๐๐ก๐จ๐ฎ๐ฅ๐ ๐ฒ๐จ๐ฎ ๐ฌ๐ก๐จ๐ฐ ๐ฒ๐จ๐ฎ๐ซ ๐-๐๐๐ฌ๐ ๐ฆ๐๐ฌ๐ฌ๐๐ ๐ ๐๐จ๐ซ ๐ฉ๐๐ฒ๐ฆ๐๐ง๐ญ ๐ฏ๐๐ซ๐ข๐๐ข๐๐๐ญ๐ข๐จ๐ง?
Many Kenyans routinely show sellers their M-Pesa confirmation message after paying, and in crowded places such as matatus some even hand over the whole phone. Lawyers at Muri Mwaniki Thige Kageni LLP Advocates and Kageni LLP say this habit raises privacy and data protection concerns under the Constitution and that no Kenyan law compels a customer to display a private device or an M-Pesa message to a cashier, merchant, tout, or any other third party as proof of payment. Fridah Muriithi, an associate advocate at the firm, says payment verification is a commercial practice rather than a statutory requirement and that the Data Protection Act 2019 leans toward protecting customer privacy rather than giving merchants a right to inspect personal devices.
In this view, proof of payment sits with the merchant, not the customer. Muriithi says the merchantโs own confirmation, such as a receipt or a notification on the M-Pesa Till or Paybill system, is the primary evidence because every Lipa na M-Pesa transaction triggers a concurrent message to the merchantโs device or system. Once funds have reached the merchantโs Till or Paybill, the transaction is complete even if the customer does not display the SMS, and widespread social acceptance of showing messages does not create a legal obligation or remove a merchantโs duty to protect personal data.
The lawyers argue the confirmation SMS is not a neutral receipt because it contains personal data protected by law. Muriithi says it can include identifiers such as a customerโs name and phone number, financial details such as account balance, which she describes as sensitive personal data, and transaction information that can reveal spending habits. She adds that the transaction code is the only detail a merchant strictly needs and it already appears on the merchantโs own confirmation message, while Safaricom has taken steps to reduce exposure by masking customer names in line with the data minimisation principle. Under the Data Protection Act, she says asking to see the message generally amounts to processing personal data because processing can include consulting, using, or recording that information.
What are your thoughts? Do you agree with them?