Staff Reporter
Lesotho Communication Authority (LCA) has drawn a decisive line in the sand, asserting that consumers have an inherent right to privacy when it comes to their personal information held by mobile network operators.
This stern stance comes as a response to recent concerns surrounding the use of personal data by Econet Telecom Lesotho (ETL) and Vodacom Lesotho (VCL), prompting the LCA to publish its Consumer Protect Guidelines and Procedure in June of this year.
The guidelines emphatically stress that consumers are entitled to protection against unlawful use of their personal data and unwarranted communication or messages.
The document unequivocally declares: “Consumer’s information should not be disclosed to any third party without the consumer’s written consent or by order of a competent court of law or as required by law.â€
These guidelines surfaced in the wake of a Newsday report revealing that VCL Financial Services’ M-Pesa had been used as a surveillance tool.
This was after VCL Financial Services made a decision prohibiting deposits into M-Pesa account when the depositor’s phone is not in the immediate vicinity of an agent.
To enforce this decision, Newsday reported, VCL customers’ locations were tracked without their knowledge and consent and shared with VCL Financial Services.
M-Pesa arrived in Lesotho in July 2013 when VCL, ventured into the highly thriving and profitable business of mobile money.
In 2014, the parliament enacted the Payment Systems Act to make provision for the management of interbank systems, clearing houses, and securities settlement systems, and for related purposes.
In 2017, the Central Bank of Lesotho (CBL) promulgated the Payment Systems (Issuers of Electronic Payments Instruments) Regulations.
The objective of these regulations is to provide for the licensing and oversight of issuers of electronic payment instruments including the issuance of e-money as well as general provisions applying to e-money issuers.
Then in July 2021, VCL announced that M-Pesa would operate under a new company, VCL Financial Services – an independent company licensed by CBL as a financial services provider.
VCL Financial Services is wholly owned by VCL.
VCL said the decision to separate the businesses followed the CBL’s recommendation – a move it welcomed – to separate the M-Pesa business from the GSM business.
VCL Financial Services is licensed under the Payment Systems (Issuers of Electronic Payments Instruments) Regulations same regulations as a mobile money issuer.
“VCL Financial Services, through M-Pesa, is clearly in violation of people’s privacy and the acts of monitoring and accessing people’s locations in accessing service without any form of oversight whatsoever is a clear surveillance of the customers,†advocate Letuka Molati told Newsday in April this year.
Molati stressed that tracking people’s locations without their consent was flagrant surveillance, and thereby a violation of several laws including the Constitution.
Lesotho may not have surveillance law but citizen privacy is protected by the constitution of Lesotho’s section 11 (1) and the Data Protection Act of 2011’s sections 15 and 50.
CBL, as a regulator of VCL Financial Services, was expected to prevent surveillance of clients but allowed the practices to continue despite public outcry.
It was LCA, an independent regulatory body established in 2000, that ultimately stepped up to address the issue.
The LCA’s core responsibilities encompass licensing communication service providers, ensuring fair competition, tariff approval, and safeguarding consumer interests.
It said the aim of the guidelines is to facilitate the achievement of adequate protection of consumers of communications services in Lesotho by outlining the rights and obligations of the consumers and service providers, and prescribing complaints handling processes.
Newsday understands that VCL and its subsidiary, VCL Financial Services, have quietly reversed their decision to track the locations of the customers’ mobile phones.
