This article was originally published in Issue 3 of Southern Africa Digital Rights, an online publication produced under the project "The African Declaration on Internet Rights and Freedoms: Fostering a human rights-centred approach to privacy, data protection and access to the internet in Southern Africa".
Biometrics are being collected for various purposes in Namibia mostly without legal authorisation protection. However, the forthcoming Civil Registration and Identification Bill is expected to lead the way in providing data protection safeguards for personal data including biometrics, while the Data Protection Bill that is in the works will hopefully expand data protection safeguards.
Civil registration and identification
Namibia is in the midst of overhauling its civil registration and identity management systems through the Civil Registration and Identification Bill which is expected to make its way through Parliament in 2023. [1] Many aspects of the new approach contained in this Bill are already in place in practice.
The key innovation in the new system is to link e-notices of birth and death with the identity management system. When a birth takes place in a hospital, medical personnel send an electronic e-notice of the birth to the Ministry of Home Affairs, Immigration, Safety and Security.
One or both parents then apply for birth registration, which has been made more convenient by the provision of registration points at health facilities. The e-notice provides reliable verification that the birth in question took place, and provides information for follow-up if no parent comes forward to complete the registration process.
The proposed law also makes provision for birth registration in respect of children born outside a health facility, abandoned or orphaned children, and for late birth registration of persons of any age. A unique identifying number is assigned to each individual at the time of birth registration.
Deaths are similarly verified by means of an e-notice issued by a health facility or a mortuary, to ensure that death registrations can be confirmed through links to clear physical evidence of the death. Reliable death registration, although often neglected in discussions of civil registration, is vital in the maintenance of a reliable identification database.
Against this backdrop, most people resident in Namibia are required to apply for an identity document upon reaching the minimum age – currently age 16 but set to drop to age 14. Under the proposed law, this duty would apply to citizens, permanent residents, non-citizens with legal authority to be present in Namibia for longer than one year, refugees and other categories of persons that may be identified in future by the Minister – with the colour of the ID card currently indicating the category in question.
The biometrics currently required for the issue of an identification card are a photograph, fingerprints of all ten fingers and any other biometrics that may be set out in future by regulation. [2] For persons whose births were registered in Namibia, the identification number on the ID card will be either the unique identifier assigned at the time of birth registration, or another unique number linked via a confidential system to the birth identifier. Older IDs had a representation of a fingerprint and a bar code on the back, but since 2020, the prescribed format contains a QR code and a machine-readable zone (as illustrated). [3]
Identity documents are generally welcomed in Namibia as the means to facilitate access to education, state welfare benefits and financial services, as well as providing a basis for exercising rights (such as the right to vote) and providing access to a host of other public and private transactions.
In terms of an agreement between Namibia and Botswana, Namibia’s new-style ID cards are recognised as travel documents for citizens moving between the two countries – with this approach expected to spread to other SADC borders. [4] A spokesperson for Amnesty International recently welcomed this move, pointing out that it will reduce barriers to migration and provide an economic boost to informal cross-border traders, especially women – thereby contributing to the alleviation of poverty and food security. [5]
Data protection safeguards in the Civil Registration and Identification Bill
The Bill incorporates key data protection principles, which is particularly important given that it is expected to reach Parliament well ahead of the draft Data Protection Bill that is under development.
Access to information in the Ministry’s database is strictly regulated by the Bill, although individuals will have a clear right to access information about themselves and to motivate corrections where necessary. There are clear duties of confidentiality with respect to personal data, and access to the database by staff members can be monitored by means of a digital trail.
Data-sharing with other organs of state or with private entities will take place only in terms of memorandums of agreement, and key information regarding such agreements must be published. Law enforcement agencies seeking access to information in the database must use the normal legal procedures that govern searches in other contexts – with the sole exception of accessing fingerprints or other biometric data for the purpose of identifying the body of a deceased person. Access by various intelligence agencies must similarly follow the legal procedures in the laws governing those agencies, which typically require a warrant or other judicial authorization.
Any person will be entitled to reasonable information regarding the security of the database (although only to an extent that will not compromise that security), and the Ministry will be required to maintain an access register that records instances of information-sharing.
