Safaricom PLC has declined to accept a Ksh 200 million compensation demand from a university student who was recently acquitted in a cybercrime case, setting the stage for a constitutional dispute over data privacy and the role of telecommunications companies in criminal investigations.
The dispute arises from a petition filed at the High Court in Nairobi by David Ooga Mokaya, a student at Moi University, who claims that his personal data was shared with law enforcement agencies without his consent, leading to his arrest, prosecution and prolonged trial.
Through his advocates, Danstan Omari & Associates, Mokaya contends that the disclosure of his mobile phone data violated his constitutional rights, including the right to privacy and protection of personal information.
He argues that the alleged breach of his data triggered criminal proceedings that could have been avoided.
Mokaya had been arrested in November 2024 over allegations that he published false information on the social media platform X, formerly Twitter, under the account “LANDLORD@bozgabi,” suggesting the death of President William Ruto.
He was subsequently charged in Milimani in Criminal Case No. MCCR/E1161/2024, but was acquitted on February 19, 2026 after the court found that the prosecution had not proved its case.
In its decision, the trial court raised concerns about the manner in which digital evidence had been obtained and handled during investigations, a factor that has now become central to Mokaya’s constitutional claim.
Following his acquittal, Mokaya moved to the High Court, arguing that the criminal case against him was built on data that was allegedly obtained and shared without his knowledge or approval.
He maintains that this resulted in significant personal, financial and academic hardship.
In a sworn affidavit, he states that the case disrupted his studies and forced him to travel frequently from Eldoret, where he is pursuing a Bachelor of Financial Economics, to Nairobi to attend court sessions.
He says the financial burden of the proceedings was borne by his family and well-wishers, despite already struggling with tuition obligations.
He further asserts that the alleged release of his personal data subjected him to an unnecessary criminal process, causing emotional distress and infringing on his constitutional rights.
As part of his petition, Mokaya is seeking a declaration that his rights were violated, compensation for the harm suffered, and orders to prevent the disclosure of personal data without consent or a lawful court order.
He has also asked the court to issue interim orders restraining Safaricom from sharing his call data or location data without proper legal authorization, pending the hearing and determination of the case.
Safaricom, however, has rejected the claims and denied any wrongdoing.
In a letter dated February 24, 2026 addressed to Mokaya’s lawyers, the company stated that it does not accept liability and pointed out that the criminal court did not make any finding of civil fault against it.
The telecommunications firm maintained that its actions were in line with formal requests from law enforcement agencies and that such cooperation should not be interpreted as a breach of constitutional rights.
It also dismissed the demand for compensation, stating that the request for Ksh 200 million was unacceptable and would not be entertained.
The company indicated that it is prepared to defend itself fully in any legal proceedings arising from the matter.
Mokaya’s legal team has urged the court to treat the case as urgent, arguing that it raises important constitutional questions about data protection and the safeguards required when personal information is shared with investigative agencies.
They contend that the matter goes beyond an individual dispute and has broader implications for the protection of citizens’ data, particularly in cases where digital evidence forms the basis of criminal charges.
The case is now expected to test the extent to which telecommunications companies can be held accountable for the disclosure of user data and whether stronger legal protections are needed to safeguard privacy in the digital age.
