[kictanet] SIM CARD REGISTRATION & DATA PROTECTION ACT, 2019

Barrack Otieno otieno.barrack at gmail.com
Thu Mar 17 11:07:16 EAT 2022


@Benson Muite <benson_muite at emailplus.org>
Kenyan Telcos have already moved in this direction.

Thank you

Best Regards

On Thu, Mar 17, 2022 at 10:39 AM Benson Muite via KICTANet <
kictanet at lists.kictanet.or.ke> wrote:

> It is interesting to observe that MTN is re-branding to become a
> data/technology company  - full details are unclear, but it maybe
> something that other telecommunications companies in Africa may also do.
> Anti-trust regulations have had an interesting history in the USA, for
> example [1] and [2].
>
> [1] https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp.
> [2] https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System
> On 3/16/22 11:25 PM, kanini mutemi via KICTANet wrote:
> > @Mwendwa Kivuva <mailto:Lordmwesh at gmail.com> Let us not conflate
> issues.
> > ALWAYS treat mobile banking (and banking in general) quite separate from
> > other services offered by MNOs. A practical problem- @James Mbugua was
> > right on data minimization (I would add necessity as well) disqualifying
> > the current directive by CA. If you speak of harmonization of
> > regulations, you can no longer rely on minimization and necessity
> > because a need (banking) has been created. While all these things begin
> > with a SIM Card registration, MPESA requires a further positive step of
> > registration. At that point, we can safely speak of harmonization and
> > requiring more information to prevent financial crimes etc. Different
> > products, different markets.
> >
> > Are we sure CA is the source of the photos directive? (Kindly share the
> > directive if you have access to it). The Regulations only allow this
> > information to be collected during SIM Card registration-
> >
> > 5 (1) A person who intends to register a SIM-card shall provide the
> > following particulars to the telecommunications operator or agent—
> >
> > (a)
> >
> > full names;
> >
> > (b)
> >
> > identity card, service card, passport or alien card number;
> >
> > (c)
> >
> > date of birth;
> >
> > (d)
> >
> > gender;
> >
> > (e)
> >
> > physical address;
> >
> > (f)
> >
> > postal address, where available;
> >
> > (g)
> >
> > any other registered subscriber number associated with the subscriber;
> >
> > (h)
> >
> > an original and a copy of the national identity card, service card,
> > passport or alien card;
> >
> > (i)
> >
> > an original and a copy of the birth certificate, in respect of
> > registration of minors;
> >
> > (j)
> >
> > subscriber number in respect to existing subscribers;
> >
> > (k)
> >
> > an original and true copy of the certificate of registration, where
> > relevant;
> >
> > (l)
> >
> > a letter duly sealed by the chief executive officer or the person
> > responsible for the day to day management of the statutory body.
> >
> >
> > (while your ID would normally have a photo- it is vastly different from
> > a digital photo which can become part of a biometric register).
> >
> >
> > I cannot insist on this enough, a SIM Card registration is not the same
> > thing as MPESA (or other mobile money platform registration). The
> > requirements for SIM Card registration have to remain as basal as
> possible.
> >
> >
> > On Wed, Mar 16, 2022 at 9:33 PM Mwendwa Kivuva via KICTANet
> > <kictanet at lists.kictanet.or.ke <mailto:kictanet at lists.kictanet.or.ke>>
> > wrote:
> >
> >     Since SIM card data is used by a large section of the population for
> >     mobile banking (Safaricom has 30 million mobile money customers) -
> >     and banking regulations require a photo ID, should the regulation be
> >     harmonised for all mobile money customers to provide their photo ID?
> >
> >     KICTANet had a Thought Leadership Forum with the ODPC, and the
> >     question of DPIA came up. I can't remember the response. The
> >     recording of the forum is available here
> >     https://youtu.be/Rmdvoc8Valo <https://youtu.be/Rmdvoc8Valo>
> >
> >     On Wed, 16 Mar 2022, 16:04 James Mbugua via KICTANet,
> >     <kictanet at lists.kictanet.or.ke
> >     <mailto:kictanet at lists.kictanet.or.ke>> wrote:
> >
> >         Listers,
> >
> >         I am not sure if I am being paranoid but the SIM card
> >         re-registration order ostensibly by CA (Communications
