Communications Authority Dispels Fears Over New SIM Card Biometrics

The initial broad language had placed telecommunication providers, including Safaricom (the dominant market leader commanding a vast 65.1% of Kenyan SIM subscriptions) in a profoundly difficult position. The gazetted rules initially created a dual legal risk for the operators.

They faced the possibility of incurring hefty non-compliance penalties for failing to adhere to the new registration rules, including fines up to KES 1 million (approximately $7,700) or potential jail terms. Conversely, collecting overly sensitive data would risk violating the nation's stringent Data Protection Act, a law specifically structured to champion the principle of data minimization.

The regulator’s official explanation underscores the challenging balance faced by African governments as they strive to advance the digitalization of their economies. This ambitious goal must be pursued while simultaneously implementing robust, strict measures to counteract the growing threat of cybercrime and fraud.

The CA firmly argues that the reinforced registration rules are not punitive but are, in fact, essential instruments for combating pervasive issues. These include identity theft and sophisticated "SIM box" scams, fraudulent activities that severely compromise the security and integrity of Kenya's widely successful mobile money ecosystem. The regulator's goal is to ensure the integrity of the registration database remains a solid foundation for digital trust.

While the regulator's assurances are intended to calm the waters, the initial inclusion of physiological traits in the regulatory text continues to concern privacy legal experts. They contend that codifying such expansive definitions in law, even without current intent to use them, establishes a legal framework for future overreach, setting a worrying precedent for any future administration seeking more intrusive data collection powers.