High Court Halts Enforcement of Controversial Cybercrime Law Over Rights Concerns

The High Court has temporarily suspended the enforcement of the newly amended Computer Misuse and Cybercrimes Act, 2025, halting a key section that criminalizes cyber harassment. The ruling comes amid growing debate over the law’s impact on freedom of expression and data privacy in Kenya’s digital space.

Justice Lawrence Mugambi of the Milimani Law Courts issued the conservatory orders on Wednesday, October 22, freezing the implementation of Section 27 of the Act, pending the full hearing of a petition filed by the Kenya Human Rights Commission (KHRC) and former presidential aspirant Reuben Kigame.

In his ruling, Justice Mugambi directed that the temporary order remains in place until the court determines whether the disputed provisions violate constitutional guarantees. “Pending the hearing and determination of this application, a conservatory order is hereby issued suspending the enforcement, implementation and operation of Section 27(1)(b), (c) and (2) of the Computer Misuse and Cybercrimes (Amendment) Act, 2025,” the judge stated.

The petitioners contend that the amendments signed into law by President William Ruto on October 15 are unconstitutional, arguing that they contain vague and overly broad clauses that criminalize legitimate online speech and undermine the Data Protection Act of 2019.

Among the contested provisions is Section 27, which expands the definition of cyber harassment and prescribes penalties of up to Ksh.20 million in fines or 10 years in prison. The KHRC and Kigame argue that such provisions could be misused to silence critics and stifle digital activism.

The Act, part of eight bills assented to by the President shortly before the announcement of former Prime Minister Raila Odinga’s death, has sparked national concern over the timing and intent of the legislation.

Beyond cyber harassment, the amendments also tighten regulations on phishing and SIM-swap fraud. Offenders found guilty of phishing – using fake websites or deceptive messages to steal personal data -face fines of up to Ksh.300,000 or imprisonment for three years.

Similarly, unauthorized SIM swaps could attract penalties of up to Ksh.200,000 or two years in jail.

The case is now set for a full hearing, marking a key moment in Kenya’s ongoing debate over digital rights, privacy and online freedom.