Other instances of biometric data collection and use
In 2018, Namibia’s Ministry of Home Affairs introduced a new e-Passport with an electronic microprocessor chip containing biometric information that can be used to authenticate the identity of the passport holder, in order to comply with International Civil Aviation Organization requirements. [6]
Furthermore, Namibia is in the process of rolling out an Integrated Border Management System, in which scans of travellers’ faces and digital fingerprints are checked against various international watch lists such as lists of wanted criminals, missing persons and lost or stolen travel documents. The data collected at the border is held in a central database hosted by the Ministry. [7] Although such systems at international borders are not unusual, some analysts have expressed concern about possible compromises to the confidentiality of the data in the Namibian system due to the cross-linking across different systems, as well as concerns about the possible ramifications of government dependence on private operators for system function and maintenance. [8]
Other Namibian government agencies also routinely collect biometric data. One example is the procedure for voter registration under the Electoral Act. This law requires potential voters to provide a digital image and digital fingerprints [9] – even though many prospective voters will present their Namibian identification card, which is already linked to a fingerprint database. The voter registration card displays a barcode with encrypted registration details, including the voter’s name, surname and address along with information on which elections the voter is qualified for (with local and regional elections requiring proof of residency in the relevant constituency or local authority). [10] An electronic “Voters’ Registration Kit” at the polling place uses a digital fingerprint scanner to verify the voter’s fingerprints against the fingerprints on the electronic voters’ roll and produces a record that the voter has voted in the election in question. There is also provision for manual verification if necessary, such as where the barcode is damaged in some way and cannot be scanned. [11]
The process of obtaining a Namibian driving licence also requires a digital image and digital fingerprints (with a manual option in case the driving testing centre does not have the requisite equipment). [12] The driving licence contains a barcode on the reverse side that captures information about the driver, which is linked to an automated biometric system to ensure that the licence is collected by the person to whom it is issued. [13]
Another biometric data collection point is the procedure for applying for Certificates of Conduct from the Namibian Police which provide information on past criminal convictions. These are required for many purposes in Namibia, including tender bids and many job applications. The application procedure involves the taking of digital fingerprints for comparison against the police database, in an effort to ensure that the information provided is accurate. [14] The fingerprints that are collected for this purpose are saved and stored by the Namibian Police, despite the lack of any underlying law governing this process. [15]
Biometric verification is also used in connection with several social grants – either through fingerprint verification against the recipient’s Namibian ID, or in the case of benefits provided to veterans of the liberation struggle and their dependants, by means of a separate registration card that includes a photograph, fingerprint and registration number. [16]
Another example concerns the recently-introduced requirements for SIM card registration in Namibia’s Communications Act, which requires telecommunications service providers to collect and retain certain information about their customers. [17] The current regulations require service providers to collect a customer’s full name, address and Namibian identity number (which can be substituted by some other form of identification if necessary). The service provider is required to store this information in a manner that allows for retrieval via the customer’s name. [18] Service providers are required to store information about the source, destination, date, time and duration of all their customers’ telecommunications along with other data – but not including the content of the communication – for at least five years. The Namibian Police or the Namibia Central Intelligence Service can access the stored information with authority from a judge or a magistrate. [19]
The Communications Act makes no mention of biometric collection, but this SIM card registration process is being combined with “voluntary” biometric collection by Namibia’s biggest cell provider, MTC – a company in which the government is a majority shareholder. [20] MTC is promoting a digital ID with biometric verification called “Verifi” which was initially presented as an optional way to enhance customer convenience in transactions with MTC, such as SIM cards when a phone is stolen or damaged. [21] In January 2023, MTC announced that the biometrically-supported Verify tool would henceforth be a requirement for accessing any MTC services. Assuring customers that this would also cover the requirements of the government-mandated SIM registration. [22] The company promises that the biometrics collected will not be shared without the express consent of the customer, but there is no legal framework as yet to back up this assurance. [23]
This is just one instance of private sector collection of biometrics. Other Namibian companies, including medical aid schemes and financial entities, also collect biometrics. [24] While the consumer in theory has the option to choose another company if there are objections to this approach, Namibia’s small economy and thin competition will in many instances make the idea of free choice on this point nothing more than an illusion.
