<div dir="ltr"><a class="gmail_plusreply" id="plusReplyChip-0" href="mailto:benson_muite@emailplus.org" tabindex="-1">@Benson Muite</a><div> Kenyan Telcos have already moved in this direction.</div><div><br></div><div>Thank you</div><div><br></div><div>Best Regards<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Mar 17, 2022 at 10:39 AM Benson Muite via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">It is interesting to observe that MTN is re-branding to become a <br>
data/technology company - full details are unclear, but it maybe <br>
something that other telecommunications companies in Africa may also do. <br>
Anti-trust regulations have had an interesting history in the USA, for <br>
example [1] and [2].<br>
<br>
[1] <a href="https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp" rel="noreferrer" target="_blank">https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp</a>.<br>
[2] <a href="https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System" rel="noreferrer" target="_blank">https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System</a><br>
On 3/16/22 11:25 PM, kanini mutemi via KICTANet wrote:<br>
> @Mwendwa Kivuva <mailto:<a href="mailto:Lordmwesh@gmail.com" target="_blank">Lordmwesh@gmail.com</a>> Let us not conflate issues. <br>
> ALWAYS treat mobile banking (and banking in general) quite separate from <br>
> other services offered by MNOs. A practical problem- @James Mbugua was <br>
> right on data minimization (I would add necessity as well) disqualifying <br>
> the current directive by CA. If you speak of harmonization of <br>
> regulations, you can no longer rely on minimization and necessity <br>
> because a need (banking) has been created. While all these things begin <br>
> with a SIM Card registration, MPESA requires a further positive step of <br>
> registration. At that point, we can safely speak of harmonization and <br>
> requiring more information to prevent financial crimes etc. Different <br>
> products, different markets.<br>
> <br>
> Are we sure CA is the source of the photos directive? (Kindly share the <br>
> directive if you have access to it). The Regulations only allow this <br>
> information to be collected during SIM Card registration-<br>
> <br>
> 5 (1) A person who intends to register a SIM-card shall provide the <br>
> following particulars to the telecommunications operator or agent—<br>
> <br>
> (a) <br>
> <br>
> full names;<br>
> <br>
> (b) <br>
> <br>
> identity card, service card, passport or alien card number;<br>
> <br>
> (c) <br>
> <br>
> date of birth;<br>
> <br>
> (d) <br>
> <br>
> gender;<br>
> <br>
> (e) <br>
> <br>
> physical address;<br>
> <br>
> (f) <br>
> <br>
> postal address, where available;<br>
> <br>
> (g) <br>
> <br>
> any other registered subscriber number associated with the subscriber;<br>
> <br>
> (h) <br>
> <br>
> an original and a copy of the national identity card, service card, <br>
> passport or alien card;<br>
> <br>
> (i) <br>
> <br>
> an original and a copy of the birth certificate, in respect of <br>
> registration of minors;<br>
> <br>
> (j) <br>
> <br>
> subscriber number in respect to existing subscribers;<br>
> <br>
> (k) <br>
> <br>
> an original and true copy of the certificate of registration, where <br>
> relevant;<br>
> <br>
> (l) <br>
> <br>
> a letter duly sealed by the chief executive officer or the person <br>
> responsible for the day to day management of the statutory body.<br>
> <br>
> <br>
> (while your ID would normally have a photo- it is vastly different from <br>
> a digital photo which can become part of a biometric register).<br>
> <br>
> <br>
> I cannot insist on this enough, a SIM Card registration is not the same <br>
> thing as MPESA (or other mobile money platform registration). The <br>
> requirements for SIM Card registration have to remain as basal as possible.<br>
> <br>
> <br>
> On Wed, Mar 16, 2022 at 9:33 PM Mwendwa Kivuva via KICTANet <br>
> <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a> <mailto:<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>>> <br>
> wrote:<br>
> <br>
> Since SIM card data is used by a large section of the population for<br>
> mobile banking (Safaricom has 30 million mobile money customers) -<br>
> and banking regulations require a photo ID, should the regulation be<br>
> harmonised for all mobile money customers to provide their photo ID?<br>
> <br>
> KICTANet had a Thought Leadership Forum with the ODPC, and the<br>
> question of DPIA came up. I can't remember the response. The<br>
> recording of the forum is available here<br>
> <a href="https://youtu.be/Rmdvoc8Valo" rel="noreferrer" target="_blank">https://youtu.be/Rmdvoc8Valo</a> <<a href="https://youtu.be/Rmdvoc8Valo" rel="noreferrer" target="_blank">https://youtu.be/Rmdvoc8Valo</a>><br>
> <br>
> On Wed, 16 Mar 2022, 16:04 James Mbugua via KICTANet,<br>
> <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
> <mailto:<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>>> wrote:<br>
> <br>
> Listers,<br>
> <br>
> I am not sure if I am being paranoid but the SIM card<br>
> re-registration order ostensibly by CA (Communications<br>
> Authority) and which has mobile operators asking us to<br>
> te-register our SIM cards by April or risk being deregistered,<br>
> seems like regulatory overreach.<br>
> <br>
> CA says under the SIM Registrations regulations of 2015, MNOs<br>
> are required to update their registers with details including ID<br>
> documents and photo IDs. The reason given, ostensibly, is that<br>
> many had their SIM details registered before that law came into<br>
> place.<br>
> <br>
> Speaking of laws coming into operation, the Data Protection Act,<br>
> itself came into effect in 2019. Significantly long after the<br>
> said regulations.<br>
> <br>
> In seeking to protect privacy and personal data, the DPA <br>
> requires Data Minimisation where personal data collected should be:<br>
> "adequate, relevant and limited to what is necessary in relation<br>
> to the purposes for which they are processed (‘data<br>
> minimisation’);" Sec. 25(d) DPA, 2019<br>
> <br>
> This means that data that the controller does not really need to<br>
