How DCI gets your call data in Kenya

The Directorate of Criminal Investigations (DCI) plays a crucial role in tackling crime in Kenya.

A key tool in their investigations is the use of call detail records (CDRs) from telecommunications companies.

However, accessing this private data is not a simple request; it is a process strictly governed by Kenyan law to balance security needs with the constitutional right to privacy.

The foundation of data privacy in Kenya is Article 31 of the Constitution, which guarantees every person the right to privacy, including the right not to have the privacy of their communications infringed.

This fundamental right ensures that state agencies cannot arbitrarily access personal information.

However, this right is not absolute.

The law provides for circumstances where it can be limited, such as for the prevention or detection of crime.

This limitation is only permissible through a clearly defined legal process that requires independent oversight.

For the DCI to legally access an individual's call detail records, they must follow a formal procedure involving judicial approval.

Investigators cannot simply walk into a service provider's office and demand customer data.

The process is broken down into the following key steps.

First, an investigating officer must make a formal application to a Magistrate's Court.

This is the official start of the legal request to obtain communication data.

READ ALSO: DCI reveal how 26-year-old university dropout hacked betting firm & stole millions

The application must be supported by a sworn affidavit, a written statement confirmed by oath.

In this document, the officer must provide specific and compelling reasons for the request.

They must demonstrate to the magistrate that there are reasonable grounds to believe a crime has been committed, is being committed, or is about to be committed.

The application must also prove that the specific call data requested is necessary and relevant to their investigation.

This is not a 'fishing expedition'; the request must be targeted to a specific phone number and a defined period.

The magistrate’s role is to act as an impartial check on the DCI’s power.

The magistrate reviews the application to ensure it meets the legal threshold and is not an abuse of power or an unjustified violation of privacy.

If the magistrate is satisfied that the request is legitimate and necessary, they will issue a production order.

READ ALSO: DCI suffers cyber attack, launches probe to nab culprits

The court order is a legal document compelling the telecommunications service provider to produce the specified records.

Upon being served with a valid court order, the service provider is legally obligated to comply.

Their actions are governed by laws, including the Kenya Information and Communications Act and the Data Protection Act, 2019.

READ ALSO: Safaricom issues statement on data privacy amid abduction of Finance Bill protestors

It is important to note that call detail records do not contain the content of conversations or messages.

Instead, they provide metadata, which includes:

• Numbers dialled and received from

• Duration and time of calls

• Location data derived from the cell towers used

READ ALSO: Decoding NIS, DCI, NPS with Interior PS Raymond Omollo

The bottom line is, a judge must always be in the middle.

The law requires the DCI to get a court's permission before they can ask a telecommunications company for your call data.

This rule acts as a powerful shield, protecting your privacy from being looked into without a very good, legally-approved reason.