POTRAZ's Phone Registration: Security Boost or Rig...

POTRAZ's Phone Registration: Security Boost or Rights Bust?

By Nyashadzashe Ndoro

Chief Reporter

Observers have raised significant legal and constitutional questions regarding the recent proposal by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) to mandate the registration of all cellphone handsets in the country.

The regulatory body argues that this measure is necessary to enhance the security of electronic transactions and combat rising cybercrime.

POTRAZ's competition and standards manager, Engineer Hasha Myambo, stated a few days ago that the authority is lobbying the government for a "corresponding instrument" to the existing SIM card registration, which would establish a Central Equipment Identification Database (CEID) for handsets.

This database would allow for the blocking of stolen or lost devices across all networks upon reporting. Eng Myambo emphasized the need for policies to address cyber vices and believes the initiative signifies a move towards a more collaborative regulatory approach within the ICT sector.

However, a legal opinion raised by prominent lawyer and former Cabinet Minister Fortune Chasi highlights several critical concerns. The opinion points out that currently, no explicit statutory basis exists for mandatory handset registration under the Postal and Telecommunications Act [Chapter 12:05]. Chasi argues that POTRAZ's power to regulate telecommunication services does not expressly extend to device registration, suggesting that any such requirement would likely necessitate an amendment to the existing Act or the enactment of new legislation. Imposing this through regulation or directive alone could be deemed legally invalid ("ultra vires").

"There is currently no explicit statutory basis for mandatory handset registration in Zimbabwe. POTRAZ cannot unilaterally impose such a requirement without an amendment to the Postal and Telecommunications Act or the enactment of new enabling legislation. Any attempt to do so via regulation or directive alone may be ultra vires," Chasi stated.

Furthermore, the legal analysis delves into the constitutionality of the proposal, particularly concerning the right to privacy enshrined in Section 57 of the Constitution of Zimbabwe (2013). Linking IMEI numbers to individual identities is classified as intrusive personal data collection. The opinion warns that without robust safeguards, including judicial oversight, independent review, and public accountability, such a system risks infringing upon citizens' privacy rights.

The principle of necessity and proportionality is also questioned. While acknowledging the legitimate aims of public security and crime prevention, the legal opinion suggests that the proposed blanket handset registration might not be the least restrictive means to achieve these goals. It proposes exploring alternative measures such as enhanced SIM registration, mobile application controls, or a voluntary CEID registration system.

Adding to the debate, Linda Masarira, leader of the opposition party Labour, Economists and African Democrats (LEAD), has strongly criticised the proposal.

Masarira described mandatory handset registration as an "excessive, invasive, and potentially regressive approach." While acknowledging the seriousness of cyberbullying, she argued that existing legal frameworks, such as the Cyber and Data Protection Act, which criminalizes cyberbullying, are sufficient. Masarira believes the focus should be on enforcement and strengthening digital forensic capabilities rather than implementing a "blanket surveillance system."

She raised specific concerns regarding potential infringements on privacy rights and freedom of expression, fearing state surveillance and monitoring. They also highlighted the risk of criminalizing innocent citizens and the potential for economic exclusion if the policy increases the cost of mobile connectivity. Instead of mandatory registration, Masarira recommends strengthening digital forensic units, public education on digital literacy, partnerships with civil society and tech companies for safe reporting platforms, and investment in youth support systems.

Drawing comparisons with other African nations, Chasi notes that in Kenya, a Central Equipment Identity Register (CEIR) system exists under statutory authority, while in South Africa, the RICA Act mandates SIM registration but not general handset registration. Both jurisdictions operate under clear legislative mandates with avenues for judicial oversight.

"Under the Communications Authority of Kenya, a CEIR system exists and requires operators to block blacklisted IMEIs. This is done under statutory authority and in conjunction with consumer protection regulations.

"The RICA Act (Regulation of Interception of Communications and Provision of Communication-Related Information Act) mandates SIM registration but does not extend to handset registration except through voluntary or law enforcement tracking processes.

"In both jurisdictions, device registration is done under clear legislative mandates, and judicial oversight is available where constitutional rights may be infringed," he stated.

Meanwhile, POTRAZ, according to Eng Myambo, is lobbying the government to implement mandatory registration of all mobile phone handsets, linking them to existing SIM card holder databases.

“There is a need for appropriate policies to address the different vices that happen in cyberspace,” Eng Myambo said.

".....we are lobbying for a corresponding instrument that puts in place a Central Equipment Identification Database for handsets to which operators subscribe.”