Kenyan mobile phone users could get stronger protection against privacy breaches under proposed regulations that would require telecommunications companies to report recycled numbers to a central database, helping banks, digital lenders and other businesses avoid sending confidential messages to new owners of old phone lines.
The Communications Authority of Kenya (CA) says the planned system will allow service providers, including bulk SMS companies, to establish whether a number has changed hands before sending subscription-related messages.
The measure is intended to address risks that arise when inactive mobile lines are reassigned to new subscribers while remaining linked to the previous owners’ financial and online accounts.
"The Authority will establish a centralised database that will contain a list of numbers that have been recycled within a given period of time," the CA said in response to public comments on the proposed line deactivation and recycling rules.
"Querying the database will ensure that third-party value-added service providers only send messages to the rightful owner."
The proposed database forms part of a wider set of measures designed to give subscribers more time to retain their numbers before telecommunications operators can reassign them.
The regulator is also seeking to extend the period operators must wait before recycling dormant lines by three months, giving customers additional time to restore their numbers and reducing the risk of losing access to accounts connected to them.
The issue has become increasingly important as mobile numbers are used to access banking services, online platforms and identity verification systems. One-time passwords sent through SMS are also widely used to confirm transactions and verify account ownership.
When a number is reassigned, banks, savings and credit cooperative societies (Saccos) and fintech companies could continue sending transaction alerts, account updates or password-reset messages to the former number. The new subscriber could then receive information intended for someone else, potentially exposing private details.
The proposed database would give service providers a way to establish whether a number has been recycled before sending messages, helping them avoid disclosing personal information to people who are no longer authorised to receive it.
Under the plan, telecommunications operators, including Safaricom and Airtel Kenya, would be required to submit updated lists of deactivated and recycled numbers to the central system every three months. Third-party service providers would use the records to update their databases and prevent messages from being sent to the wrong recipients.
However, the CA has rejected a proposal requiring subscribers to alert their contacts through SMS whenever their numbers change ownership. The regulator warned that such a requirement could introduce additional privacy risks.
"It is a violation of the Data Protection Act to access personal information without authorisation," the CA said.
The proposed rules would also set out the conditions under which operators can deactivate and recycle inactive lines.
A mobile number would become eligible for deactivation after three months without revenue-generating activity. Such activity includes making calls, sending SMS messages, using mobile data, purchasing airtime or accessing value-added services.
After this period, the operator would be required to contact the subscriber and provide an additional three months for the line to be reactivated before proceeding with the recycling process.
Telecommunications companies would also have to give advance public notice of numbers scheduled for deactivation. Thirty days before the end of the additional period, they would publish the relevant lists on their websites, in newspapers with nationwide circulation and through other media.
The proposed regulations would introduce further restrictions on marketing messages sent to newly allocated and recycled numbers. Such lines would not receive marketing messages by default, while operators would be required to remove recycled numbers from business-to-consumer messaging services that subscribers had previously agreed to join.
Before assigning a number to a new customer, telecommunications companies would also have to separate and archive the previous owner's personal information. This would ensure that the information is neither accessible to the incoming subscriber nor transferred to them as part of the reassignment process.
The proposed safeguards follow growing concern about the security risks associated with mobile numbers that remain connected to the financial and digital accounts of former owners.
In March, the High Court barred telecommunications companies from automatically recycling inactive numbers without the original subscribers' consent. The decision followed a legal challenge by an inmate whose phone line had been affected by prolonged involuntary inactivity.
The court raised concerns that reassigned numbers could expose former subscribers' private information if new owners gained access to details linked to mobile banking services, messaging applications and online accounts.
The CA's proposals also seek to protect prisoners and people held in remand for extended periods, who may be unable to use their mobile lines for reasons beyond their control.
Under the proposed arrangements, the Commissioner-General of Prisons would facilitate exemptions from the inactivity period for eligible inmates. The protection would cover suspects denied bail who are likely to remain in remand for more than six months.
The planned database, alongside the proposed changes to deactivation timelines and data protection requirements, is intended to reduce the risks that arise when mobile numbers change ownership while remaining connected to the previous subscribers' personal information.