Kenyan High Court Strikes Down Key Cybercrime Law Provisions, Upholding Digital Freedoms
In a significant victory for digital rights and constitutional freedoms, Kenya’s High Court has declared unconstitutional critical sections of the Computer Misuse and Cybercrimes (Amendment) Act, 2025. The ruling, delivered on July 3, 2026, nullifies provisions that empowered a state committee to block websites and online platforms without judicial oversight, thereby safeguarding freedom of expression and media freedom.
The landmark judgment by Justice Patricia Mande specifically struck down Section 6(1)(j)(a) of the Act. The court found that this provision unlawfully expanded the mandate of the National Computer and Cybercrimes Coordination Committee and infringed upon fundamental constitutional guarantees, including freedom of expression, media freedom, and freedom of religion. The contested section had authorised the committee to direct internet service providers to restrict access to digital content deemed to be associated with terrorism, violent extremism, child sexual exploitation, and other illicit activities.
The High Court’s ruling underscored that the law improperly delegated the authority to determine objectionable online content and enforce restrictions to an administrative body, bypassing essential independent judicial scrutiny. Justice Mande articulated that this effectively instituted prior censorship, a severe limitation on freedom of expression, and lacked adequate safeguards against potential abuses of power. The absence of clear procedures, evidentiary standards, and oversight mechanisms before website blocking could be implemented raised significant concerns about arbitrary enforcement.
While the State contended that court supervision could be inferred from the broader legal framework, the court rejected this argument. Justice Mande pointed out that Parliament had explicitly mandated judicial involvement in other enforcement provisions within the same legislation, indicating that the omission in the contested section was deliberate, granting the committee independent powers. Furthermore, the government failed to demonstrate how the limitation of constitutional rights under Article 24 of the Constitution—requiring restrictions on fundamental freedoms to be lawful, reasonable, proportionate, and justifiable in an open and democratic society—was met. The court warned that allowing state agencies to block online platforms without judicial approval could foster a chilling effect on digital discourse, leading to self-censorship among users, media organisations, and online publishers fearing potential sanctions.
In a parallel decision, the court also invalidated Section 27(1)(b) of the amended law, which criminalised communication deemed likely to cause another person to commit suicide. Justice Mande ruled this provision unconstitutional due to its vagueness and overbreadth, failing to clearly define the conduct subject to criminal liability. The judge emphasised that imposing criminal sanctions based on communication merely considered “likely” to result in suicide relied on speculative and subjective standards, contravening the constitutional principle that criminal offences must be clearly defined by law.
The consolidated petitions were partially successful, with the court striking down the provisions concerning website blocking without court orders and the criminalisation of communication likely to lead to suicide. However, the court dismissed challenges to the legislative process itself, finding that the National Assembly had conducted sufficient public participation and that Senate approval was not required as the legislation did not directly pertain to county governments. The remaining sections of the amended cybercrimes law were left intact. This ruling has significant implications for legal practitioners, compliance officers, and corporate executives navigating the evolving landscape of digital regulation and freedom of expression in Kenya.
