Geneva Hanstein
Namibia is one of the last countries in Africa enforcing mandatory Subscriber Identity Module (SIM) card Registration. Mandatory SIM Registration is a policy adopted by several governments, around the world as part of efforts to mitigate security concerns, address crime and enable the application of digital services.
SIM registration would allow the service providers to know the identity of the owner of a SIM card and that of a person making a call or sending a message.
As a condition for the purchase or activation of a SIM card, the user will be required to provide personal data, such as residential address, as well as a valid identification document (ID), a point of contention that has some members of the public rightfully questioning the safety and security of their privacy.
The Government of the Republic of Namibia has issued a policy directive that all SIM cards in Namibia must be registered, in line with the provisions of Section 77 of the Communications Act.
To this end, the Minister of Information and Communication Technology (MICT) has consulted with the Communications Regulatory Authority of Namibia (CRAN), Director General of the Namibia Central Intelligence Service (NCIS) and all providers of telecommunications services in Namibia on the regulations setting out the framework for SIM registration, which were published in the Government Gazette of 15 March 2021.
The regulations will be operationalised and as of 01 January 2023, mobile operators will be required to register all their customers’ SIM cards and obtain relevant information before the sale and activation of SIM cards. Operators will have a period of 12 months to conclude the registration of existing customers. The information of new customers must be registered within three months from date of sale and unregistered SIM cards will be deactivated.
Established in terms of the Communications Act (No. 8 of 2009), the Communications Regulatory Authority of Namibia (CRAN) is an independent regulator that manages, supervises, and promotes the provision of telecommunication services and networks, broadcasting, postal services and the use and allocation of radio spectrum in Namibia. The regulations in terms of Part 6 of Chapter V of the Communications Act, as published in the Government Gazette of March 2021, mandates CRAN as responsible for setting up the conditions to ensure all active SIM-card owners in Namibia are verified and registered. These conditions are expected to be implemented by all telecommunications service providers countrywide.
CRAN commenced the SIM registration awareness campaign in June 2022 and despite the concerns of privacy rights, the public are in favour of the regulations. CRAN’s awareness campaign included a roadshow across Namibia to engage with the public and educate individuals on the relevance of SIM Registration. The public responded positively and is curious about the process of SIM registration, which must be communicated by service providers to their customers.
People understand SIM registration is also relevant to the administration and regulation of electronic financial services and e-governance that require identity verification for the delivery of a trustworthy service in a lawful manner.
In essence, SIM registration will also be used to address mobile fraud, act as a tool for e-service rollout and be an instrument that eases and enables digital surveillance and interception as part of investigations of criminal offences and counter terrorism efforts.
Protecting citizens’ rights remain a key priority in the registration process and the overall policy would ensure appropriate privacy safeguards and effective legal oversight to protect consumers’ personal data. The request of stored SIM card information will be done with due regard to the provisions of the regulations, which involves the issuance of an order by a judge or magistrate to authorise the obtaining of that information from a service provider. The Communications Act also deals with disclosure of information and places a duty on telecommunications service providers to safeguard the integrity of such information.
The Namibian constitution stipulates that the right to privacy of communications may be limited in accordance with law and as is necessary in a democratic society in the interests of national security, public safety, or the economic wellbeing of the country, for the protection of health or morals, for the prevention of disorder or crime or for the protection of the rights or freedoms of others. The Namibian judiciary is full of ample jurisprudence certifying that the right to privacy is not absolute and can be limited by the provisions of another act. The limitations authorised by the Namibian Constitution are set out in the Namibian Central Intelligence and Service Act, the Criminal Procedure Act and the Combating and Prevention of Terrorist Activities Act, which clearly establishes the circumstances under which personal communications may be intercepted.
Many members of the public consulted during the roadshow, have fallen victim to cybercrimes and are keen to embrace financial technology. The authority reiterates that any personal data stored by a service provider is protected by relevant regulations and the user’s right to privacy is at the core of implementing this legislation.
*Geneva Hanstein is CRAN’s Legal Advisor: Corporate Advice & Legislative Drafting