobile phone device users on how their IMEI numbers will be used, stored and shared. The respondents further have not met their disclosure requirements under section 29 of the Data Protection Act.
The 1 st interested party asserted that IMEI numbers should only be collected and used for specific, explicit and legitimate purposes which the respondents have not demonstrated. Being personal data, it should only be retained as long as necessary for the intended purpose, which period has not been indicated contrary to section 25 of the Data Protection Act. The respondents had also not provided proof of security of the IMEI data that they want disclosed; disclose all third parties that will have access to the IMEI data and how they will use the data and the safeguards they have put in place for processing or publishing a Data Protection Impact Assessment as required under section 31 of the Data Protection Act.
The 1 st interested party maintained that handling of IMEI numbers could lead to a violation of the right to freedom of expression, movement and freedom from discrimination. Operational costs will be unbearable for small scale business owners and local assemblers as a result of an added administrative layer due to tax compliance and registration of IMEI numbers at the port of entry. The investment in compliance systems by small-scale players and local assemblers would push them out of the market space and allow larger and more aggressive players to dominate the industry.
The 1 st interested party asserted that the threat of blacklisting IMEI numbers or blocking non-registered devices may prevent users from accessing essential services, such as mobile banking, affecting the marginalized groups. It could also lead to undermining the progress of the country in areas such as digital inclusion, online education, access to internet powered phones and technological growth and advancements.
The 1 st interested party posited that in the absence of a cogent legislative support under which the respondents anchored the impugned notices, there is likely to be a hurdle in implementation of the directive, which will have far reaching consequences to businesses and consumers.
4 th interested party’s case
The 4 th interested party supported the petition through an affidavit sworn by Stephen Mutoro. The 1 st interested party stated that disclosure and registration of mobile device IMEI numbers is an affront on the right to privacy and data protection; exposes individuals to the risk of unjustifiable access to their personal data and communication.
According to the 4 th interested party, the disclosure requirements imposed do not meet the limitation test under article 24 of the Constitution. Through the imposed measures (notices) the respondents do not demonstrate elaborate mechanisms for oversight and monitoring to ensure that handling of personal data by KRA and mobile network operators is done in an accountable manner and safeguarded from exploitative use for other purposes other than the tax purpose.
The 4 th interested party was of the view, that in seeking to adopt measures that might expose individual’s data and communications to exploitative use, the respondents have not demonstrated adequate measures to safeguard against surveillance and unauthorized interceptions.
Amicus Brief
The amicus cited an article ‘ Analysing of Security Risks Associated with IMEIs and Unwiped Data of Disposed Mobile Handsets, Vol.3, Issue 11, International Research Journal of Modernization in Engineering Technology and Science’, Raja Sharma and Krishan Kumar and Prabhpreet Kaur, ‘ Vulnerability Detection of International Mobile Equipment Identity Number of Smartphone and Automated Reporting of Changed IMEI Number’ on the meaning of an IMEI number.
The amicus submitted that IMEI number constitutes personal data as it is obtained and linked to an individual immediately an individual purchase a mobile device. The Amicus relied on comparative analysis considered from, Paragraph 1.3 (xix) of the Nigerian Data Protection Regulations, 2019 and Paragraphs 171 and 172 of the European Data Protection Board (EDPB) Guidelines on processing personal data in the context of connected vehicles and mobility related applications.
The amicus again relied on article 5(3) of the European Union Data Protection Directive, The Privacy Directive (2002/58/EC, as Revised by 2009/136/EC), Section 2 of the Data Protection Act and a Report prepared by European Union Directorate General Justice Department Working Party; article 29 Data Protection Working Party Opinion02/2013 on Apps on Smart Devices, 00461/13/EN-WP 202 on the guiding principles for storage, processing and access to personal data.
The amicus submitted that based on the foregoing characterization of IMEI, it follows that it ought to be processed in line with the provisions of articles 31 of the Constitution and sections 25, 26, 30 and 31 of the Data Protection Act. The requirement to disclose IMEI numbers poses a threat to violation of the right to privacy guaranteed under article 3
[...truncated]