Odibets Data Case: Kenya High Court Ruling Due May 13

In Short

• A Kenya High Court judgment is expected on May 13 in a case tied to alleged misuse of telecom subscriber data.
• A Directorate of Criminal Investigations (DCI) forensic report is cited as naming Odibets as a recipient of stolen personal data.
• The ruling could shape enforcement in Kenya’s betting sector, including possible criminal cases and licence action.

What Happened

A Kenya Insights report says Odibets is central to a High Court matter in Nairobi that could test how Kenya applies data protection and consumer protection expectations to betting firms.

The report cites a DCI forensic analysis of WhatsApp messages that allegedly documents repeated purchases of stolen Safaricom subscriber information. The report frames this as more than a single deal, it describes a multi-step commercial relationship.

The alleged theft dates back to 2018 and is described as affecting up to 29.9 million subscribers. The dataset described in court records reportedly included personal identifiers like names and ID numbers, device identifiers like IMEI numbers (a phone’s unique serial number), location details, and some M-Pesa activity references (mobile money account activity).

Kenya Insights also alleges that Betika and KwikBet were among firms that bought data to target bettors, including people considered vulnerable.

Why It Matters

If the court accepts the forensic findings and assigns liability, it raises the compliance bar for betting operators that use direct marketing and player targeting. That includes how they source customer lists and how they prove consent, meaning a user clearly agreed to be contacted.

For operators, the immediate risk is regulatory fallout. Kenya’s betting licences can be suspended or revoked, and a court finding can strengthen the case for criminal prosecution and follow-on civil claims.

More broadly, the case is a signal to telecoms, fintech providers, and advertisers that data sharing arrangements need auditable controls. That means clear permissions, data minimisation (only collecting what is needed), and strong vendor oversight to reduce exposure when insiders leak data.