The decision effectively nullifies the CA’s plan to install the Device Management System (DMS) it said would guard against use counterfeit handsets to make calls in Kenya.
The CA had denied that the DMS has capacity to access the phone records, location, and mobile money transaction details of subscribers.
It insists that the technology can only detect and record the unique identification number of mobile phones and assigned subscriber numbers.
Mobile phone users yesterday got a major relief against spying on their private communication after the High Court threw out the quest by the Communications Authority of Kenya (CA) to have unfettered access to consumer data held by telecoms service providers.
In a precedent-setting decision that re-affirms consumers’ right to privacy, the court declared the CA’s move unconstitutional, as it gave no assurance that it won’t be used by third parties to access private information.
The decision effectively nullifies the CA’s plan to install the Device Management System (DMS) it said would guard against use counterfeit handsets to make calls in Kenya.
The CA had denied that the DMS has capacity to access the phone records, location, and mobile money transaction details of subscribers, insisting that the technology can only detect and record the unique identification number of mobile phones and assigned subscriber numbers.
Justice John Mativo in his judgment agreed with the petitioner, activist Okiya Omtatah, that the system could allow third parties such as the CA to access mobile users’ private information.
“Today citizens live a major portion of their lives online and use computers and cell phones to conduct business, to communicate, impart ideas, conduct research, explore their sexuality, seek medical advice and express political views, that increases state’s mandate to enhance protection of privacy. By seeking to integrate DMS (with mobile service providers networks) to access information on the IMEI, IMSI, MSISDN and CDRs of subscribers the CA would become a big threat to the subscribers’ privacy, and operate in breach of the subscribers’ constitutionally guaranteed right to privacy.”
The CA had in January 2017 written to Safaricom #ticker:SCOM, Airtel and Orange (Telkom) demanding that a contractor it had hired be allowed into the operators’ sites to install the snooping device, sparking public uproar.
Sweet victory
The court’s decision amounts to a major blow to the government and sweet victory for consumers and operators, including market leader Safaricom, who argued that the device could be used as a back door to gain access to sensitive customer data and expose the operators to legal risks.
The CA, the telecoms market regulator, had on its part defended the move on grounds that it would help weed out counterfeit phones from the local market.
Mr Omtatah questioned the CA’s quest, arguing that the regulator had not invited public participation as required by the law prior to implementing the system.
Safaricom, which was enjoined in the case as an interested party, revealed that it had raised queries on the privacy of the data that the device would collect as well as on security arrangements with the regulator but none was resolved.
Airtel Kenya, which was also enjoined in the suit as interested party, did not participate in the deliberations while Telkom told the court that it would be comfortable with any outcome of the case.
Justice Mativo found that the CA has no mandate in combating use of counterfeit goods in the Kenyan market, noting that the law has assigned that role to the anti-counterfeit agency.
“The role of upholding product quality standards is assigned to the Kenya Bureau of Standards while that of combatting illegal entry of goods belongs to Kenya Revenue Authority, Ministry of Roads and Transport, and the Kenya Police,” the judge ruled.
He observed that 1.8 million counterfeit phones were switched off in absence of the system, noting that less intrusive means are available to combat the same.
Justice Mativo further noted that all points of entry into Kenya are manned and that it had not been proven that the agencies involved are unable to perform their duties.
He, however ,rejected the petitioner’s request to cancel the DMS tender, noting that no information was provided laying out the process of awarding the said tender.
He further rejected the request to hold CA officials personally liable, saying that nobody should be prosecuted unheard.
