Petition filed over misuse of protesters’ data by government and telcos

A constitutional petition has been filed at the Milimani High Court challenging the alleged unlawful sharing and use of protesters’ personal data by telecommunications companies and investigative agencies.

In the petition, the Law Society of Kenya (LSK) has named several state agencies, police officers, and institutions as respondents, accusing them of unlawfully accessing and using private communication and location data of protesters between 2024 and 2025.

According to court documents, a telecommunications service provider is listed as the first respondent. The petition alleges that the company breached its statutory and constitutional obligations by disclosing subscriber data of protesters without a court order, contrary to the Data Protection Act, 2019.

The lawyers’ body argues that the respondents failed to observe the Constitution and statutory safeguards when requesting data without warrants, transporting suspects across counties without due process, relying on unlawfully obtained evidence, and submitting forensic devices without lawful seizure.

The petition further claims that the Communications Authority and the Office of the Data Protection Commissioner failed in their oversight functions, enabling continued abuse of private citizen data, “reads court papers.”

The petition claims that officers under the Inspector General’s command unlawfully sought and used private data belonging to protesters, in violation of constitutional safeguards governing policing operations.

Also named is the Directorate of Criminal Investigations (DCI), described in the petition as a specialised investigative unit mandated to investigate crimes and gather intelligence. The petition accuses the directorate of obtaining communication and location data of protesters without a lawfully issued court warrant.

The Director of Public Prosecutions (DPP) has also been named as a respondent. The petition alleges that the prosecution authority relied on unlawfully obtained data in criminal proceedings, contrary to constitutional standards requiring evidence to be lawfully acquired.

The Attorney General has been listed as a respondent as the principal legal adviser to the government and the representative of the state in civil proceedings involving alleged constitutional violations by government institutions.

The Communications Authority of Kenya is also named in the petition. The Law Society argues that the regulator failed to enforce compliance with data protection obligations by telecommunications providers and allowed investigative agencies to access subscriber data without court authorisation.

The petition further names Kenya Power Company, claiming its systems or agents may have facilitated unlawful access to protesters’ personal information, including home location details.

Several police officers attached to the Directorate of Criminal Investigations, ranging from constables to senior investigators, have also been named individually. The petition accuses them of requesting, accessing, or using subscriber information and location data of protesters without judicial authorisation, contrary to the Constitution, the National Police Service Act, and the Police Standing Orders.

The Director of the National Police Service Forensic Laboratory has also been named, with the petition alleging that the laboratory processed and analysed digital evidence obtained from protesters’ devices without lawful authority.

A senior DCI officer is further accused of authoring or directing letters requesting personal communication and location records from telecommunications providers without the required judicial authorisation.

The petition also alleges that several officers travelled to Eldoret to arrest one of the individuals involved without following constitutional requirements during arrest, including identifying themselves and informing the suspect of the reason for arrest.

In addition to the respondents, the case lists several interested parties, including individuals said to have participated in protests and whose data was allegedly shared unlawfully. The petition claims that the sharing of their data violated their constitutional rights to privacy, fair administrative action, and due process.

Oversight and human rights institutions have also been included as interested parties to assist the court. These include the Independent Policing Oversight Authority (IPOA), the Kenya National Commission on Human Rights (KNCHR), and the Independent Medical Legal Unit (IMLU), which have documented alleged human rights violations linked to surveillance and arrests of protesters.

Busia Senator Okiya Omtatah has also been listed as an interested party due to his advocacy on data privacy and digital rights.

International and local civil society organisations, including Amnesty International and Katiba Institute, are also expected to make submissions on the protection of privacy rights and unlawful surveillance.

The Office of the Data Protection Commissioner has also been included to provide regulatory guidance on the lawful handling and disclosure of personal data under the Data Protection Act.

The Competition Authority of Kenya and other regulatory bodies have similarly been listed due to their roles in safeguarding consumer rights and monitoring compliance in the telecommunications sector.

The petition argues that the alleged actions by the respondents violated constitutional protections on privacy, fair trial, and lawful administrative action. It asks the court to determine whether the sharing and use of communication and location data without court orders was unconstitutional.

Justice Lawrence Mugambi directed that the petition be served upon the respondents and scheduled the next hearing for further directions on 9th April 2026.