The Computer Misuse and Cybercrimes (Amendment) Act, 2024, signed into law by President William Ruto on Wednesday, October 15, 2025, is facing a legal challenge at the Milimani Law Courts. The petition, filed by the Kenya Human Rights Commission (KHRC) and former presidential contender Reuben Kigame, argues that the amended law violates several provisions of the Kenyan Constitution.

The petitioners contend that the law contains vague and overbroad provisions that could criminalise legitimate online expression and undermine existing data protection safeguards. They have named the Attorney General and the Speaker of the National Assembly as respondents, accusing them of failing to ensure the legislative process met constitutional and procedural requirements.

Constitutional Concerns and Digital Rights

At the core of the petition are claims that several sections of the amended Act grant government agencies unchecked powers to monitor, access, and restrict online accounts without judicial oversight. This, the petitioners argue, contravenes Articles 31 (privacy), 33 (freedom of expression), 34 (media independence), 35 (access to information), and 36 (freedom of association) of the Constitution.

One contentious provision highlighted is the mandatory verification of social media accounts, which would require users to link their profiles to government-issued identification documents. The petitioners assert that this amounts to state surveillance and an invasion of privacy, potentially endangering human rights defenders, journalists, and activists who rely on anonymity.

Furthermore, the petition challenges the clause criminalising the spread of "false, misleading, or mischievous" information, arguing that its vague wording could lead to arbitrary arrests and censorship of dissenting opinions.

Impact on Data Protection and Legislative Process

The petitioners also claim that the Computer Misuse and Cybercrimes (Amendment) Act, 2024, directly undermines the Data Protection Act of 2019. They argue that the new law introduces conflicting data-handling procedures, effectively creating a parallel regulatory system that dilutes the mandate of the Office of the Data Protection Commissioner (ODPC).

Procedural irregularities during the legislative process are another key argument. The petitioners contend that Parliament failed to refer the Bill to the Senate for consideration, despite it being a matter that concerns county governments as defined in the Constitution, specifically regarding the control of pornography.

Historical Context and Previous Challenges

The original Computer Misuse and Cybercrimes Act, 2018, also faced legal challenges. The Bloggers Association of Kenya (BAKE) filed a petition in 2018, leading to the suspension of several sections. The High Court eventually dismissed that petition in February 2020, allowing all provisions of the 2018 Act to come into full force.

The 2018 Act was designed to address various cybersecurity concerns, including unauthorised access, cyber harassment, phishing, and cyberterrorism. It aimed to protect computer systems, programs, and data, and facilitate the investigation and prosecution of cybercrimes.

Evidence/Data Box

• Law Challenged: Computer Misuse and Cybercrimes (Amendment) Act, 2024.
• Date Assented: Wednesday, October 15, 2025, by President William Ruto.
• Petitioners: Kenya Human Rights Commission (KHRC) and Reuben Kigame.
• Respondents: Attorney General and Speaker of the National Assembly.
• Constitutional Articles Cited: Articles 10, 24, 31, 33, 34, 35, 36, and 47.
• Previous Legislation: Computer Misuse and Cybercrimes Act, 2018.
• Related Legislation: Data Protection Act, 2019.

Risks and Implications

The new amendments broaden the legal definitions of cybercrimes such as phishing, cyber harassment, and identity theft, and introduce steeper penalties, including fines of up to KSh 10 million or 20 years imprisonment for severe cases. While intended to combat emerging digital threats, critics argue that the vague wording of certain clauses risks misuse against journalists, whistleblowers, and those expressing dissenting opinions.

The Act also empowers the National Computer and Cybercrimes Coordination Committee (NC4) to order the blocking or removal of websites, applications, or content without judicial oversight, raising concerns about potential censorship and government control over online content.

What to Watch

The High Court's decision on this petition will have significant implications for digital rights, freedom of expression, and data privacy in Kenya. The court will need to balance the government's stated aim of combating cybercrime with constitutional guarantees of fundamental freedoms. The involvement of interested parties such as the Law Society of Kenya (LSK), the Kenya Union of Journalists (KUJ), and the Data Protection Commissioner underscores the broad public interest in this case.