> >         Authority) and which has mobile operators asking us to
> >         te-register our SIM cards by April or risk being deregistered,
> >         seems like regulatory overreach.
> >
> >         CA says under the SIM Registrations regulations of 2015, MNOs
> >         are required to update their registers with details including ID
> >         documents and photo IDs. The reason given, ostensibly, is that
> >         many had their SIM details registered before that law came into
> >         place.
> >
> >         Speaking of laws coming into operation, the Data Protection Act,
> >         itself came into effect in 2019. Significantly long after the
> >         said regulations.
> >
> >         In seeking to protect privacy and personal data, the DPA
> >         requires Data Minimisation where personal data collected should
> be:
> >         "adequate, relevant and limited to what is necessary in relation
> >         to the purposes for which they are processed (‘data
> >         minimisation’);" Sec. 25(d) DPA, 2019
> >
> >         This means that data that the controller does not really need to
> >         achieve a specific purpose, should not be collected.
> >
> >         Biometric information such as Passport Photos that the Operators
> >         will take and store,for example, are in my opinion, surplus to
> >         requirements.
> >
> >         The identification of the subscriber can be done without
> >         collection of intrusive biometric data for example by using
> >         national IDs. CA explicitly asks that the operators verify
> >         details with the Integrated Personnel Registry System. so
> >         collection of biometric data to me is disproportionate and
> >         cannot meet the threshold of lawful basis.
> >
> >         Being the later law, and by the Huduma Number case precedent,
> >         the data minimisation provisions of the DPA, 2019 in my opinion
> >         hold primacy and in fact impliedly, repeal or render unlawful,
> >         the requirements for photo taking for SIM registration in the
> >         2015 regulations.
> >
> >         2. Data Protection Impact Assessment.
> >
> >         Another question I would have for the CA, the Data Commissioner
> >         and mobile operators, is if, as per the precedent sent by
> >         Justice Ngaah in the Katiba Institute v. MoICT & others
> >         regarding the need for the conduct of a Data Processing Impact
> >         Assessment, has been carried out in this instance when CA
> >         proposes to have collected the data of more than 30 million
> >         subscribers including biometric data.
> >
> >         I think this is a plain case of flouting judicial guidance viz a
> >         viz when DPIAs should be carried out and CA should have had this
> >         carried out first before issuing the said directive.
> >
> >         Regards,
> >
> >         James G. Mbugua
> >         Data Privacy Consultant & Tech Policy Blogger
> >         @jgmbugua <mailto:jgmbugua at gmail.com>
> >
> >
> >
> >         _______________________________________________
> >         KICTANet mailing list
> >         KICTANet at lists.kictanet.or.ke <mailto:
> KICTANet at lists.kictanet.or.ke>
> >         https://lists.kictanet.or.ke/mailman/listinfo/kictanet
> >         <https://lists.kictanet.or.ke/mailman/listinfo/kictanet>
> >         Twitter: http://twitter.com/kictanet <
> http://twitter.com/kictanet>
> >         Facebook: https://www.facebook.com/KICTANet/
> >         <https://www.facebook.com/KICTANet/>
> >
> >         Unsubscribe or change your options at
> >
> https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com
> >         <
> https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com
> >
> >
> >
> >         KICTANet is a multi-stakeholder Think Tank for people and
> >         institutions interested and involved in ICT policy and
> >         regulation. KICTANet is a catalyst for reform in the Information
> >         and Communication Technology sector. Its work is guided by four
> >         pillars of Policy Advocacy, Capacity Building, Research, and
> >         Stakeholder Engagement.
> >
> >         KICTANetiquette : Adhere to the same standards of acceptable
> >         behaviors online that you follow in real life: respect people's
