Kenya Court Strikes Down Cybercrime Law Sections as Unconstitutional

Nairobi — Kenya’s Court of Appeal has struck down key provisions of the Computer Misuse and Cybercrimes Act, a law enacted in 2018 and amended in 2024, deeming Sections 22 and 23 unconstitutional. The ruling, delivered on March 6, 2026, centers on concerns that the sections criminalized free expression and risked ensnaring individuals for unknowingly sharing false information online. The decision follows an appeal filed by a coalition of organizations including the Bloggers Association of Kenya (BAKE), Article 19 Eastern Africa, the Kenya Union of Journalists (KUJ), and the Law Society of Kenya (LSK).

The contested sections of the Act carried significant penalties. Section 22 stipulated a fine of up to Sh5 million (approximately $32,600 USD based on current exchange rates) or imprisonment for up to two years, or both, for intentionally publishing false, misleading, or fictitious data with the intent that it be considered authentic. Section 23 imposed even harsher penalties – a fine of up to Sh5 million or imprisonment for up to 10 years, or both – for knowingly publishing false information that could cause panic, chaos, violence, or damage to another’s reputation. Despite acknowledging that the Constitution allows for limitations on freedom of expression in cases of incitement to violence or hate speech (Article 24), the court found these provisions overly broad.

The Core of the Challenge: Vagueness and Overreach

The three-judge bench, comprised of Justices Patrick O. Kiage, Aggrey Muchelule, and Weldon Kipyegon Korir, argued that the language used in Sections 22 and 23 lacked the necessary clarity to withstand constitutional scrutiny. The judges likened the provisions to “unguided missiles,” capable of indiscriminately targeting innocent citizens. A central concern was the potential for criminalizing individuals who shared information online without realizing its falsity. This echoes broader international debates about the balance between combating disinformation and protecting fundamental rights to freedom of expression.

Mercy Mutemi, a partner at Nzili and Sumbi Advocates and legal counsel for BAKE, hailed the ruling as a “pivotal moment,” urging the Office of the Director of Public Prosecutions to immediately discharge anyone charged under the now-unconstitutional sections. Kennedy Kachwanya, Chairperson of BAKE, emphasized that the decision affirmed the internet as a space for accountability, not intimidation. This sentiment reflects a growing concern among digital rights advocates about the use of vaguely worded laws to suppress online dissent.

A History of Amendments and Suspensions

The Computer Misuse and Cybercrimes Act has been subject to ongoing scrutiny and legal challenges since its enactment. In 2024, President William Ruto signed the Computer Misuse and Cybercrimes (Amendment) Act into law following protests led by Gen Z activists. These amendments were ostensibly aimed at addressing issues like terrorism, child exploitation, SIM-swap scams, and cyber fraud. However, the amendments themselves drew criticism for potentially expanding the scope of the law and further restricting online freedoms.

Prior to the Court of Appeal’s ruling, the High Court of Kenya had already suspended the implementation of Sections 27(1)(b), (c), and (2) of the Act, which deal with cyber harassment and false information. This earlier suspension came after challenges from organizations like the Kenya Human Rights Commission and Reuben Kigame, who argued those provisions were similarly vague and open to abuse. The government defended the law, asserting that the amendments were necessary to combat evolving cyber threats. Capital FM reports that the government’s rationale centered on the necessitate to address increasingly sophisticated online criminal activity.

Regional Implications and the Global Trend

Kenya’s experience with the Computer Misuse and Cybercrimes Act reflects a broader trend across Africa and globally, where governments are grappling with how to regulate online content without infringing on fundamental rights. Many countries have enacted or are considering similar legislation aimed at combating disinformation, hate speech, and cybercrime. However, these laws often face criticism from human rights organizations and digital rights advocates who argue they can be used to stifle dissent and suppress legitimate expression.

The African Union, for example, has been developing a Convention on Cybersecurity and Data Protection, which aims to harmonize cybersecurity laws across the continent. While proponents argue this is necessary to address the growing threat of cybercrime, critics worry it could lead to the adoption of overly restrictive laws that undermine freedom of expression. BAKE’s analysis highlights the importance of ensuring that any cybersecurity legislation adheres to international human rights standards.

The Constitutional Framework: Freedom of Expression in Kenya

The Kenyan Constitution, adopted in 2010, guarantees freedom of expression under Article 33 and freedom of the media under Article 34. However, these rights are not absolute and can be limited under Article 24, but only through a law that is demonstrably justified in a free and democratic society. The Court of Appeal’s ruling underscores the high bar for such limitations, emphasizing that any restrictions on freedom of expression must be clearly defined and narrowly tailored to achieve a legitimate aim. This aligns with international standards set by bodies like the United Nations Human Rights Committee, which has consistently emphasized the importance of protecting freedom of expression online.

What’s Confirmed and What Remains Unclear

Confirmed: Sections 22 and 23 of the Computer Misuse and Cybercrimes Act have been declared unconstitutional by the Court of Appeal. The ruling is binding and requires the immediate cessation of any prosecutions based on these sections. The court explicitly cited vagueness and the potential for criminalizing innocent individuals as the basis for its decision.

Unclear: The long-term impact of the ruling on Kenya’s cybersecurity landscape remains to be seen. It’s unclear whether the government will seek to amend the Act to address the court’s concerns or whether it will pursue alternative legislative approaches. The ruling does not affect other sections of the Act, and the government retains the authority to investigate and prosecute cybercrime under other provisions of the law. The extent to which the Office of the Director of Public Prosecutions will act on Mutemi’s call to discharge those already charged under the invalidated sections is also currently unknown.

Next Steps: Legislative Review and Potential Amendments

The immediate procedural step involves the dissemination of the Court of Appeal’s ruling to all relevant law enforcement agencies and judicial officials. The Attorney General’s office will likely review the judgment to advise the government on its implications and potential course of action. A legislative review of the Computer Misuse and Cybercrimes Act is now highly probable, with a focus on drafting provisions that are both effective in combating cybercrime and compliant with constitutional safeguards for freedom of expression. This process will likely involve consultations with stakeholders, including civil society organizations, the media, and technology companies. The Kenya Times reports that legal experts anticipate a period of uncertainty as the government navigates these complex issues.