SportPesa faces the music after violating data privacy laws
In recent events, SportPesa, a renowned operator in Kenya operating under Milestone Games Limited, was served a penalty notice for violating data privacy laws and not complying with Kenya’s Data Protection Act (DPA) on the laws of processing personal data. This penalty was served by the Office of the Data Protection Commissioner after it was concluded that the company failed to erase the complaint’s data even after multiple requests.
The complaint and investigation
The case involves Lee Mutunga, a player, who claims that the defendants failed to attend to his data erasure requests. Lee Mutunga, from the 3rd to the 25th of April 2024, tried to initiate an account deletion procedure multiple times.
However, SportPesa insisted on taking more details from the user such as his ID number, date of birth, occupation, postal address, and physical address in a bid to cater to his request. These requests appeared to defeat the purpose of an account closure process proposed by SportPesa that initially simply involved an email confirmation.
The follow-up investigation by the ODPC found that, while SportPesa claimed email verification was enough to remove accounts, its website required a lot of personal data before complying with such requests. SportPesa only acted on Mutunga’s request after the ODPC’s intervention on December 4, 2024, over seven months after he initially tried to have his details removed. This postponement resulted in significant shortcomings on SportPesa’s part to complying with the Data Protection Act, thus creating doubt on the operator’s commitment to data protection.
Breach of data ethics
As the investigation went on, the Office of the Data Protection Commissioner (ODPC) found that SportPesa violated data privacy laws by not adhering to principle of data minimisation. By requesting an inordinate amount of personal data for the comparatively straightforward process of account cancellation, the business not only delayed a legitimate request but also diminished the privacy entitlements of its users.
Additionally, the results highlighted the company’s overall non-cooperative behaviour during the course of the investigation, particularly on a scheduled site visit on February 13, 2025.
In accordance with these findings, the ODPC ordered SportPesa to pay Mutunga KES 350,000 (approximately $2,700) for violating his right to erasure. This amount was far below the KES 1,000,000 (approximately $7,728) that he had originally demanded. Additionally, the ODPC recommended taking SportPesa’s directors to court for hindering the activities of the Data Commissioner, as provided under Section 61 of the Data Protection Act.
The implications of this ruling are a stark reminder of the legal and reputational risks that companies run if they do not take data protection law seriously. Businesses need to treat data privacy with the highest degree of seriousness, as partial compliance can have severe consequences.
Matters of player safeguarding
SportPesa’s case of violating data privacy laws presents a significant question of the effectiveness with which operators apply player protection measures, which comprise a fundamental duty in the gambling industry. Given that data privacy is a central aspect of user protection, the circumstances underlying this case reveal a troubling disparity between policy and practice.
If an established bookmaking operator is having issues fulfilling minimum data handling requirements, it speaks to the overall integrity of player protection measures across the industry. The stakes for the gambling industry go beyond transactions of money; they include aspects of consumer protection, safety, and mental welfare. Ineffectiveness in protecting user data implies a wider worry about how much player protection ranks among operators.
As more and more consumers continue betting online, having firm data privacy safeguards should be the very cornerstone of the industry rather than just another regulation. For the industry to foster trust and promote responsible gaming, it is essential that operators ensure that player protection goes beyond marketing rhetoric and is embedded in their core operational procedures.
Subscribe HERE to SiGMA’s Top 10 News countdown and SiGMA’s weekly newsletter to stay up to date with all the latest iGaming News from the world’s iGaming authority, and benefit from subscriber-only offers.
