<div dir="ltr">@Walu, if i had time to spare i would dig in, but billable work is hogging my schedule right now. I can however add some direction for whoever has time to delve into this- we all looking forward to any findings:<div><br></div><div> Further to direction by Grace, Walu & Mutemi, it seems work needed along the lines of what the law says regarding: <div><ol><li>requirements for SIM card registration - probably KICA both Act and Regs as well as any relevant guidelines issued by CA. Kanini Mutemi reproduced a segment of KICA earlier. some work to get any other relevant provisions.</li><li>@Walu it is also important that any directive for re-registration has been issued by CA - the same be reviewed. Yes CA has a mandate , content of any directions would also inform thai convo. <br></li><li>Requirements for mobile money registration/use are also relevant- from my understanding mobile money legal framework is the National Payment Systems ACt (NPSA)& Regs and relevant guidelines under that. Cursory review of Act, I do not remember seeing requirements for photo here last time I reviewed this (which a while back) someone with time on their hands can go through requirements as well.</li><li>Mobile banking regulatory framework- is different from mobile money framework. Mobile banking falls more within banking so Banking Act, prudential guidelines etc - we could actually have different requirements for registration of customers for mobile banking in law than requirements for registration of mobile money (NPSA)</li><li>Like Walu said - there is also need to review laws relating to ani-money laundering , terrorism fianncing etc to see requirements under those esp those that would relate to KYC as well as the deffinition of insitutions to which the obligations apply and if any distinction between application to businesses lines licensed under KICA (Sim card), NPSA (mobile money)versus licensees under Banking Act (mobile banking). </li><li>All the findings then need to be reconciled with provisions of the Data Protection Act & Regs now in force :</li></ol>(i) from a data protection principle perspective but then also </div><div>(ii) from a communications to data subject perspective- as evident in this thread, data subjects have questions around this and compliance is definitely impacted by clarity of comms to data subjects. This second point is particularly important for data protection compliance as communications helps with accountability and transparency with regards to what data controllers/ processors are actually doing with data subject data and why. <br></div><div><br></div><div><br></div><div>Kind regards,</div><div>Mutindi</div><div>Advocate & Certified Information Privacy Manager (CIPM)- International Association of Privacy Professionals (IAPP)</div><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 21, 2022 at 11:44 AM Walubengo J via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div style="font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:16px"><div></div>
<div dir="ltr">Interesting discourse.</div><div dir="ltr"><br></div><div dir="ltr">I didnt know CA had a directive for SIM card re-registration but that's besides the point since its their mandate. The issues here is whether collecting photos of data subjects during registration is an overeach.</div><div dir="ltr"><br></div><div dir="ltr">From reading various comments its seems we have CA regulations, Banking regulations and Data Protection Regulations coming into play. It looks like Listers agree that the stringent Banking Regulations (e.g KYC) may kick in for MPESA registration, but not necessarily for basic subscriber (eg voice) registration. </div><div dir="ltr"><br></div><div dir="ltr">The argument seems to be whether the basic subscriber (SIM card) registration for say voice services, should be accompanied with digital photos since this may violate the data minimization principles of the Data Protection Act.</div><div dir="ltr"><br></div><div dir="ltr">I am persuaded that this is a valid concern - However, I request the lawyers to expand their search further and review the security laws. Is it possible that the Security Laws (as amended over time) could have enhanced basic service (eg for voice) registration to include photos of the subscriber?</div><div dir="ltr"><br></div><div dir="ltr">Such that in case there is a terror attack and the terrorists use voice communication (and not necessarily mobile money), one would still want to track them down using their mug-shot?</div><div dir="ltr"><br></div><div dir="ltr">the lawyers can find out and tell us.</div><div dir="ltr"><br></div><div dir="ltr">walu</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div><br></div>
</div><div id="gmail-m_8899195805961457416ydp173044e1yahoo_quoted_8694169113">
<div style="font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;color:rgb(38,40,42)">
<div>