> achieve a specific purpose, should not be collected.<br>
> <br>
> Biometric information such as Passport Photos that the Operators<br>
> will take and store,for example, are in my opinion, surplus to<br>
> requirements.<br>
> <br>
> The identification of the subscriber can be done without<br>
> collection of intrusive biometric data for example by using<br>
> national IDs. CA explicitly asks that the operators verify<br>
> details with the Integrated Personnel Registry System. so<br>
> collection of biometric data to me is disproportionate and<br>
> cannot meet the threshold of lawful basis.<br>
> <br>
> Being the later law, and by the Huduma Number case precedent,<br>
> the data minimisation provisions of the DPA, 2019 in my opinion<br>
> hold primacy and in fact impliedly, repeal or render unlawful,<br>
> the requirements for photo taking for SIM registration in the<br>
> 2015 regulations.<br>
> <br>
> 2. Data Protection Impact Assessment.<br>
> <br>
> Another question I would have for the CA, the Data Commissioner<br>
> and mobile operators, is if, as per the precedent sent by<br>
> Justice Ngaah in the Katiba Institute v. MoICT & others<br>
> regarding the need for the conduct of a Data Processing Impact<br>
> Assessment, has been carried out in this instance when CA<br>
> proposes to have collected the data of more than 30 million<br>
> subscribers including biometric data.<br>
> <br>
> I think this is a plain case of flouting judicial guidance viz a<br>
> viz when DPIAs should be carried out and CA should have had this<br>
> carried out first before issuing the said directive.<br>
> <br>
> Regards,<br>
> <br>
> James G. Mbugua<br>
> Data Privacy Consultant & Tech Policy Blogger<br>
> @jgmbugua <mailto:<a href="mailto:jgmbugua@gmail.com" target="_blank">jgmbugua@gmail.com</a>><br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> KICTANet mailing list<br>
> <a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a> <mailto:<a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a>><br>
> <a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
> <<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a>><br>
> Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a> <<a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a>><br>
> Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
> <<a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a>><br>
> <br>
> Unsubscribe or change your options at<br>
> <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com</a><br>
> <<a href="https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com</a>><br>
> <br>
> <br>
> KICTANet is a multi-stakeholder Think Tank for people and<br>
> institutions interested and involved in ICT policy and<br>
> regulation. KICTANet is a catalyst for reform in the Information<br>
> and Communication Technology sector. Its work is guided by four<br>
> pillars of Policy Advocacy, Capacity Building, Research, and<br>
> Stakeholder Engagement.<br>
> <br>
> KICTANetiquette : Adhere to the same standards of acceptable<br>
> behaviors online that you follow in real life: respect people's<br>
> times and bandwidth, share knowledge, don't flame or abuse or<br>
> personalize, respect privacy, do not spam, do not market your<br>
> wares or qualifications.<br>
> <br>
> KICTANet - The Power of Communities, is Kenya's premier ICT<br>
> policy engagement platform.<br>
> <br>
> _______________________________________________<br>
> KICTANet mailing list<br>
> <a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a> <mailto:<a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a>><br>
> <a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
> <<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a>><br>
> Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a> <<a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a>><br>
> Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
> <<a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a>><br>
> <br>
> Unsubscribe or change your options at<br>
> <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com</a><br>
> <<a href="https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/kaninimutemi%40gmail.com</a>><br>
> <br>
> <br>
> KICTANet is a multi-stakeholder Think Tank for people and<br>
> institutions interested and involved in ICT policy and regulation.<br>
> KICTANet is a catalyst for reform in the Information and<br>
> Communication Technology sector. Its work is guided by four pillars<br>
> of Policy Advocacy, Capacity Building, Research, and Stakeholder<br>
> Engagement.<br>
> <br>
> KICTANetiquette : Adhere to the same standards of acceptable<br>
> behaviors online that you follow in real life: respect people's<br>
> times and bandwidth, share knowledge, don't flame or abuse or<br>
> personalize, respect privacy, do not spam, do not market your wares<br>
> or qualifications.<br>
> <br>
> KICTANet - The Power of Communities, is Kenya's premier ICT policy<br>
> engagement platform.<br>
> <br>
> <br>
> <br>
> -- <br>
> *Mercy Mutemi, Advocate*.<br>
> <br>
> */<br>
> /*<br>
> <br>
> <br>
> _______________________________________________<br>
> KICTANet mailing list<br>
> <a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
> <a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
> Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
> Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
> <br>
> Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/benson_muite%40emailplus.org" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/benson_muite%40emailplus.org</a><br>
> <br>
> <br>
> KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
> <br>
> KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
> <br>
> KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br>
> <br>
<br>
<br>
_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/otieno.barrack%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/otieno.barrack%40gmail.com</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature">Barrack O. Otieno<br>+254721325277<br>+254733206359<br>Skype: barrack.otieno<br>PGP ID: 0x2611D86A<br> <br><br><br><br></div>