for early access to the latest igaming videos!
and get the latest igaming news first!
The Office of the Data Protection Commissioner (ODPC) has served a penalty notice to Milestone Games Limited, operating under the name SportPesa. This was due to a failure to comply with Kenya’s Data Protection Act (DPA) on the processing of personal data. This ruling follows a complaint from Lee Mutunga, who claimed that SportPesa failed to erase his personal data despite several requests tendered from 3rd to 25th April 2024.
Insights on the Kenya’s Data Protection Act
The Data Protection Act in Kenya governs how data is collected and handled within the country, ensuring the transparent processing of personal data. This regulation was enacted in 2019 in Article 31 of Kenya’s constitution. It is closely modeled after the European Union’s General Data Protection Regulation, using similar provisions, definitions, and requirements.
With this Act, data processors and controllers are mandated to only collect personal data from a data subject or a source the subject consents to, except it is contained in a public record. Even with consent, such personal data must not harm the interests of the supposed data subject.
Also, the ODPC is in charge of ensuring that businesses or parties involved in data collection operate in compliance with this law. The body can investigate complaints filed by subjects and make fair rulings based on the outcome of its investigation. Recently, SportPesa was found guilty of breaching the DPA’s provisions, and in light of this violation, the ODPC issued a penalty notice.
Investigation of SportPesa’s Violation
Lee Mutunga, a former SportPesa customer, requested that his account be deleted from the platform. However, he claimed that the website required some unnecessary personal details, such as his date of birth and ID number, to process the deletion. This complicated the process of erasing his personal information from the platform.
Following Mutunga’s complaint, the Office of the Data Protection Commissioner embarked on an extensive investigation and confirmed that SportPesa did not process the claimant’s data deletion request until over seven months later on 4th December 2024. Thus, the ruling declared the Office of the Data Protection Commissioner guilty, “the respondent is hereby found liable for violating the Complainant’s right to erasure.“
The Imposed Penalty
After finding SportPesa guilty, the ODPC ordered the company to compensate Mutunga with KES 350,000 (about $2,700) for the stress resulting from this violation. The sum is much less than KES 1,000,000, which the complainant had initially requested.
As part of this ruling, they recommend that SportPesa’s directors be prosecuted for shirking their duties. Both parties can appeal at the High Court, but within 30 days after this verdict. In the absence of an appeal, the fine must be settled, and the company’s directors must comply with the penalty provisions of the ODPC.
About SportPesa
SportPesa is a renowned online gaming platform in Kenya operated by Milestone Games Limited. This company was founded in 2014 and grew significantly to have a customer base of approximately 12 million bettors. It provides players with various gambling products, including sportsbooks, online casinos, and live betting.
Source: E-play Africa
