Thank you Nick for bringing this discussion here. I am a Software Engineer and I have implemented the M-Pesa API in several solutions to
automate payment and it worked like a charm. This is now not going to be so flawless with the data minimization strategies being implemented by Safaricom.
In my view, data minimization should be rethought, especially in API to API data sharing, as you have rightly pointed out. It is going to negatively impact user experience like in the Supermarket Loyalty Program which you highlighted, in which case a customer will have to be asked once more for their phone number after they have made their payment in order to get their Loyalty Points for the purchase made. Will this lead to longer queues in the supermarket?
Another example is when you send money to someone else via your bank application or online banking via web, some banks now require you to type the name of the person you are sending the money to, which can actually be shared by the M-Pesa API, making that process more challenging.
Safaricom should consider signing Data Protection Agreements with such organizations to ensure that they will use the data as per their terms of service and privacy policy to ensure protection compliance.
I am looking forward to reading other possible workarounds from other listers on this challenge.