Namibia’s Data Protection Bill
The widespread increase in biometric data collection and storage makes it urgent for Namibia to enact a strong data protection law. Although a draft has been circulated for discussion, much work is still needed before it will be ready to move forward. The Bill covers the basic international principles on the protection of personal data, but needs strengthening and refinement.
The draft currently on the table places restrictions on the processing of biometric and genetic data, but the proposed exceptions need to be carefully considered. [25]
The way forward
There has been little public concern or debate about the collection or security of biometric data. On the one hand, a verifiable identity system is a lynchpin of the government’s goal of increasing e-government services – which has the capacity, in the best scenario, of increasing access to government in Namibia’s far-flung rural areas. [26]
The improved civil registration and identity management system is envisaged as a foundational system that can ultimately eliminate the need for overlapping biometric data collection and storage by multiple government agencies. The countervailing concern is the need to make sure that inter-operative databases are secure, and that compromised data cannot reveal a multiplicity of information about an individual if encoded linkages to the underlying ID number are penetrated. [27]
The wording of the Namibian Constitution’s privacy provision is somewhat narrow. focussing on the right to privacy in respect of “homes, correspondence or communications” – and thus arguably does not cover the collection of biometric data. [28] However, the broader privacy provisions of the International Covenant on Civil and Political Rights [29] are incorporated into Namibian law by virtue of Article 144 of the Namibian Constitution which makes international agreements binding upon Namibia part of the law of Namibia. [30] Namibia has also ratified the 2014 African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention) – which has not yet garnered sufficient support to come into force. [31] Namibia is in the process of crafting a Cybercrime Bill. [32]
In September 2022, representatives of civil society met to discuss a “Namibian Digital Rights Declaration” which sets out some key principles aimed at ensuring that digital spaces respect and enable rights and serve the public, including vulnerable and marginalised groups. One of the provisions in the draft demands that “privacy and the protection of personal information on- and offline must be urgently prioritised and rights-based safeguards must be enacted in legislation”. [33]
Biometric information collection is widespread in Namibia across various contexts, yet public attention towards privacy remains relatively subdued. The issue might only attract significant prominence if an information leak occurs, causing alarm. It is crucial that the Data Protection Bill is not eclipsed by any potential damaging data breaches and progresses swiftly to safeguard against such risks.
Notes:
1. The author served as a technical adviser to the Ministry of Home Affairs, Immigration, Safety and Security during the development of this Bill.
2. “Biometrics underpin the uniqueness of identity and bind identities to specific identity holders. Proof of identity is key to maintaining a robust national population register and upholding data integrity. This also ensures that documents such as birth and death certificates, identity cards, and passport and travel documents are trustworthy. In turn, population data integrity means that linked functional registers are accurate.” “Case Study 4: Namibia” in Centre of Excellence for Civil Registration and Vital Statistics (CRVS) Systems, Compendium of Good Practices in Linking Civil Registration and Vital Statistics (CRVS) and Identity Management Systems, Ottawa: International Development Research Centre, 2019, page 103.
3. Identification Regulations, 2001, as amended (issued under the current Identification Act 21 of 1996, which will be replaced in due course by the Civil Registration and Identification Bill. 4. Namibia Daily News, “Botswana and Namibia launch National ID Cards as travel documents at port of entry/exit”, 24 February 2023; Gerhard Erasmus & Trudi Hartzenberg, “Botswana and Namibia concluded an agreement on the movement of persons”, Tralac, 8 March 2023.
5. “Botswana/Namibia: Accord on free movement between countries a ‘step in the right direction’”, Amnesty International, 24 February 2023, quoting Tigere Chagutah, Amnesty International’s Director for East and Southern Africa.
6. Stephen Mayhew, “Namibia makes the switch to biometric passports”, Biometrics News, 8 January 2018; Case Study 4: Namibia” in Centre of Excellence for Civil Registration and Vital Statistics (CRVS) Systems, Compendium of Good Practices in Linking Civil Registration and Vital Statistics (CRVS) and Identity Management Systems, Ottawa: International Development Research Centre, 2019, page 102.
7. “Namibia invests in world-class border management”, Thales Group [the company providing the border technology to Namibia], undated. The system has been in place at Hosea Kutako International Airport in Windhoek, since September 2017 and will eventually be extended to all of the country’s land, sea, and air borders.
