Betika to pay compensation after overstepping data boundaries
The company refused to close a player’s account unless he provided his national ID and three months of M-Pesa transaction statements.
Kenya.- Kenyan betting company Betika has been ordered to pay a compensation of KSh 250,000 (€1,650) to a player for demanding excessive financial records as a condition for deleting his account.
Bosco Otieno had been betting with Betika for six years without issues. However, when he decided to quit in June 2025, the company refused to close his account unless he provided his national ID and three months of M-Pesa transaction statements.
Viewing these demands as an invasion of his privacy, Otieno filed a complaint with the Office of the Data Protection Commissioner (ODPC), arguing that Betika’s request exceeded what was necessary for account closure and violated Kenya’s Data Protection Act of 2019, which grants users the right to request deletion of their data.
Otieno asserted: “The company’s request risked misuse of my financial information and went beyond what was necessary for account closure.”
However, defending its position, Betika cited the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) of 2009, which requires verification of identity and transaction sources to prevent fraud and money laundering. The company also referenced its privacy policy, which states users may need to provide additional documents when closing accounts.
The ODPC ruled that the company’s request for Otieno’s national ID complied with both POCAMLA and data protection laws, but demanding three months’ worth of M-Pesa statements was excessive and unjustified.
Data Commissioner Immaculate Kassait wrote: “In the present circumstances, while requiring the production of a national ID may be considered necessary and consistent with both POCAMLA and the Data Protection Act for purposes of verifying identity at account closure, the blanket demand for three months’ M-Pesa statements was disproportionate, unnecessary and inconsistent with the principle of data minimisation.”
She noted that those statements contain extensive personal details unrelated to closing the account, and with no signs of wrongdoing in Otieno’s betting history, Betika had no valid reason for requesting such information. The commissioner described Betika’s requests as “intrusive, unnecessary and disproportionate” and ordered the company to pay compensation and permanently delete Otieno’s data.
Betika has 30 days to file an appeal against the decision with Kenya’s High Court.
This ruling highlights Kenya’s commitment to protecting personal data and ensuring online businesses adhere to compliance regulations. In March 2025, the ODPC fined SportPesa for a major data breach.
