MasiboLaw

The Office of the Data Protection Commissioner (ODPC) has ruled against Milestone Games Limited t/a SportPesa for violating Kenya’s Data Protection Act, 2019. This ruling marks a significant precedent in enforcing data privacy rights in Kenya. If you’ve ever had a company misuse your data, this case proves that you have legal rights—and that businesses must be held accountable.

Here’s what happened and what it means for you.

The Complaint: Did SportPesa Violate Data Privacy Laws?

The case was initiated by LM (full name withheld for privacy), a SportPesa customer, who complained to the ODPC. He alleged that:

✅ SportPesa refused to delete his account unless he provided additional personal data.

✅ The company demanded irrelevant details, including his ID, date of birth, occupation, and physical address, without explaining why these were necessary.

✅ SportPesa failed to honour his right to data erasure, a key protection under the Data Protection Act, 2019.

✅ When the ODPC tried to investigate, SportPesa obstructed the process by refusing to allow regulatory officers access to its premises.

What the Law Says About Data Erasure

The Data Protection Act, 2019 grants Kenyan citizens specific rights over their data. Some key provisions include:

🔹 Right to Erasure (Section 40 (1)(b)) – A person can request a company to delete their data if it is no longer necessary.

🔹 Data Minimization Principle (Section 25(d)) – A company should only collect data that is relevant and necessary for its stated purpose.

🔹 Obstruction of Investigation (Section 61(c)) – Blocking a data protection investigation is illegal and punishable.

SportPesa’s demand for irrelevant personal details before deleting an account was a clear violation of these legal provisions.

The ODPC’s Ruling: SportPesa Found Guilty

After reviewing the evidence, the ODPC determined that SportPesa violated the complainant’s right to data erasure.

The official ruling stated that:

📌 SportPesa’s refusal to delete the account without additional personal details was unlawful.

📌 The company failed to comply with the Data Protection Act, making it liable for data privacy violations.

📌 SportPesa obstructed an ODPC investigation, worsening its legal position.

📌 The company was ordered to compensate the complainant with KES 350,000 for breaching his privacy rights.

To read the full decision, access the ODPC’s determination here

What This Means for You

This case sets a strong precedent in data protection law in Kenya.

For Individuals: Protect Your Data Privacy Rights

Many Kenyans unknowingly give businesses access to their private data without understanding their rights. This case shows that:

✔ You have the right to request deletion of your data from any company.

✔ No company should demand irrelevant personal information as a condition for account deletion.

✔ If your data is misused, you can take legal action and seek compensation.

If you believe a company is violating your privacy rights, you can enforce your rights by filing a claim.

For Businesses: Compliance is Now a Legal Obligation

Companies handling personal data must comply with the Data Protection Act, 2019 or risk fines, legal battles, and reputational damage.

To avoid such legal risks, businesses should:

✔ Implement clear data deletion policies in compliance with the law.

✔ Only collect and store data that is necessary for business operations.

✔ Cooperate with the ODPC to avoid penalties for non-compliance.

Need a Data Protection Lawyer in Kenya?

If your data has been misused, or if you need expert legal guidance on data protection compliance, we’re here to help.

How a Data Protection Lawyer Can Assist You:

📌 Filing a complaint with the ODPC on your behalf.

📌 Taking legal action against businesses violating your rights.

📌 Ensuring businesses comply with Kenya’s data protection laws.

📌 Negotiating compensation if your personal data has been misused.

Take Action Today!

If you believe your personal data has been misused or need expert legal advice on data protection compliance, we’re here to help.

📩 Email us at info@masibolaw.co.ke for a consultation with an experienced data protection lawyer in Kenya.