8. Carolina Polito & Dr Cristina Alaimo, “The Politics of Biometric Technologies: Borders control and the making of data citizens in Africa”, European Conference on Information Systems (ECIS), Research-in-Progress Papers 78, 2023.
9. Electoral Act 5 of 2014, section 30.
10. Regulations relating to Registration of Voters, Political Parties or Organisations, 2015, regulation 5(2).
11. “Frequently-asked questions”, Electoral Commission of Namibia website, accessed 11 May 2023; see also Namibia Presidential and National Assembly Elections, Report of the Commonwealth Observer Group, 27 November 2019, pages 17-18.
12. Road Traffic and Transport Regulations, 2001.
13. See “New Driving Licences Are Here”, Erongo News, 11 February 2022, quoting Minister of Works and Transport, John Mutorwa.
14. See the discussion of police clearance certificates in “A Sex Offender Register For Namibia? Right Idea, Wrong Solution”, Legal Assistance Centre, Pro Bono series, 2022.
15. Personal communication, Criminal Records Office, Namibian Police, May 2023.
16. Veterans Act 2 of 2008, sections 27-ff; Regulations relating to Registration and Benefits of Veterans and Dependants of Veterans, 2008, regulation 6.
17. Communications Act 8 of 2009, section 73: Duty to obtain information relating to customers.
18. Regulations in terms of Part 6 of Chapter V of the Communications Act, 2021, regulation 7.
19. Id, regulations 3 and 5.
20. Until 2021, MTC was wholly owned by a government entity (Namibia Post and Telecommunications Holdings Limited). MTC Company Profile 2021-2022, “Who We Are” (unpaginated). The company was listed on the Namibian Stock Exchange in 2021, with a minority of its shares being offered for sale. See, for example, “Govt to raise N$3bn from MTC listing”, The Brief, 31 July 2021; Ogone Tlhage, “NPTH Undecided Over Unsold MTC Shares”, Namibian Sun, 8 July 2022.
21. MTC Press Release: MTC Introduces Biometrics And Artificial Intelligence To Protect Consumer Data”, 12 January 2021.
22. “MTC Press Release: MTC Verifi KYC Tool in relation to SIM Registration”, 31 January 2023.
23. Ibid.
24. For instance, some medical aid providers provide member identification cards that encode digital fingerprints.
25. “Thinking about data protection” and “LAC submission on the draft data protection bill” in Perspectives on Parliament, Issue No. 17, Institute for Public Policy Research (IPPR), December 2022.
26. e-Government Strategic Action Plan of the Public Service of Namibia (2014-2018). Alletto Shikololo, “Home affairs embraces e-governance…online passports, work visa applications launched”, New Era, 16 March 2023. The Electronic Transactions Act 4 of 2019, which provides for the legal recognition of electronic transactions, also helps set the stage for increased e-government.
27. “Case Study 4: Namibia” in Centre of Excellence for Civil Registration and Vital Statistics (CRVS) Systems, Compendium of Good Practices in Linking Civil Registration and Vital Statistics (CRVS) and Identity Management Systems, Ottawa: International Development Research Centre, 2019, page 105; Stephanus van Staden, “Moving the Namibia Civil Registration and Identity System towards an Unified and Federated Service Oriented Population and Identity Management Platform”, 2017.
28. Namibian Constitution, Article 13: Privacy. Article 13(1) states: “No persons shall be subject to interference with the privacy of their homes, correspondence or communications save as in accordance with law and as is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the protection of health or morals, for the prevention of disorder or crime or for the protection of the rights or freedoms of others.
29. International Covenant on Civil and Political Rights, 1966, Article 17: “1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. 2. Everyone has the right to the protection of the law against such interference or attacks.”
30. Namibian Constitution, Article 144: International Law.
31. African Union Convention on Cyber Security and Personal Data Protection, 2014. The AU reported 14 ratifications as of 11 April 2023; see the status list here.
32. Frederico Links, “Familiar Flaws - Unpacking Namibia’s Cybercrime Bill”, Institute for Public Policy Research (IPPR), March 2022.
33. “HAVE YOUR SAY! Draft Namibian Digital Rights Declaration open for public input”, Action Coalition website, 4 October 2022.