(Photo: Unsplash / Enrique Alarcon)
The Ministry of Interior’s draft identity management stipulates that biometric information captured by surveillance cameras – equipped with facial recognition software – is linked to the population register and communicated to the police. It demands that suspects be searched without guarantee and that all personal information – including biometric data – be available to the police without a court order.
Melissa Cawthra is Program and Research Officer at the African Policing Civilian Oversight Forum (APCOF).
In the information age, data is a valuable currency and South African officials are sitting at a gold mine.
Most of us know them Sassa / CPS scandal Meanwhile: Corruption, fraud and mismanagement within the government’s social security agency resulting in the personal data of 17 million grant recipients being lost by the company they commissioned the payments with. This, in turn, results in illegal and unauthorized withdrawals from Sassa Fellows bank accounts by unscrupulous third parties who pursue the most vulnerable members of society through airtime, funeral policies and loan programs.
It is a cautionary story about the possible excesses of state power, the extent to which individuals’ rights to privacy can be violated if those powers are largely neglected, and the disproportionate effects that lack of oversight and regulation can have on poor and marginalized communities can.
The long-awaited operationalization of the Personal Data Protection Act (Popia) drawn up in 2013 will become reality on July 1, 2021. The Information Regulator (Popia’s Custodian) has published general publications Guidelines on the development of codes of conduct for the processing of personal data on its website. The guidelines are intended as a benchmark for a broad group that includes relevant bodies, stakeholders and the regulator itself. However, they lack details on how to regulate specific surveillance technologies and there remain concerns about the misuse of personal data in the hands of government officials.
In general, these concerns are about giving the police and the Home Office (DHA) excessive discretion in the collection, processing and storage of sensitive personal information from nationals and foreigners. At Popia, the processing of personal data is permitted in certain exceptional circumstances. Exceptions include national security issues (such as the prevention of crime and terrorism) but are subject to controls and balancing to ensure that the processing is necessary, justified, proportionate and meets the requirements of international norms and standards of human rights law.
The DHA’s draft Identity Management Policy, funded by SAPS and the Justice Department, calls for biometric information to be captured by surveillance cameras installed in public spaces with facial recognition software. be linked to the DHA population register and that this database is shared with the police; allegedly to improve the efficiency of criminal investigations. While the DHA is pushing its plans to migrate the database to a biometric system, there is still no legislation regulating police use of facial recognition software.
The draft directive provides that suspicious searches of suspects and all personal information – including biometric data – be made available to the police without a court order in the interests of national security.
There are currently no clear rules governing video surveillance and related surveillance technologies in South Africa. There is also no coordination between the laws that regulate surveillance. The information regulator needs to fill this loophole by enforcing a set of norms and standards for surveillance operators. Guidance on how to balance the benefits of this technology as a crime-fighting tool with basic data protection rights. At the heart of this process is the development of a code of conduct for surveillance systems: a set of legally binding rules with instructions on how to install and use certain technologies to ensure compliance with Popia regulations and align South Africa with international privacy standards.
The code should contain guidelines regarding facial recognition software, big data and information matching, as well as security measures for the ethical and responsible use of surveillance technology. The one from the The British Commissioner for Surveillance Cameras and published on its website provide a good benchmark and could be a useful template for developing a code of conduct for South African surveillance operators. The regulator must also clarify the interaction between Popia and the existing international and national surveillance and data protection laws.
The proposed guidelines described above are detailed and appear to violate the principles of purpose, openness, restriction of further processing and security measures. This means that they may not meet four of the eight conditions set out in Popia for lawful processing.
Furthermore, and especially against the backdrop of other official measures taken on the pretext of containing the spread of the virus (e.g. criminalizing misinformation and disinformation related to Covid-19) – all point to a worrying trend towards state overreach in the processing of sensitive information of citizens and in the more comprehensive regulation of control and the flow of information within the borders of the SA: there is an obvious risk of granting the authorities unrestricted access to the population register in a country already affected by corruption , Police operations and police operations affected is a long history of illegal state espionage.
These are matters that come under the mandate of the information regulator, which must act urgently to bring the law into full effect with which it must comply. While the regulator faces major human and funding challenges, it no longer has the luxury of neglecting its core mandate regardless of internal malfunctions.
When its resources are so limited that it cannot carry out its duties, the regulator should look for alternatives, such as strong partnerships with civil society actors to address these issues and provide oversight. DM