Betika Ordered to Pay a Kenyan Man Ksh250,000

Betting firm Betika Kenya has been ordered to pay KSh250,000 in compensation to a customer after unlawfully refusing to delete his betting account, in a landmark determination by the Office of the Data Protection Commissioner (ODPC).

The ruling follows a complaint filed by Bosco Otieno, who in June 2025 formally requested the permanent deletion of his Betika account.

According to the determination, the company declined to comply with the request unless Otieno submitted a copy of his national identity card and three months of M-Pesa statements, citing anti-money laundering (AML) obligations.

In its complaint, Otieno argued that the conditions imposed by Betika were unnecessary, intrusive, and amounted to an unlawful restriction of his statutory right to erasure under Kenyan data protection law.

“The Respondent unlawfully restricted his right to erasure and deletion by conditioning account deletion on the provision of his national ID and three months’ M-Pesa statements,” the determination states.

Excessive data demands faulted

While acknowledging that some level of verification may be justified, the ODPC drew a clear line on what constitutes reasonable data processing.

The Office ruled that “demanding an ID for verification was reasonable,” but found that the, “blanket demand for three months of financial statements was excessive, intrusive, and unnecessary for simply closing an account.”

The regulator held that Betika’s actions violated the principles of data minimization and purpose limitation as set out in the Data Protection Act, 2019.

These principles require that only data strictly necessary for a specific purpose be collected and processed.

“The Respondent failed to discharge its statutory obligations under Sections 25(d), 40(1)(b) and Section 26(e) of the Act,” the ODPC stated.

Also Read: Najib Razak Convicted Again as Court Delivers Fresh Blow in 1MDB Scandal

Constitutional right to privacy

In outlining the legal basis for its decision, the ODPC cited Article 31(c) and (d) of the Constitution of Kenya, which guarantees every person the right to privacy, including the right not to have information relating to their family or private affairs unnecessarily required or revealed.

The Office emphasized that the Data Protection Act was enacted to operationalize these constitutional guarantees and to regulate how personal data is processed by both public and private entities.

“This Office is mandated with the responsibility of regulating the processing of personal data and protecting the privacy of individuals,” the determination noted.

Also Read: JSC Fights Back After Court Ruling ‘Constrains’ Its Mandate on Judges

Enforcement notice issued

Beyond financial compensation, the Data Commissioner ordered that an enforcement notice be issued against Betika under Section 58 of the Act and Regulation 16 of the Enforcement Regulations.

The notice is intended to ensure future compliance with data protection principles.

“In so doing, this Office takes into account the nature and extent of violation with regard to the unlawful restriction imposed on the Complainant,” the ruling stated.

In the final determination dated September 25, 2025, Data Commissioner Immaculate Kassait declared Betika liable, ordered the payment of KSh250,000 to Otieno, and affirmed that both parties retain the right to appeal to the High Court within 30 days.

Follow our WhatsApp Channel and WhatsApp Community for instant news updates

Court gravel for illustration purposes. PHOTO/FILE