The High Court of Kenya has ruled that the indefinite retention of criminal records for individuals who were never convicted is unconstitutional.
The case, Patrick Kimathi v. Inspector General of Police & 5 Others (2026), highlights a critical intersection between national security and the fundamental right to privacy, specifically concerning data collected from minors.
The legal battle began when Patrick Kimathi challenged the National Police Service over the retention of his fingerprints, name, and demographic data. The data originated from a police case filed two decades ago when Kimathi was still a minor.
Despite the fact that the proceedings never resulted in a conviction, the stain of the arrest remained in the national criminal records register for 20 years. This administrative ghost followed Kimathi into adulthood, obstructing his ability to secure a clean Certificate of Good Conduct, a mandatory requirement for most employment and travel opportunities in Kenya.
Presiding Judge Justice H.M. Nyaga delivered a scathing critique of the current police record-keeping culture. The court held that storing sensitive biometric data without a clear, justifiable legal end-date violates several constitutional pillars:
- The Right to Dignity (Article 28): The court noted that a permanent record for a non-convicted individual imposes a “social stigma” that unfairly brands a citizen for life.
- The Right to Privacy (Article 31): Indefinite storage without proportionality is a breach of personal data protections.
- Fair Administrative Action (Article 47): The police’s failure to provide a mechanism for data review or deletion was deemed a failure of administrative justice.
Justice Nyaga ordered the immediate expungement of Kimathi’s data from the register and directed the authorities to issue him a clean Certificate of Good Conduct.
This ruling marks a significant shift in Kenyan jurisprudence, effectively introducing a Right to be Forgotten within the criminal justice context. Legal experts note that this decision forces the Directorate of Criminal Investigations (DCI) to rethink how it handles spent records or cases where charges were dropped.
Under the Data Protection Act (2019), data controllers are required to practice storage limitation, keeping data only for as long as is strictly necessary. The Kimathi ruling confirms that for the police, necessary does not mean forever, especially when the subject was a child at the time of the incident.
The judgment signals an urgent need for the Ministry of Interior and the Office of the Data Protection Commissioner (ODPC) to establish a clear legal framework for the review and deletion of criminal records.
- For Minors: The ruling sets a high bar for protecting children’s data, ensuring that mistakes made in youth do not result in a lifetime of exclusion.
- For the Public: Thousands of Kenyans currently “blacklisted” by the DCI for dismissed cases or acquittals may now have a legal pathway to clear their names.