The Communications Authority of Kenya (CA) is proposing a centralised database that will list recycled mobile numbers to help banks, fintech firms and bulk-SMS providers verify number ownership before sending messages.
Under the proposal, telecommunications operators would submit lists of deactivated and recycled numbers to the regulator every three months, allowing third-party value-added service providers to query the database.
The CA said the database will ensure that third-party providers only send messages to the rightful owner and rejected a suggestion that subscribers notify contacts by SMS when numbers change ownership, calling such a practice a violation of the Data Protection Act.
The rules would also extend the period before a number can be recycled, making a line eligible for deactivation after three months of no revenue-generating activity and giving the subscriber a further three months to reactivate it.
Operators would be required to give thirty-day advance notice before deactivation and publish lists of numbers due for recycling on their websites, in national newspapers and other media.
Before reassigning a number, operators would need to delink or archive the previous subscriber’s personal data, and newly issued or recycled numbers would be excluded from marketing messages by default, with operators required to remove recycled numbers from existing business-to-consumer messaging services where the prior subscriber had opted in.
The proposal follows a High Court ruling that highlighted privacy risks of recycling inactive numbers, and it includes special protection for prisoners and remand detainees, with the Commissioner-General of Prisons facilitating exemptions for eligible inmates.
Businesses such as banks, savings and credit co-operatives, mobile-money providers and fintech firms may need to integrate verification checks into their systems, potentially incurring technical and operational costs, while telcos are expected to face compliance costs.
The centralised system mirrors the United States Federal Communications Commission’s Reassigned Numbers Database, and its effectiveness will depend on how reliably operators update the database and whether providers use it before sending sensitive communications.
