<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Emoji";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Smh! Too much confusion<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span lang=EN-US>From:</span></b><span lang=EN-US> KICTANet <kictanet-bounces+awatila=gmail.com@lists.kictanet.or.ke> <b>On Behalf Of </b>Mutindi Muema via KICTANet<br><b>Sent:</b> Friday, April 8, 2022 7:21 PM<br><b>To:</b> Alex Watila <awatila@gmail.com><br><b>Cc:</b> Mutindi Muema <missmutindi@gmail.com><br><b>Subject:</b> Re: [kictanet] SIM CARD REGISTRATION & DATA PROTECTION ACT, 2019<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Gobsmaked in deed <span style='font-family:"Segoe UI Emoji",sans-serif'>💯</span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The CA has finally stated today that kica SIM registration regs does not require photo of subscriber to be taken<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Full interview on Youtube here <a href="https://youtu.be/-SpW2rFhYxQ">https://youtu.be/-SpW2rFhYxQ</a> <o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Thu, 7 Apr 2022, 17:28 Ciiru K via KICTANet, <<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal>Dear listers,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I am equally concerned by the overreach in this matter.<o:p></o:p></p></div><div><p class=MsoNormal>For people who are outside Kenya, the list of requirements is obnoxious. Below are the requirements.<o:p></o:p></p></div><div><p class=MsoNormal> - Mobile number<br>- Passport page containing your bio details.<br>- Passport page containing your visa.<br>- Passport page containing the exit stamp from Kenya (full page including the dotted passport number)<br>- Passport page containing the entry stamp in your current country of residence(full page including the dotted passport number)<br>- Scanned copy of ID(both sides)<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Why do they need all this information? Who will have access to it? <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Yours truly gobsmacked. <o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>Liz<o:p></o:p></p><div><div><p class=MsoNormal>On Thu, Mar 17, 2022, 02:06 James Mbugua via KICTANet <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><p class=MsoNormal>Listers,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I am not sure if I am being paranoid but the SIM card re-registration order ostensibly by CA (Communications Authority) and which has mobile operators asking us to te-register our SIM cards by April or risk being deregistered, seems like regulatory overreach.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>CA says under the SIM Registrations regulations of 2015, MNOs are required to update their registers with details including ID documents and photo IDs. The reason given, ostensibly, is that many had their SIM details registered before that law came into place.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Speaking of laws coming into operation, the Data Protection Act, itself came into effect in 2019. Significantly long after the said regulations.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>In seeking to protect privacy and personal data, the DPA requires Data Minimisation where personal data collected should be:<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>"<span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:black'>adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);" Sec. 25(d) DPA, 2019</span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>This means that data that the controller does not really need to achieve a specific purpose, should not be collected.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Biometric information such as Passport Photos that the Operators will take and store,for example, are in my opinion, surplus to requirements.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The identification of the subscriber can be done without collection of intrusive biometric data for example by using national IDs. CA explicitly asks that the operators verify details with the Integrated Personnel Registry System. so collection of biometric data to me is disproportionate and cannot meet the threshold of lawful basis.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Being the later law, and by the Huduma Number case precedent, the data minimisation provisions of the DPA, 2019 in my opinion hold primacy and in fact impliedly, repeal or render unlawful, the requirements for photo taking for SIM registration in the 2015 regulations.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>2. Data Protection Impact Assessment.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Another question I would have for the CA, the Data Commissioner and mobile operators, is if, as per the precedent sent by Justice Ngaah in the Katiba Institute v. MoICT & others regarding the need for the conduct of a Data Processing Impact Assessment, has been carried out in this instance when CA proposes to have collected the data of more than 30 million subscribers including biometric data.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I think this is a plain case of flouting judicial guidance viz a viz when DPIAs should be carried out and CA should have had this carried out first before issuing the said directive.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Regards,<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>James G. Mbugua<o:p></o:p></p></div><div><p class=MsoNormal>Data Privacy Consultant & Tech Policy Blogger<o:p></o:p></p></div><div><p class=MsoNormal><a href="mailto:jgmbugua@gmail.com" target="_blank">@jgmbugua</a> <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><p class=MsoNormal>_______________________________________________<br>KICTANet mailing list<br><a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a><br><a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>Twitter: <a href="http://twitter.com/kictanet" target="_blank">http://twitter.com/kictanet</a><br>Facebook: <a href="https://www.facebook.com/KICTANet/" target="_blank">https://www.facebook.com/KICTANet/</a><br><br>Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/lizwanjiru%40gmail.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/lizwanjiru%40gmail.com</a><br><br><br>KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br><br>KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br><br>KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<o:p></o:p></p></blockquote></div></div></div><p class=MsoNormal>_______________________________________________<br>KICTANet mailing list<br><a href="mailto:KICTANet@lists.kictanet.or.ke" target="_blank">KICTANet@lists.kictanet.or.ke</a><br><a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>Twitter: <a href="http://twitter.com/kictanet" target="_blank">http://twitter.com/kictanet</a><br>Facebook: <a href="https://www.facebook.com/KICTANet/" target="_blank">https://www.facebook.com/KICTANet/</a><br><br>Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/missmutindi%40gmail.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/missmutindi%40gmail.com</a><br><br><br>KICTANet is a multi-stakeholder Think Tank for people and institutions interested and involved in ICT policy and regulation. KICTANet is a catalyst for reform in the Information and Communication Technology sector. Its work is guided by four pillars of Policy Advocacy, Capacity Building, Research, and Stakeholder Engagement.<br><br>KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br><br>KICTANet - The Power of Communities, is Kenya's premier ICT policy engagement platform.<o:p></o:p></p></blockquote></div></div></body></html>