How 'fatal flaw' could nullify Cybercrime Act amendments, according to Kigame's petition

A new petition led by musician Reuben Kigame argues that Kenya's controversial 2024 cybercrime amendment was passed illegally, citing a 'fatal procedural defect' that could see it nullified.

The law, which targets 'mischievous' information, cyberharassment and spreading of 'false' news is being challenged as an unconstitutional breach of privacy and free speech.

The Kigame petition claims the 2024 amendment was passed illegally and that its provisions violate fundamental rights to privacy and free expression guaranteed in the Constitution.

A 'fatal procedural defect' in how it was passed

The petition's central argument is that the entire law is invalid because of the process through which it was passed.

The petitioners claim the National Assembly flouted the Constitution by failing to involve the Senate in the legislative process.

According to the petition, the 2024 Amendment Act contains provisions that affect the functions of county governments.

Under Article 110(1) of the Constitution, any bill that concerns county governments must be considered by both the National Assembly and the Senate.

The legal filing argues two specific failures occurred:

1. The National Assembly allegedly failed to refer the Bill to the Senate Speaker, which is required by Article 110(3) of the Constitution.

2. The Bill was never transmitted to the Senate for its participation, which the petition states is a direct contravention of Article 110(4).

The petitioners describe this exclusion of the Senate as a 'fatal procedural defect that vitiates the entire enactment', or, in short, invalidates the entire Computer Misuse and Cyber Crime Amendment bill of 2024, now signed into law.

If the court agrees with this single procedural argument, the law could be nullified without the court even considering its other controversial contents.

Dismiss on substantive grounds: Privacy and free speech

Beyond the procedural flaw, the petition attacks the specific content of the law, arguing it directly undermines the rights of Kenyans and creates unconstitutional conflicts with other existing laws.

1. 'Severe infringement' on privacy

The petition challenges a provision in the law for 'Mandatory Verification of Social Media Accounts,' which it claims forces all users to link their online identities to their government-issued legal names.

This, the petitioners argue, is a severe, blanket infringement of the right to privacy under Article 31 of the Constitution.

Furthermore, the petition argues that this mandate fundamentally dilutes Kenya's Data Protection Act (DPA).

It claims the new law violates core DPA principles, including:

• Data Minimisation: The petition states that a legal name is not necessary for the purpose of using a social media platform and violates Section 27 of the DPA, which limits data collection to only what is necessary.

• Lawfulness and Fairness: It claims the law makes the processing of a sensitive identifier (a legal name) a compulsory condition for accessing a service, violating the principle of Lawfulness and Fairness under Section 25 of the DPA.

The challenge also notes that the new law undermines the role of the Data Commissioner, who is listed an interested party in the case.

2. 'Severe chilling effect' on free expression

The Kigame petition directly targets the Act's criminalisation of 'false, misleading, and mischievous' information.

It argues this phrase is 'impermissibly vague' and 'creates a severe chilling effect,' violating Article 33 (Freedom of Expression) and Article 34 (Freedom of the Media).

The petition claims that by forcing digital platforms to engage in rapid takedowns, the law amounts to 'state-induced prior restraint'.

3. 'Unworkably vague' clauses

The petition also challenges an amendment to Section 27 of the principal Act, which deals with communications that allegedly cause another person to commit suicide.

The filing argues this provision is 'unconstitutionally vague' and 'unworkably speculative' because it 'fails to establish any objective criteria'.

It claims the law provides no standard to determine criminal liability, such as the speaker's intent, the immediacy of the threat, or the recipient's vulnerability.

Who is challenging the Act?

The legal challenge is fronted by Reuben Kigame Lichete, musician, politician and human rights defender, and the Kenya Human Rights Commission (KHRC).

They are joined by a list of interested parties representing key sectors, including:

1. The Kenya Union of Journalists (KUJ)

2. The Media Council of Kenya (MCK)

3. The Law Society of Kenya (LSK)

4. The Data Protection Commissioner

The petitioners have sued the Attorney General and the Speaker of the National Assembly.

What the petitioners want

The petition asks the High Court at Milimani to issue several declarations, including that the Computer Misuse and Cybercrimes (Amendment) Act, 2024, is 'inconsistent' with the Constitution and is therefore 'null and void'.

They also seek a 'permanent order of prohibition' to restrain the government from 'implementing or enforcing' the controversial provisions.