Court of Appeal has declared Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, 2018, unconstitutional, striking down the two provisions that police and the Directorate of Criminal Investigations (DCI) have routinely deployed to arrest journalists, bloggers, and government critics accused of spreading false information online.
In a landmark judgment, a three-judge bench comprising Justices Kiage, Muchelule and Korir found that the two sections were vague, overbroad, and failed to meet the strict constitutional threshold required before a law may limit the right to freedom of expression.
The bench held that the provisions were open to abuse and could not be saved by the State’s justification that they were necessary to combat the spread of false information online.
Section 22 criminalised the publication of false, misleading or fictitious information, while Section 23, which was quietly inserted into the Bill at the Committee of the Whole House stage without fresh public participation, created the offence of publishing false information likely to cause panic, chaos, fear, alarm or despondency.
Both sections carried heavy penalties. Critics, including Article 19 East Africa, the Kenya Union of Journalists (KUJ), and the Law Society of Kenya (LSK), had long warned the provisions were tailor-made for silencing dissent.
“The use of subjective and undefined terms such as “false”, “misleading”, “panic”, “chaos” and “grossly offensive” delegates the definition of criminal conduct to the subjective discretion of individual police and judicial officers, resulting in legal uncertainty.”
Central to the court’s reasoning was the principle of legal certainty, that a criminal law must be formulated with sufficient precision to enable a citizen to foresee the consequences of their conduct.
The bench found that the impugned sections fell far short of this standard. Adopting the submissions of counsel for Article 19 East Africa, the court agreed that the failure to define terms such as false, misleading, panic, and alarm meant that the provisions effectively delegated the definition of criminal conduct to the subjective discretion of individual police and judicial officers, resulting in legal uncertainty, a constitutionally impermissible outcome.
The court further held that the provisions created an unconstitutional chilling effect on free speech. Counsel for the appellant, Ms. Mercy Mutemi, had argued that the sections would lead to prior restraint, which is in effect censorship that goes against the very purpose of Article 33 of the Constitution.
The bench agreed, finding that the breadth of the offences went beyond what was permissible under Article 33(2) of the Constitution, which contains an exhaustive list of the grounds upon which freedom of expression may be limited.
Critically, the court found that the State had failed to demonstrate that criminalisation was the least restrictive means of achieving its stated goal of combating harmful online content.
The bench pointed to existing civil remedies for defamation and to the National Cohesion and Integration Act, which already addresses hate speech,as less invasive alternatives.
The court noted that the burden under Article 24(3) of the Constitution rested squarely on the State to demonstrate to the court that the requirements of this Article have been satisfied, a burden it failed to discharge.
The fate of Section 23 was compounded by an additional procedural infirmity.
BAKE had argued that the provision was smuggled into the Bill during the Committee of the Whole House stage, bypassing the constitutional requirement for public participation under Articles 10 and 118 of the Constitution.
Although the court found the amendment not to be substantive enough to require fresh public participation on procedural grounds, it nonetheless declared the section unconstitutional on its merits for the same reasons as Section 22, vagueness, overbreadth, and disproportionate impact on free expression.
The ruling has immediate practical consequences for dozens of pending criminal cases in which suspects were charged under the two sections.
Since the Act came into force in 2018, the DCI has used Sections 22 and 23 to arrest and charge bloggers, social media users, and opposition figures accused of sharing content deemed false or alarmist by the State.
The court’s declaration that the provisions are void renders those charges legally untenable.
The court upheld the remainder of the Act’s contested provisions.
It found that sections creating offences of unauthorised computer access, cyber harassment, cybersquatting, child pornography, and wrongful distribution of intimate images were constitutional.
It also found that the Act’s investigative powers, including search and seizure, production orders, and real-time interception of data under court warrant, were proportionate and ringed with sufficient judicial safeguards, though it cautioned that overly broad or disproportionate use of the powers therein can easily violate constitutional rights.
The judgment is a significant victory for digital rights advocates in Kenya.
BAKE filed its original petition in May 2018, just days after the Act was signed into law, arguing it was a direct threat to online freedom of expression.
Seven years later, the Court of Appeal has vindicated the core of that concern.
The Kenya Union of Journalists welcomed the decision, saying it confirmed what journalists had experienced on the ground, that the two sections were instruments of intimidation rather than legitimate law enforcement tools.
