Reflections on the Proposed Mandatory SIM Card Registration Policy

JB TJIVIKUANAMIBIAN MOBILE telecommunication users will in future have to register their subscriber identification module (SIM) cards to be able to access communication networks. The new regulations have yet to be gazetted and operationalised. Currently, the registration of SIM cards is voluntary.

In many countries, consumers can buy prepaid or ‘Pay As You Go’ mobile SIM cards from retail outlets, usually with little or no paperwork involved. Unlike pay-monthly mobile SIM contracts, the activation and use of prepaid SIM cards doesn’t always require customers to register or present identity documents. In countries where prepaid SIM registration is not required, mobile users can access mobile services more easily, but can also voluntarily register with their mobile network operator in order to use additional services, such as mobile banking, that require identification. 

An increasing number of governments have introduced mandatory registration of prepaid SIM card users, citing national security, countering terrorism, organised crime and supporting law enforcement efforts. However, this approach is not universal. There are also countries that choose to address security concerns without requiring people to register. 

In Latin America, consumers are required to register their mobile handset (IMEI) number, which may not always be registered against the specific consumer’s mobile phone number (SIM). The focus is addressing handset theft rather than criminal activities. In other markets, SIM registration has also been seen as a way to address antisocial behaviour, to provide age verification and to help address mobile fraud. Meanwhile, we know for certain that mandatory registration makes digital surveillance and interception easier. 

However, to date, there appears to be no cogent evidence that mandatory registration leads to a reduction in crime. A number of governments, including those in the United Kingdom, the Czech Republic, Romania and New Zealand, have considered mandatory prepaid SIM registration but then decided against it. Initial reports have highlighted the absence of evidence in terms of providing significant benefits for criminal investigations as a key reason for rejecting this policy. 

In Mexico, for example, mandatory SIM registration was introduced in 2009 and repealed three years after a policy assessment showed it had not helped with the prevention, investigation and/or prosecution of associated crimes. 

In around 80 countries you need to show your ID card before you can legally buy a new SIM card. Around half of these countries are in Africa, where governments have been especially keen to know who is connected to which phone. 

Mandatory registration can also deny access to communication to the poor. Obtaining an official ID card usually requires a basic level of literacy and the means to travel. Amongst the millions of people who can’t get connected, or have seen their phones disconnected, in multiple countries are the poorest citizens who often lack ID papers.

Admittedly, there’s an absence of robust and adequately enforced data protection laws in most countries in Africa, where mandatory SIM card registration laws have been passed. In fact, only 43% of African countries have data privacy laws.

In 57% of countries in Africa, data processing occurs in a legal void, which means information collected as part of registration today could be kept indefinitely and be used for different purposes in future. In this context, there are a lack of requirements for how data is managed and stored, which is particularly concerning in the case of biometric data. 

In this connection, it will be imperative for Africa to increase the need for greater regional cooperation regarding the protection of people’s data. So far, only Ghana, Mauritius, Namibia and Senegal have ratified the African Union (AU) Convention on Cyber Security and Personal Data Protection, which was established in June 2014 and requires signatories to establish some legal, regulatory, and institutional framework. However, the Convention will only enter into legal force 30 days after the 15th AU member state ratifies it. Given the slow pace at which only five countries have ratified it so far, it remains unclear when that will happen. 

In summary, mandated requirements for SIM registration need to be practical. Balancing national security demands against protecting citizens’ rights must be a priority. While addressing security and criminal activity concerns is important, policy makers and regulators should ensure there are also appropriate privacy safeguards and effective legal oversight to protect consumers’ personal data and privacy. This is critical for building consumer confidence in any registration scheme. 

In an age of information overload, Sunrise is The Namibian’s morning briefing, delivered at 6h00 from Monday to Friday. It offers a curated rundown of the most important stories from the past 24 hours – occasionally with a light, witty touch. It’s an essential way to stay informed. Subscribe and join our newsletter community.