Africa: SIM Card Registration Only Increases Monitoring and Exclusion

Image credit: Emil Sjöblom [ShareAlike 2.0 Generic (CC BY-SA 2.0)]

Prepaid SIM card use and mandatory SIM card registration laws are especially widespread in countries in Africa: these two factors can allow for a more pervasive system of mass surveillance of people who can access prepaid SIM cards, as well as exclusion from important civic spaces, social networks, and education and health care for people who cannot.

Mandatory SIM card registration laws require that people provide personal information, including a valid ID or even their biometrics, before they can purchase or activate a prepaid SIM card for their mobile device. Such laws can allow the state to identify the owner of a SIM card and infer who is likely to be making a call, sending a message, in a particular location at any particular time, or making a particular financial transaction through a money transfer app, such as M-Pesa in Kenya.

Building off our timeline of mandatory SIM card registration laws, we examine areas of concern in African countries with such laws. As of February 2019 (source: GSMA p.46-47):

• 50 countries in Africa had introduced such laws: Algeria, Angola, Benin, Botswana, Burkina Faso, Burundi, Cameroon, Central African Republic, Chad, Congo, Côte d'Ivoire, Democratic Republic of Congo, Egypt, Equatorial Guinea, Eritrea, Ethiopia, Gabon, Gambia, Ghana, Guinea, Guinea-Bissau, Kenya, Lesotho, Liberia, Libya, Madagascar, Malawi, Mali, Mauritania, Mauritius, Morocco, Mozambique, Niger, Nigeria, Rwanda, Sao Tome and Principe, Senegal, Seychelles, Sierra Leone, Somalia, South Africa, South Sudan, Sudan, Swaziland, Tanzania, Togo, Tunisia, Uganda, Zambia, and Zimbabwe.
• 2 countries had not mandated SIM card registration and were not considering doing so: Cabo Verde and Comoros.
• Namibia was considering SIM card registration.
• The state of SIM card registration in Djibouti was inconclusive.

Because fixed, long-term contracts with a specific mobile carrier generally require people to prove their credit worthiness, pre-paid SIM cards offer a more accessible and flexible way for millions of people around the world to connect and communicate. Across Africa, almost all mobile connections are made via prepaid SIM cards (94 percent), more than in Central America (87 percent, Asia (80 percent), South America (70 percent), Europe (52 percent), or North America (21 percent) (source: GSMA p. 9). Furthermore, between 2017 and 2025, the percentage of the population with access to mobile connections is expected to increase most significantly in Sub-Saharan Africa (source: GSMA p. 12).

If almost every mobile device has its SIM card registered to a particular person, and the government can get access to that mobile subscriber information, the people who own and use such devices can be more easily tracked and monitored. Not all people with mobile devices may fall equally under the watchful eye of such surveillance systems: people advocating for change, people who disagree with the government’s policies, religious or ethnic minorities, journalists, and human rights defenders are particularly vulnerable.

The absence of legal safeguards to protect against abuse

There is an absence of robust and adequately enforced data protection laws in the majority of countries in Africa where mandatory SIM card registration laws have been passed. In fact, only 43% of African countries have any data privacy laws. In countries that do have data privacy laws, critics and advocates have raised concerns about the lack of sufficient protections and safeguards.

In 57% of countries in Africa, data processing occurs in a legal void, which means that information collected as part of registration today could be kept for an indefinite amount of time and used for different purposes in the future, as technology, corporate incentives, or governments change. In such contexts, there are a lack of requirements for how data is managed and stored, which is particularly concerning in the case of biometric data.

According to the U.N. High Commissioner for Human Rights, biometric data

is particularly sensitive, as it is by definition inseparably linked to a particular person and that person’s life, and has the potential to be gravely abused. For example, identity theft on the basis of biometrics is extremely difficult to remedy and may seriously affect an individual’s rights. Moreover, biometric data may be used for different purposes from those for which it was collected, including the unlawful tracking and monitoring of individuals.  Given those risks, particular attention should be paid to questions of necessity and proportionality in the collection of biometric data. Against that background, it is worrisome that some States are embarking on vast biometric data-based projects without having adequate legal and procedural safeguards in place.

There is a need for greater regional cooperation regarding the protection of peoples’ data. Only Ghana, Guinea, Mauritius, Namibia, and Senegal have ratified the African Union (AU) Convention on Cyber Security and Personal Data Protection, which was established in June 2014 and requires signatories to establish some legal, regulatory, and institutional frameworks.

However, the Convention will only enter into legal force 30 days from when the fifteenth African Union member state ratifies it, but given the slow pace at which only 5 countries have ratified it so far, it remains unclear when that will happen.

Fear of being under surveillance has a chilling effect on people’s rights

Even if people are not actually being surveilled by the government, the fact that people may fear they are being tracked has a chilling effect on innocent and ordinary behaviour, including what information people look up on the Internet, who they contact, and how they express themselves. People may not feel comfortable visiting certain websites, and thus may not obtain the information they need to form and share opinions.