On Thursday, March 17, 2022, 12:57:53 PM GMT+3, James Mbugua via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="gmail-m_8899195805961457416ydp173044e1yiv1081238168"><div><div dir="ltr">Mwendwa,<div><br clear="none"></div><div>I agree with Mutindi we should isolate KYC issues with subscriber registration. That is the whole essence of purpose limitation. We cannot use banking regulations for subscribe registration. It is not to say that every mobile subscriber is automatically also an MPESA customer and that the information should be collected for use the day they decide to register for MPESA. In any case, it is also not to say that when they do register for mobile money, that they will not have to provide all the know-your-customer details including photographs.</div><div><br clear="none"></div><div>My point is that SIM registration must be limited in data collection to what is necessary and adequate for its stated purposes, and not more personal information than necessary. </div><div><br clear="none"></div><div>Mutindi, </div><div><br clear="none"></div><div>I will be raising it with the ODPC thanks.</div><div><br clear="none"></div><div>Regards,</div><div><br clear="none"></div><div><div style="color:rgb(80,0,80)">James G. Mbugua</div><div style="color:rgb(80,0,80)">Data Privacy Consultant & Tech Policy Blogger</div><div style="color:rgb(80,0,80)"><a shape="rect" id="gmail-m_8899195805961457416ydp173044e1yiv1081238168gmail-m_7442972044354764016m_8008772171606984219plusReplyChip-0" href="mailto:jgmbugua@gmail.com" rel="nofollow" target="_blank">@jgmbugua</a> </div></div></div><br clear="none"><div><div id="gmail-m_8899195805961457416ydp173044e1yiv1081238168yqt71548"><div dir="ltr">On Wed, Mar 16, 2022 at 9:31 PM Mwendwa Kivuva via KICTANet <<a shape="rect" href="mailto:kictanet@lists.kictanet.or.ke" rel="nofollow" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<br clear="none"></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div>Since SIM card data is used by a large section of the population for mobile banking (Safaricom has 30 million mobile money customers) - and banking regulations require a photo ID, should the regulation be harmonised for all mobile money customers to provide their photo ID?</div><div><br clear="none"></div><div>KICTANet had a Thought Leadership Forum with the ODPC, and the question of DPIA came up. I can't remember the response. The recording of the forum is available here <a shape="rect" href="https://youtu.be/Rmdvoc8Valo" rel="nofollow" target="_blank">https://youtu.be/Rmdvoc8Valo</a> <br clear="none"><br clear="none"><div><div dir="ltr">On Wed, 16 Mar 2022, 16:04 James Mbugua via KICTANet, <<a shape="rect" href="mailto:kictanet@lists.kictanet.or.ke" rel="nofollow" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<br clear="none"></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Listers,<div><br clear="none"></div><div>I am not sure if I am being paranoid but the SIM card re-registration order ostensibly by CA (Communications Authority) and which has mobile operators asking us to te-register our SIM cards by April or risk being deregistered, seems like regulatory overreach.</div><div><br clear="none"></div><div>CA says under the SIM Registrations regulations of 2015, MNOs are required to update their registers with details including ID documents and photo IDs. The reason given, ostensibly, is that many had their SIM details registered before that law came into place.</div><div><br clear="none"></div><div>Speaking of laws coming into operation, the Data Protection Act, itself came into effect in 2019. Significantly long after the said regulations.</div><div><br clear="none"></div><div>In seeking to protect privacy and personal data, the DPA requires Data Minimisation where personal data collected should be:</div><div> </div><div>"<span style="color:rgb(0,0,0);font-family:arial,helvetica,verdana,sans-serif;font-size:12px;text-align:justify">adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);" Sec. 25(d) DPA, 2019</span></div><div><br clear="none"></div><div>This means that data that the controller does not really need to achieve a specific purpose, should not be collected.</div><div><br clear="none"></div><div>Biometric information such as Passport Photos that the Operators will take and store,for example, are in my opinion, surplus to requirements.</div><div><br clear="none"></div><div>The identification of the subscriber can be done without collection of intrusive biometric data for example by using national IDs. CA explicitly asks that the operators verify details with the Integrated Personnel Registry System. so collection of biometric data to me is disproportionate and cannot meet the threshold of lawful basis.</div><div><br clear="none"></div><div>Being the later law, and by the Huduma Number case precedent, the data minimisation provisions of the DPA, 2019 in my opinion hold primacy and in fact impliedly, repeal or render unlawful, the requirements for photo taking for SIM registration in the 2015 regulations.</div><div><br clear="none"></div><div>2. Data Protection Impact Assessment.</div><div><br clear="none"></div><div>Another question I would have for the CA, the Data Commissioner and mobile operators, is if, as per the precedent sent by Justice Ngaah in the Katiba Institute v. MoICT & others regarding the need for the conduct of a Data Processing Impact Assessment, has been carried out in this instance when CA proposes to have collected the data of more than 30 million subscribers including biometric data.</div><div><br clear="none"></div><div>I think this is a plain case of flouting judicial guidance viz a viz when DPIAs should be carried out and CA should have had this carried out first before issuing the said directive.</div><div><br clear="none"></div><div>Regards,</div><div><br clear="none"></div><div>James G. Mbugua</div><div>Data Privacy Consultant & Tech Policy Blogger</div><div><a shape="rect" id="gmail-m_8899195805961457416ydp173044e1yiv1081238168gmail-m_7442972044354764016m_8008772171606984219plusReplyChip-0" href="mailto:jgmbugua@gmail.com" rel="nofollow" target="_blank">@jgmbugua</a> <br clear="none"></div><div><br clear="none"></div><div><br clear="none"></div><div><br clear="none"></div></div>
