The Directorate of Criminal Investigations (DCI) plays a crucial role in tackling crime in Kenya.

A key tool in their investigations is the use of call detail records (CDRs) from telecommunications companies.

However, accessing this private data is not a simple request; it is a process strictly governed by Kenyan law to balance security needs with the constitutional right to privacy.

The foundation of data privacy in Kenya is Article 31 of the Constitution, which guarantees every person the right to privacy, including the right not to have the privacy of their communications infringed.

This fundamental right ensures that state agencies cannot arbitrarily access personal information.

However, this right is not absolute.

The law provides for circumstances where it can be limited, such as for the prevention or detection of crime.

This limitation is only permissible through a clearly defined legal process that requires independent oversight.

The legal process

For the DCI to legally access an individual's call detail records, they must follow a formal procedure involving judicial approval.

Investigators cannot simply walk into a service provider's office and demand customer data.

The process is broken down into the following key steps.

Step 1: Formal application to the court

First, an investigating officer must make a formal application to a Magistrate's Court.

This is the official start of the legal request to obtain communication data.

Step 2: Justification via sworn affidavit

The application must be supported by a sworn affidavit, a written statement confirmed by oath.

In this document, the officer must provide specific and compelling reasons for the request.

They must demonstrate to the magistrate that there are reasonable grounds to believe a crime has been committed, is being committed, or is about to be committed.

The application must also prove that the specific call data requested is necessary and relevant to their investigation.

This is not a 'fishing expedition'; the request must be targeted to a specific phone number and a defined period.

Step 3: Judicial review and Order issuance

The magistrate’s role is to act as an impartial check on the DCI’s power.

The magistrate reviews the application to ensure it meets the legal threshold and is not an abuse of power or an unjustified violation of privacy.

If the magistrate is satisfied that the request is legitimate and necessary, they will issue a production order.

Step 4: Compliance by the service provider

The court order is a legal document compelling the telecommunications service provider to produce the specified records.

Read Also:President Ruto Spotted in Stylish Sh167,000 Cartier Luxury Sunglasses During Ethiopia Tour

Upon being served with a valid court order, the service provider is legally obligated to comply.

Their actions are governed by laws, including the Kenya Information and Communications Act and the Data Protection Act, 2019.

What do call records actually contain?

It is important to note that call detail records do not contain the content of conversations or messages.

Instead, they provide metadata, which includes:

• Numbers dialled and received from

• Duration and time of calls

• Location data derived from the cell towers used

The bottom line is, a judge must always be in the middle.

The law requires the DCI to get a court's permission before they can ask a telecommunications company for your call data.

This rule acts as a powerful shield, protecting your privacy from being looked into without a very good, legally-approved reason.