This article was originally published in Issue 1 of Southern Africa Digital Rights, an online publication produced under "The African Declaration on Internet Rights and Freedoms: Fostering a human rights-centred approach to privacy, data protection and access to the internet in Southern Africa" project.
Namibia has become the latest African country to introduce mandatory SIM card registration and data retention regulations that will have a far-reaching impact on online privacy and data protection in the country.On 28 April 2022, barely days before World Press Freedom Day 2022 was marked under the theme “Journalism Under Digital Siege”, conditions to be imposed on internet and telecommunications service providers were gazetted.
The newly gazetted regulatory conditions [1] followed from the gazetting of regulations under Part 6 [2] of the Communications Act of 2009 on 15 March 2021.
Part 6 of Namibia’s Communications Act [3] provides the enabling framework for wide-ranging telecommunications surveillance by the state, but has never been officially operationalised since the law was passed almost 13 years ago, because regulations for implementation had not been finalised in all that time.
The Part 6 regulations and conditions come at a time when Namibia is still busy formulating and drafting a data protection bill, a process that has also been ongoing for more than a decade.
However, while the Part 6 regulations and conditions have been gazetted, they have not been implemented as the directives, issued by the Minister of Information and Communication Technology (MICT) and the Communications Regulatory Authority of Namibia (CRAN), that set the operationalising date had not been issued yet by end May 2022.
The regulatory conditions and their potential threat to data and online privacy first came to light in October 2021, following reports of discussions [4] of the then draft conditions between the Communications Regulatory Authority of Namibia (CRAN) and telecommunications and internet service providers.
The regulations and conditions have come as Namibians appear to be highly suspicious of state communications surveillance practices.
The eighth round of the Afrobarometer survey, [5] from 2019, found that almost exactly 60% of respondents “agree with” or “very strongly agree with” the statement that people “should have the right to communicate in private without a government agency reading or listening to what they are saying”.
The threats
The danger that the Part 6 regulations and conditions pose to online and data privacy was articulated by the executive director of the Ministry of Information and Communication Technology (MICT), Mbeuta Ua-Ndjarakana in an official communique [6] issued on 26 October 2021, in which he stated: “The benefits of SIM card registration is that it eradicates anonymity of communications, which aids in legal surveillance and interception.”
The eradication of anonymity of communications is to be achieved through two ways that are extensively prescribed in the Part 6 regulations and conditions – through mandatory SIM card registration and data retention by telecommunications and internet service providers.
When selling and registering a SIM card or registering a customer for an internet connection, telecommunications service providers would be required to collect all sorts of identifying information or data from the customer.
The customer information to be collected is: the full name of the customer, the residential address of the customer; and the Namibian identity or passport or driving licence number of the customer.
In terms of data retention, telecommunication and internet service providers would also be required to store all telecommunications and internet traffic of all users for a period of five years.
The regulations and conditions mean that mobile phone and internet users in Namibia will all be instantly and permanently identifiable and trackable – the definition of continuous bulk or mass surveillance.
This sort of surveillance environment will probably have the effect of stifling critical media reporting, [7] as it enables the easy identification of journalistic sources and whistleblowers, as well as undermining lawyer-client or doctor-patient confidentiality, to point out just some of the obvious threats to sectors where privacy, anonymity and confidentiality are highly prized.
A legal response
For Namibian public interest law firm, the Legal Assistance Centre (LAC), there’s one important question swirling around the Part 6 regulations and conditions, and that is “whether Namibia’s requirements for telecommunications data collection and retention might be unconstitutional”?
In a policy brief [8] published around the time the conditions were being discussed and finalised, the LAC answered this question by stating “the scheme needs to comply with basic data protection principles – including measures pertaining to the security of the data and protections for confidentiality and the prevention of unauthorised access, as well as provision for the erasure or destruction of data after the requisite time period for its retention has expired”.
The legal assessment concludes that “it seems likely that Namibia’s telecommunications data retention scheme might be found to be an unconstitutional infringement of the right to privacy overall, given the intrusion into the privacy of large segments of the population in a manner that has a questionable ability to serve the intended objectives”.
The LAC assessment of the emerging Namibian surveillance environment echoes sentiments and concerns expressed by former UN special rapporteur on freedom of expression, David Kaye, in a report submitted to the UN Human Rights Council [9] in May 2015.
Kaye states of broad data retention regulations, such as those now on the verge of being rolled out in Namibia, that they “limit an individual’s ability to remain anonymous. A State’s ability to require internet service and telecommunications providers to collect and store records documenting the online activities of all users has inevitably resulted in the State having everyone’s digital footprint.”
He adds that a “State’s ability to collect and retain personal records expands its capacity to conduct surveillance and increases the potential for theft and disclosure of individual information”.
The special rapporteur’s report concludes, among others, that “Encryption and anonymity, and the security concepts behind them, provide the privacy and security necessary for the exercise of the right to freedom of opinion and expression in the digital age. Such security may be essential for the exercise of other rights, including economic rights, privacy, due process, freedom of peaceful assembly and association, and the right to life and bodily integrity”.
The report goes on to state that because “of their importance to the rights to freedom of opinion and expression, restrictions on encryption and anonymity must be strictly limited according to principles of legality, necessity, proportionality and legitimacy in objective”.
It is these principles that civil society organisations, such as the LAC and the Institute for Public Policy Research (IPPR), an independent Namibian think-tank which has for years been sounding the warnings on the looming threats of increased state surveillance powers through law and regulation, have been citing to advocate for transparency and accountability around state surveillance measures and mechanisms in order to minimise the avenues for surveillance abuse and overreach.
As the Namibian state moves to implement the Part 6 regulations and conditions, these CSOs and others are looking to increase their advocacy engagements around the emerging state surveillance environment.
Notes:
[1] https://drive.google.com/file/d/1jAQyI7eiuuRAjhxY0k4EE-AFFGnOnwe/view
[2] http://www.lac.org.na/laws/2021/7481.pdf
[3] https://www.lac.org.na/laws/annoSTAT/Communications%20Act%208%20of%202009.pdf
[4] https://www.namibian.com.na/6214602/archive-read/Civil-society-warns-against-Govt-phone-spying
[5] https://www.afrobarometer.org/wp-content/uploads/2022/02/afrobarometer_sor_nam_r8_en_2019-12-03.pdf
[6] https://drive.google.com/file/d/1bn9NaAgSyJoQgzm_kp4gNNrRobxw95QU/view
[7] https://ispeak.africa/fearless-journalism-under-threat/