By Andrew Kariuki
The Court of Appeal has declared two provisions of the Computer Misuse and Cybercrimes Act, 2018 unconstitutional while upholding the rest of the law, in a significant ruling on the regulation of online conduct in Kenya.
In a judgment delivered by a three-judge bench comprising Patrick O. Kiage, Asike-Makhandia O. Muchelule and William Korir, the court ruled that Sections 22 and 23 of the Act are unconstitutional because they are overly broad and could potentially criminalise innocent conduct.
Sections 22 and 23 of the law criminalise the intentional publication of false or misleading information.
Section 22 makes it an offence to knowingly publish false or misleading data intended to be treated as genuine. The provision limits freedom of expression where such information could promote war, incite violence, amount to hate speech, spread ethnic hatred or discrimination, or harm the rights and reputation of others.
Under the law, offenders could face a fine of up to Ksh5 million, imprisonment for up to two years, or both.
Section 23, on the other hand, criminalises knowingly publishing false information likely to cause panic, chaos, violence, or damage a person’s reputation, with penalties of a fine of up to Ksh5 million, imprisonment for up to 10 years, or both.
The case arose from an appeal filed by the Bloggers Association of Kenya (BAKE), which challenged a 2020 High Court ruling by James Makau that had upheld the constitutionality of the law.
BAKE had asked the court to declare several sections of the Computer Misuse and Cybercrimes Act unconstitutional, arguing that they violated constitutional rights including freedom of expression, privacy, and the right to a fair trial.
However, the Court of Appeal largely agreed with the High Court and found that most provisions of the law were constitutional and justified under Article 24 of the Constitution, which allows limitation of certain rights where necessary.
“The intention of section 27 is clear. It is aimed at addressing harmful conduct occasioning harassment through an internet-enabled platform, which the legislature had the mandate to address,” the judges stated.
The court affirmed that Parliament has the authority to create criminal offences regulating conduct in cyberspace in order to protect the public from online harassment, fraud and other digital harms.
The judges emphasised that digital spaces must remain subject to the rule of law.
“Cyberspace cannot be a law-free environment, a virtual jungle or wild west devoid of criminal sanctions essential to deter its abuse,” the bench stated.
The court also dismissed BAKE’s challenge to Section 28 of the Act, which criminalises cybersquatting, ruling that the provision legitimately protects intellectual property rights and consumer trust in the digital economy.
According to the judges, cybersquatting undermines trust in digital commerce and therefore does not merit constitutional protection.
However, the court concluded that Sections 22 and 23 were too broadly drafted, raising the risk that innocent individuals could be caught within their scope.
“In the end, this appeal partially succeeds to the extent that we find sections 22 and 23 of the Act unconstitutional for being too broad to the extent that they are likely to net innocent persons,” the judges ruled.
Apart from that finding, all other grounds of appeal were dismissed.
The appellate court also issued guidance to courts and investigative agencies implementing the law, cautioning that surveillance and interception powers must be exercised carefully.
Judges and investigators were advised to clearly specify the offence under investigation, the duration of interception, and how the collected data will be examined, stored and eventually destroyed.
The bench further warned that the law could be misused for political purposes if not applied cautiously.
“Courts must be alive and alert to the risk that the Act can be deployed for political purposes and must carefully scrutinise every application before granting any order,” the judges said.
