)
)
The Directorate of Criminal Investigations (DCI) plays a crucial role in tackling crime in Kenya.
A key tool in their investigations is the use of call detail records (CDRs) from telecommunications companies.
However, accessing this private data is not a simple request; it is a process strictly governed by Kenyan law to balance security needs with the constitutional right to privacy.
The foundation of data privacy in Kenya is Article 31 of the Constitution, which guarantees every person the right to privacy, including the right not to have the privacy of their communications infringed.
This fundamental right ensures that state agencies cannot arbitrarily access personal information.
However, this right is not absolute.
The law provides for circumstances where it can be limited, such as for the prevention or detection of crime.
This limitation is only permissible through a clearly defined legal process that requires independent oversight.
The legal process
For the DCI to legally access an individual's call detail records, they must follow a formal procedure involving judicial approval.
Investigators must follow a formal procedure involving judicial approval.
Investigators cannot simply walk into a service provider's office and demand customer data.
The process is broken down into the following key steps.
Step 1: Formal application to the court
First, an investigating officer must make a formal application to a Magistrate's Court.
This is the official start of the legal request to obtain communication data.
READ ALSO: DCI reveal how 26-year-old university dropout hacked betting firm & stole millions
Step 2: Justification via sworn affidavit
The application must be supported by a sworn affidavit, a written statement confirmed by oath.
In this document, the officer must provide specific and compelling reasons for the request.
They must demonstrate to the magistrate that there are reasonable grounds to believe a crime has been committed, is being committed, or is about to be committed.
The application must also prove that the specific call data requested is necessary and relevant to their investigation.
This is not a 'fishing expedition'; the request must be targeted to a specific phone number and a defined period.
Step 3: Judicial review and Order issuance
The magistrate’s role is to act as an impartial check on the DCI’s power.
The magistrate reviews the application to ensure it meets the legal threshold and is not an abuse of power or an unjustified violation of privacy.
If the magistrate is satisfied that the request is legitimate and necessary, they will issue a production order.
READ ALSO: DCI suffers cyber attack, launches probe to nab culprits
Step 4: Compliance by the service provider
The court order is a legal document compelling the telecommunications service provider to produce the specified records.
Upon being served with a valid court order, the service provider is legally obligated to comply.
Their actions are governed by laws, including the Kenya Information and Communications Act and the Data Protection Act, 2019.
READ ALSO: Safaricom issues statement on data privacy amid abduction of Finance Bill protestors
What do call records actually contain?
)
Directorate of Criminal Investigations (DCI) Headquarters
It is important to note that call detail records do not contain the content of conversations or messages.
Instead, they provide metadata, which includes:
Numbers dialled and received from
Duration and time of calls
Location data derived from the cell towers used
READ ALSO: Decoding NIS, DCI, NPS with Interior PS Raymond Omollo
The bottom line is, a judge must always be in the middle.
The law requires the DCI to get a court's permission before they can ask a telecommunications company for your call data.
This rule acts as a powerful shield, protecting your privacy from being looked into without a very good, legally-approved reason.