‘Who am I?’ you ask … ‘We’re not sure’, Home Affairs answers
Home Affairs is the undisputed custodian of identity, but it has stated that it cannot efficiently and securely deliver identity services
For any country, it is important that a government has systems in place. For every person, the state needs to know, among other things, name, date and place of birth; nationality; whether the person is alive or dead, married or single and the details of their children.
Neither the state nor society in general can function if individual identities are unknown. The Department of Home Affairs is the undisputed custodian of identity. However, identity must be managed within the framework of the Constitution, and the human rights of citizens must be respected and protected.
It has been argued that there is a level of re-alignment required in SA when it comes to identity and immigration services. The Department of Home Affairs has stated that as presently constituted, it is not able to efficiently, securely and strategically deliver identity and immigration services. Therefore, plans are under way to put in place a comprehensive and secure national identity system.
As citizens, we should welcome a comprehensive and secure national identity system. This would reduce fraud, improve services and enhance investment opportunities. It will also form the backbone of a national security system. It is important for security purposes to know the citizens in SA.
But unfortunately, the Department of Home Affairs says it operates without critical specialists needed to develop and manage systems and protect data from being compromised by criminal syndicates.
These debates directly relate to personal information. The question therefore is what constitutes personal information. Personal information is a very wide concept in terms of the Protection of Personal Information Act (Popia), act 4 of 2013. Personal information is any "information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person".
Ordinary personal information includes, among others:
• Identity numbers, any identifying numbers (e.g. a passport number but also the unique number that a company gives to its customer);
• Information about where a person is (e.g. information that a GPS on a cellphone would track); and
• Biometrics of a person: Any unique physical, physiological or behavioural characteristics that can be used to identify an individual. Examples include fingerprints, DNA analysis, blood type, retinal scans and voice recognition.
The fundamental purpose of Popia is to give effect to the constitutional right to privacy. The right to privacy, which is protected by section 14 of the Constitution, includes information privacy, which is a person’s right to control access to, and the use of, private information whether by the government or the private sector.
Popia applies equally to processing activities undertaken by "public bodies". However, Popia does not apply to a public body when the processing of personal information relates to national security ("national security" includes the identification of financing used for terrorist and related activities or the defence of public safety); or when the public body is involved in preventing, detecting, investigating or proving offences prosecuting offenders or executing criminal sentences.
These two exclusions only apply to the extent that "adequate safeguards have been established in legislation for the protection of such personal information". One has to consider the integrity of the information as well as security and security safeguards when it comes to personal information.
Section 19 of Popia provides that a responsible party must ensure the integrity and confidentiality of the personal information in its possession by putting "appropriate" and "reasonable" technical and organisational measures in place to prevent the loss of, damage to, unauthorised destruction of, unlawful access to or unlawful processing of personal information.
The question is, how would reasonableness be determined by the Department of Home Affairs, given that it has stated that it is unable to efficiently, securely and strategically deliver identity and immigration services?
Security must take into account in the design, testing and piloting of systems, and there must be adequate disaster recovery, business continuity and redundancy. These are matters that would require detailed attention when it comes to the national identity system.
Also, South Africans will have to own the vision of a modern Home Affairs and support the capital investment needed to build a capable department and highly secured agile systems. The Department of Home Affairs will need to build, maintain and secure the systems, infrastructure and organisation necessary for the management of identity and international migration.
It is therefore proposed that the sale of identity services and products would constitute a revenue stream for this development and also that potential partners could include the government printing works, the Council for Scientific and Industrial Research and private-sector companies. Funding requirements set aside, where does this leave the individual citizen in terms of his/her Constitutional right to privacy and the protection of personal information?
What has been envisaged is that certain official transactions will require an individual’s identity to be verified — for example, the transfer of a house or a vehicle would attract a fee for a check against the national identity system on a cost-recovery basis.
Other examples of foreseen mandatory compliance requiring Department of Home Affairs biometric identity checks are events such as banks complying with Fica legislation requirements, airlines verifying the identity of passengers, telecom providers for Rica compliance and higher education student verification for registration and access to examination centres.
State security and your personal information require rights to be balanced, and checks and balances will be required to ensure the integrity as well as security of personal information. We all have rights and all rights must be balanced. Will Home Affairs be able to do so? Only the future will tell.
• Burger-Smidt is director at Werksmans Attorneys