Summary

  • Kenya’s High Court made reassignment conditional on informed, verifiable consent or a documented process showing the former subscriber cannot be found or has given up the number, with safeguards against exposing their data.
  • The Communications Authority’s proposed six-month process adds notice, delinking and a central recycled-number system. That system can tell services a number has changed hands; it cannot, by itself, prove that every account attached to it has been detached.

The first question about an inactive mobile number is usually whether its subscriber is still using it. Kenya’s proposed safeguards ask a second question: after a number leaves one subscriber and reaches another, which other systems still treat the digits as the first person?

That distinction matters because a mobile number is both a scarce network resource and a durable contact key. An operator can disconnect a SIM and later allocate its number again. A bank, employer, school, government portal or messaging service may still hold the same number as a recovery channel or as a route for private information. The new subscriber receives the calls and messages; the old service relationship may not have ended with the old SIM.

Kenya’s High Court brought that gap into constitutional view in Odhiambo & another v Attorney General & another, a case brought by two prisoners whose numbers had become inactive while they were incarcerated. The court declared a registered mobile number a digital identifier linking to personal information protected by Article 31. Its order required the Attorney General, working with relevant departments, to establish safeguards. Reassignment was to occur only with the former registered owner’s informed and verifiable consent; after a reasonable period and public notice preceded by documented efforts to confirm that the former owner could not be located or had unequivocally revoked their rights; and with technical protections against unauthorized exposure or transfer of the former owner’s personal data.

The judgment also gave the Kenya Prisons Service a separate task: within six months, it was to formulate and gazette a scheme preserving prisoners’ number-linked identity during incarceration, including a mechanism to notify mobile operators. It set a default consequence if the orders were not implemented by midnight on 19 September 2026: reassignment and recycling of deactivated, previously registered numbers would automatically cease. That deadline is a legal condition in the judgment, not evidence that a final framework or database was in operation by that date.

The Communications Authority of Kenya (CA) then published a proposed document, CA.G.520:2026, titled Procedures and Technical Safeguards for Deactivation and Recycling of Inactive Telecommunication Numbering Resources. Its stated effective date is 19 September 2026. The document starts the recycling clock after three months without revenue-generating activity. Operators must try to reach the subscriber using registration-stage Know Your Customer details; they then have another three months to reactivate the line. Thirty days before that period ends, the operator is to publish the list of numbers at risk. A public notice is to explain the process and include a USSD status check.

After the notice period, the operator must delink and securely archive personal data, cached data and services in its own systems so a new subscriber cannot access or inherit them. It must submit the number to a centralized system on a quarterly basis. Third parties are meant to use that system to update records before calling or sending messages about obligations associated with the number. The operator can initiate recycling once the submission is made. The database-dependent provisions, however, take effect only once the system has been established.

This is a meaningful design change. It makes number reuse a recorded transition rather than an internal telco event. It also recognizes that an operator should remove its own subscriber data and that another service should know when the number it holds has been recycled. The CA’s consultation-response summary shows the regulator backing a central list and periodic third-party queries. When asked about confirming that every mobile-money or banking relationship had been removed before reassignment, the Authority said operators cannot see all the value-added services to which subscribers have linked their numbers.

The proposed division of labor is therefore: operators de-link their own records; the database carries reassignment status; third-party services check it and manage their own records.

That division also reveals the limits of a number-status database. A record that says “recycled” is not the same as an account record that says “this customer changed their recovery number.” A query can warn a service to stop treating the previous number as current, but the published proposal does not show the central system changing every bank profile, resetting every authentication path or proving that each former subscriber has completed an account-level exit. Nor does a quarterly submission guarantee that a third-party query always sees a current status.

The consultation summary records a stakeholder asking for a security and governance framework before implementation; the CA responded that the details would be addressed during system establishment.

The public record still needs careful reading. The CA’s Open Consultations page continues to label the item “Proposed Draft” and shows the September 11 comment deadline. Its Published Findings page now lists the consultation summary for submissions received from September 1 to 11. In a report of a 9 October Public Petitions Committee appearance, Parliament says the CA Director General told members that procedures had been developed and described three months of subscriber contact, public notices, a USSD checker and whitelisting.

That same report records a question about notifying a deceased subscriber and an answer that alternative contact details are not always collected or insisted upon during registration.

These records show administrative work and a regulator’s account of its procedures. They do not establish, on their own, the final publication status of CA.G.520:2026, the gazetted prison-specific scheme ordered by the court, or the live operation and governance of the central database. The public hearing also shows that notice depends on the quality of data collected years earlier. A warning sent to a number already disconnected cannot reach its former user. A notice sent only to a second contact helps only if that contact exists, remains accurate and is authorized to act.

The next phase is consequently less about adding another waiting period and more about proving the hand-offs. Operators need to distinguish inactivity detection, attempted contact, public notice, de-linking, database submission and first reassignment as separate events with timestamps. Third-party services need to distinguish a number used for a message from a number used to authenticate or recover an account. A lookup that prevents an old debt notice from reaching the wrong person may still be inadequate if a recycled number can reset a high-value account.

The distinction is not a claim that Kenya’s proposed safeguards have already failed. The public documents describe intended processes, not observed cases after implementation. They also do not establish that the database has launched. The practical question is whether the final rule, system and service practices make the number’s change of holder visible to the parties that continue to rely on it—and whether they do so without exposing the former holder’s history to the new one.

Heng Lu’s Note 72 offers a narrow editorial lens here: a shared register should preserve accurate status and continuity, while the parties who actually control a service retain responsibility for their own decisions. That is not a legal rule for Kenya. It is a useful test for the design: the central system should be authoritative about the number’s lifecycle, not silently treated as proof that every account relationship has been repaired.

Sources and evidence limits: High Court judgment; the CA’s proposed safeguards, CA.G.520:2026, consultation summary, and current consultation page; Parliament’s 9 October hearing report. Heng Lu Note 72 informs the editorial lens only. The article does not claim that the proposed database is live, that an account takeover occurred, or that the CA’s draft by itself satisfies the High Court’s orders.