Lesotho Communication Authority (LCA) has drawn a decisive line in the sand, asserting that consumers have an inherent right to privacy when it comes to their personal information held by mobile network operators.
This stern stance comes as a response to recent concerns surrounding the use of personal data by Econet Telecom Lesotho (ETL) and Vodacom Lesotho (VCL), prompting the LCA to publish its Consumer Protect Guidelines and Procedure in June of this year.
The guidelines emphatically stress that consumers are entitled to protection against unlawful use of their personal data and unwarranted communication or messages.
The document unequivocally declares: â€œConsumerâ€™s information should not be disclosed to any third party without the consumerâ€™s written consent or by order of a competent court of law or as required by law.â€
These guidelines surfaced in the wake of a Newsday report revealing that VCL Financial Servicesâ€™ M-Pesa had been used as a surveillance tool.
This was after VCL Financial Services made a decision prohibiting deposits into M-Pesa account when the depositorâ€™s phone is not in the immediate vicinity of an agent.
To enforce this decision, Newsday reported, VCL customersâ€™ locations were tracked without their knowledge and consent and shared with VCL Financial Services.
M-Pesa arrived in Lesotho in July 2013 when VCL, ventured into the highly thriving and profitable business of mobile money.
In 2014, the parliament enacted the Payment Systems Act to make provision for the management of interbank systems, clearing houses, and securities settlement systems, and for related purposes.
In 2017, the Central Bank of Lesotho (CBL) promulgated the Payment Systems (Issuers of Electronic Payments Instruments) Regulations.
The objective of these regulations is to provide for the licensing and oversight of issuers of electronic payment instruments including the issuance of e-money as well as general provisions applying to e-money issuers.
Then in July 2021, VCL announced that M-Pesa would operate under a new company, VCL Financial Services â€“ an independent company licensed by CBL as a financial services provider.
VCL Financial Services is wholly owned by VCL.
VCL said the decision to separate the businesses followed the CBLâ€™s recommendation â€“ a move it welcomed â€“ to separate the M-Pesa business from the GSM business.
VCL Financial Services is licensed under the Payment Systems (Issuers of Electronic Payments Instruments) Regulations same regulations as a mobile money issuer.
â€œVCL Financial Services, through M-Pesa, is clearly in violation of peopleâ€™s privacy and the acts of monitoring and accessing peopleâ€™s locations in accessing service without any form of oversight whatsoever is a clear surveillance of the customers,â€ advocate Letuka Molati told Newsday in April this year.
Molati stressed that tracking peopleâ€™s locations without their consent was flagrant surveillance, and thereby a violation of several laws including the Constitution.
Lesotho may not have surveillance law but citizen privacy is protected by the constitution of Lesothoâ€™s section 11 (1) and the Data Protection Act of 2011â€™s sections 15 and 50.
CBL, as a regulator of VCL Financial Services, was expected to prevent surveillance of clients but allowed the practices to continue despite public outcry.
It was LCA, an independent regulatory body established in 2000, that ultimately stepped up to address the issue.
The LCAâ€™s core responsibilities encompass licensing communication service providers, ensuring fair competition, tariff approval, and safeguarding consumer interests.
It said the aim of the guidelines is to facilitate the achievement of adequate protection of consumers of communications services in Lesotho by outlining the rights and obligations of the consumers and service providers, and prescribing complaints handling processes.
Newsday understands that VCL and its subsidiary, VCL Financial Services, have quietly reversed their decision to track the locations of the customersâ€™ mobile phones.