A Kenyan court has ruled that mobile phone numbers form part of an individual’s digital identity, placing new restrictions on how telecom operators recycle SIM cards to prevent privacy breaches.
In a judgment delivered on March 19, Justice Lawrence Mugambi held that mobile numbers are “digital identifiers” tied to a person’s private affairs, warning that reassigning them without safeguards could expose sensitive personal data.
The ruling, which cited constitutional protections against unnecessary exposure of private information, directs the Office of the Attorney General to implement measures within six months to secure digital identities linked to phone numbers.
The decision stems from a June 2024 petition challenging the widespread industry practice of recycling inactive SIM cards. Petitioners argued that reassigning previously registered numbers could grant new users access to financial, social, and personal data still tied to the former owner.
The Problem: SIM Recycling and Digital Identity Risks
Across Africa, mobile numbers have evolved beyond communication tools into core digital identity markers. They are now linked to bank accounts, mobile money wallets, national ID systems, and social media platforms.
- According to a report by The African Exponent, Africa had over 1 billion active Subscriber Identity Module (SIM) cards.
- In markets like Nigeria, Kenya, and South Africa, with penetration rate of 85 percent, 118 percent, and 195 percent, respectively, telecom operators routinely recycle inactive numbers to meet demand.
However, this practice has increasingly exposed users to risks such as:
- Unauthorized access to banking and fintech apps
- Identity theft via OTP (one-time password) interception
- Social media account takeovers
Recent incidents across Africa have shown how recycled numbers can allow new users to inherit access to previous owners’ digital footprints, especially when platforms fail to fully delink accounts.
The Solution: Consent, Verification, and Technical Safeguards
The Kenyan court’s ruling introduces stricter conditions for SIM reassignment, effectively redefining how telecom operators must handle digital identity.
Under the new framework:
- Telecom providers must obtain informed and verifiable consent from the previous owner before reassigning a number
- Reassignment can only occur after a reasonable waiting period and public notice
- Operators must conduct a documented verification process confirming the original owner cannot be reached or has relinquished the number
- Technical safeguards must be implemented to prevent transfer or exposure of personal data tied to the previous user
The court also highlighted vulnerable groups such as incarcerated individuals, who may lose access to their numbers due to prolonged inactivity, increasing the risk of unintended data exposure.
Why It Matters for Africa
The ruling could set a precedent for other African countries where mobile numbers serve as the backbone of digital economies.
- In Nigeria alone, over 175 million active mobile subscriptions are linked to services such as bank verification numbers (BVN), NIN-SIM registration, and fintech platforms. A breach in this system can have far-reaching consequences for financial security and trust in digital services.
By enforcing stricter controls on SIM recycling:
- Users gain stronger protection against identity theft and financial fraud
- Telecom operators may need to invest in more robust identity management systems
- Regulators across Africa could adopt similar frameworks to safeguard digital ecosystems
As mobile-led innovation continues to drive Africa’s digital growth, the Kenyan ruling underscores a critical shift: phone numbers are no longer disposable assets—they are foundational to digital identity, and mishandling them carries real-world consequences.