_______________________________________________<br clear="none">
KICTANet mailing list<br clear="none">
<a shape="rect" href="mailto:KICTANet@lists.kictanet.or.ke" rel="nofollow" target="_blank">KICTANet@lists.kictanet.or.ke</a><br clear="none">
<a shape="rect" href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="nofollow" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br clear="none">
Twitter: <a shape="rect" href="http://twitter.com/kictanet" rel="nofollow" target="_blank">http://twitter.com/kictanet</a><br clear="none">
Facebook: <a shape="rect" href="https://www.facebook.com/KICTANet/" rel="nofollow" target="_blank">https://www.facebook.com/KICTANet/</a><br clear="none">
<br clear="none">
Unsubscribe or change your options at <a shape="rect" href="https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com" rel="nofollow" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldafrica.com</a><br clear="none">
<br clear="none">
<br clear="none">
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br clear="none">
<br clear="none">
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br clear="none">
<br clear="none">
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br clear="none">
</blockquote></div></div></div>
_______________________________________________<br clear="none">
KICTANet mailing list<br clear="none">
<a shape="rect" href="mailto:KICTANet@lists.kictanet.or.ke" rel="nofollow" target="_blank">KICTANet@lists.kictanet.or.ke</a><br clear="none">
<a shape="rect" href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="nofollow" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br clear="none">
Twitter: <a shape="rect" href="http://twitter.com/kictanet" rel="nofollow" target="_blank">http://twitter.com/kictanet</a><br clear="none">
Facebook: <a shape="rect" href="https://www.facebook.com/KICTANet/" rel="nofollow" target="_blank">https://www.facebook.com/KICTANet/</a><br clear="none">
<br clear="none">
Unsubscribe or change your options at <a shape="rect" href="https://lists.kictanet.or.ke/mailman/options/kictanet/jgmbugua%40gmail.com" rel="nofollow" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/jgmbugua%40gmail.com</a><br clear="none">
<br clear="none">
<br clear="none">
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br clear="none">
<br clear="none">
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br clear="none">
<br clear="none">
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br clear="none">
</blockquote></div></div>
</div></div><div id="gmail-m_8899195805961457416ydp173044e1yqt01020">_______________________________________________<br clear="none">KICTANet mailing list<br clear="none"><a shape="rect" href="mailto:KICTANet@lists.kictanet.or.ke" rel="nofollow" target="_blank">KICTANet@lists.kictanet.or.ke</a><br clear="none"><a shape="rect" href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="nofollow" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br clear="none">Twitter: <a shape="rect" href="http://twitter.com/kictanet" rel="nofollow" target="_blank">http://twitter.com/kictanet</a><br clear="none">Facebook: <a shape="rect" href="https://www.facebook.com/KICTANet/" rel="nofollow" target="_blank">https://www.facebook.com/KICTANet/</a><br clear="none"><br clear="none">Unsubscribe or change your options at <a shape="rect" href="https://lists.kictanet.or.ke/mailman/options/kictanet/jwalu%40yahoo.com" rel="nofollow" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/jwalu%40yahoo.com</a><br clear="none"><br clear="none"><br clear="none">KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br clear="none"><br clear="none">KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br clear="none"><br clear="none">KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br clear="none"></div></div>
</div>
</div></div>_______________________________________________<br>
KICTANet mailing list<br>
<a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
Twitter: <a href="http://twitter.com/kictanet" rel="noreferrer" target="_blank">http://twitter.com/kictanet</a><br>
Facebook: <a href="https://www.facebook.com/KICTANet/" rel="noreferrer" target="_blank">https://www.facebook.com/KICTANet/</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/missmutindi%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/missmutindi%40gmail.com</a><br>
<br>
<br>
KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
<br>
KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<br>
</blockquote></div>