> >         times and bandwidth, share knowledge, don't flame or abuse or
> >         personalize, respect privacy, do not spam, do not market your
> >         wares or qualifications.
> >
> >         KICTANet - The Power of Communities, is Kenya's premier ICT
> >         policy engagement platform.
> >
> >     _______________________________________________
> >     KICTANet mailing list
> >     KICTANet at lists.kictanet.or.ke <mailto:KICTANet at lists.kictanet.or.ke>
> >     https://lists.kictanet.or.ke/mailman/listinfo/kictanet
> >     <https://lists.kictanet.or.ke/mailman/listinfo/kictanet>
> >     Twitter: http://twitter.com/kictanet <http://twitter.com/kictanet>
> >     Facebook: https://www.facebook.com/KICTANet/
> >     <https://www.facebook.com/KICTANet/>
> >
> >     Unsubscribe or change your options at
> >
> https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com
> >     <
> https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com
> >
> >
> >
> >     KICTANet is a multi-stakeholder Think Tank for people and
> >     institutions interested and involved in ICT policy and regulation.
> >     KICTANet is a catalyst for reform in the Information and
> >     Communication Technology sector. Its work is guided by four pillars
> >     of Policy Advocacy, Capacity Building, Research, and Stakeholder
> >     Engagement.
> >
> >     KICTANetiquette : Adhere to the same standards of acceptable
> >     behaviors online that you follow in real life: respect people's
> >     times and bandwidth, share knowledge, don't flame or abuse or
> >     personalize, respect privacy, do not spam, do not market your wares
> >     or qualifications.
> >
> >     KICTANet - The Power of Communities, is Kenya's premier ICT policy
> >     engagement platform.
> >
> >
> >
> > --
> > *Mercy Mutemi, Advocate*.
> >
> > */
> > /*
> >
> >
> > _______________________________________________
> > KICTANet mailing list
> > KICTANet at lists.kictanet.or.ke
> > https://lists.kictanet.or.ke/mailman/listinfo/kictanet
> > Twitter: http://twitter.com/kictanet
> > Facebook: https://www.facebook.com/KICTANet/
> >
> > Unsubscribe or change your options at
> https://lists.kictanet.or.ke/mailman/options/kictanet/benson_muite%40emailplus.org
> >
> >
> > KICTANet is a multi-stakeholder Think Tank for people and institutions
> interested and involved in ICT policy and regulation. KICTANet is a
> catalyst for reform in the Information and Communication Technology sector.
> Its work is guided by four pillars of Policy Advocacy, Capacity Building,
> Research, and Stakeholder Engagement.
> >
> > KICTANetiquette : Adhere to the same standards of acceptable behaviors
> online that you follow in real life: respect people's times and bandwidth,
> share knowledge, don't flame or abuse or personalize, respect privacy, do
> not spam, do not market your wares or qualifications.
> >
> > KICTANet - The Power of Communities, is Kenya's premier ICT policy
> engagement platform.
> >
>
>
> _______________________________________________
> KICTANet mailing list
> KICTANet at lists.kictanet.or.ke
> https://lists.kictanet.or.ke/mailman/listinfo/kictanet
> Twitter: http://twitter.com/kictanet
> Facebook: https://www.facebook.com/KICTANet/
>
> Unsubscribe or change your options at
> https://lists.kictanet.or.ke/mailman/options/kictanet/otieno.barrack%40gmail.com
>
>
> KICTANet is a multi-stakeholder Think Tank for people and institutions
> interested and involved in ICT policy and regulation. KICTANet is a
> catalyst for reform in the Information and Communication Technology sector.
> Its work is guided by four pillars of Policy Advocacy, Capacity Building,
> Research, and Stakeholder Engagement.
>
> KICTANetiquette : Adhere to the same standards of acceptable behaviors
> online that you follow in real life: respect people's times and bandwidth,
> share knowledge, don't flame or abuse or personalize, respect privacy, do
> not spam, do not market your wares or qualifications.
>
> KICTANet - The Power of Communities, is Kenya's premier ICT policy
> engagement platform.
>


-- 
Barrack O. Otieno
+254721325277
+254733206359
Skype: barrack.otieno
PGP ID: 0x2611D86A
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20220317/883dc6a3/attachment.htm>


More information about the KICTANet mailing list