Journalists and human rights defenders may feel it is unsafe to communicate with confidential sources. Journalists and human rights defenders may also forgo investigations into certain controversial topics for fear of reprisal from the government and be unable to do their essential job of uncovering and challenging human rights violations.

People are excluded from mobile services

On top of the fact that many countries have not implemented any legal safeguards for personal data, including identity systems and biometric databases, when registration requires official government documents that many people do not possess or cannot afford to procure (whether due to costs the government charges for people to obtain the documents or because of transportation and time required to do so), people face incentives to try to circumvent SIM card registration laws, or else face exclusion. Compared to men, women are more likely to lack access to official government identification and be denied access to prepaid SIM cards.

People who cannot afford to, are unable to, or do not feel comfortable producing a valid form of government ID, or biometric information such as fingerprints, may be unable to purchase or activate prepaid SIM cards: thus, they can be denied access to places where they get information, communicate and share ideas, access government services, and use mobile banking and other mobile applications.

For example, after governments introduced SIM card registration laws, in South Africa, a major operator lost approximately 1 million subscribers, in Zimbabwe, two major operators lost roughly two million subscribers, and, in Kenya, more than 1.2 million subscribers were lost.

Another element of exclusion is the fact that governments are shifting costs to society when they mandate pre-paid SIM card registration. Additional burdens are placed on people in terms of requesting, potentially paying for, collecting, and transmitting documentation needed for registration. Depending on where people live and how accessible registration sites are, people may need to travel to a registration site. Mobile providers and retailers need to administer the registration process. Finally, both ordinary people and providers bear costs when new SIM card requirements are introduced, unregistered SIM cards need to be de-registered, and people whose SIM cards were de-registered seek to re-activate them.

The ability to participate in society should not be conditioned on providing personal information

Mobile devices and mobile services are increasingly becoming necessities—particularly in areas less served by other forms of information-technology infrastructure—for people to access education and health care information, stay informed about current events, buy and sell goods and services, participate in democracy, and stay in touch with one another. Mobile services provide access to important civic spaces that help promote healthy democracy and dissent. Access to such services should not be conditioned on turning over personal information that can be used to track and monitor people.

Mandatory SIM card registration laws have not been shown to improve security

While governments justify mandatory SIM card registration laws on the grounds that they assist in preventing and detecting crime, “there is no convincing empirical evidence that mandatory registration in fact systematically lowers crime rates,” and “no robust empirical studies that show that such measures make a difference in terms of crime detection.” (source: Jentzsch p. 3-5). Thus, the lack of evidence that SIM card registration helps lower crime rates makes this type of interference with the human right to privacy both unnecessary and disproportionate.

It is also worth noticing that SIM card registration schemes can be easily circumvented by people determined to engage in crime, by purchasing phones registered in someone else’s name, trading phones, and using fake forms of identification. The fact that these laws can be easily circumvented renders SIM card registration laws ineffective to reduce crime rates and makes them useful mostly as a mass surveillance tool.

Resisting mandatory SIM card registration laws

Despite the widespread adoption of mandatory SIM card registration schemes, advocates and community members have been challenging these policies.

In Uganda, Unwanted Witness has been raising awareness and campaigning against mandatory SIM card registration, exposing it as a threat against anonymity and privacy, and requesting that public authorities be held accountable for its implementation. A new data protection law enacted earlier this year represents a valuable possible mechanism to limit SIM card registration and implement safeguards against data misuse.

The Right2Know Campaign in South Africa went to court to obtain greater transparency about how the government uses information provided during registration, demanding that mobile operators disclose when and how often they accede to requests from law enforcement and other government agencies.

Although mandatory SIM card registration laws are increasingly widespread, they are not a foregone conclusion. There is still the opportunity for public discussion about the impacts on peoples’ rights, the disproportionate burdens people who are vulnerable may bear, the mass surveillance effects, room for abuse, and exclusion and suppression of peoples’ rights that can result.

Privacy International, its partner organisations, and other experts are working to push back against the SIM card registration trend by:

• raising awareness about the risks of SIM card registration, which outweigh any possible benefits;
• articulating oversight measures that are consistent with international human rights standards to policy makers; and
• advocating for better safeguards at the national, regional, and international level.

In particular, Privacy International advises governments to: 

• establish regulatory frameworks that have clearly defined and limited mandates for retention of communications data, and order judicial oversight in their individual request and delivery. 
• limit the collection and use of personal data for the implementation of public policies and the provision of public services to data that is necessary and proportional to the legitimate purpose pursued, by conducting a human rights impact assessment, and ensuring transparent participatory processes prior its implementation. 
• introduce safeguards to ensure that the rights of mobile telephone subscribers in relation to their personal data are guaranteed.
• if not in place, adopt and enforce a comprehensive data protection law to ensure the protection of the personal data of its citizens.

If you have any updates on SIM card registration laws or court cases in countries in Africa, please email research@privacyinternational.org.