Pre-paid SIM cards are preferred by many mobile phone users. According to GSMA, 73% of mobile subscriptions globally are pre-paid. In Africa, 94% of mobile subscriptions are pre-paid. In Central America it is 87%, in Asia 79%, Southern America 68%, Europe is 50%, and in North America 21% of mobile subscriptions are pre-paid.
If a mobile phone user has a 'pay monthly' contract with an operator there is usually some kind of credit check, and personal details are kept for billing purposes. With a pre-paid or 'pay as you go' SIM card, there is no reason to keep personal details.
However, as of January 2020, 155 countries have mandatory SIM registration laws. See Privacy International's timeline of SIM registration laws here. As a condition for the purchase or activation of a pre-paid SIM card, the user is asked to provide personal information as well as a valid ID. Security and fighting crime are usually cited as justification. Governments take different approaches to mandatory SIM registration and GSMA has grouped the approaches into 3 categories:
Capture and Store: Operators capture personal information upon the purchase of a pre-paid SIM card and keep the records, sharing information with government agencies on demand. 81% of countries with mandatory SIM registration laws use this approach.
Capture and Share: Operators capture personal information and proactively share it with government agencies or the regulator. 6% of countries with mandatory SIM registration laws use this approach.
Capture and Validate: Operators capture personal information and validate it against a central government database. 12% of countries with mandatory SIM registration laws use this approach.
What is the problem?
Despite mounting evidence that mandatory SIM registration is costly, intrusive and not the solution to the problem most countries are trying to solve, every year more governments try to roll it out.
SIM card registration is often introduced in a legal void. According to GSMA, only 59% of countries mandating SIM card registration have a privacy and/or data protection framework in place. In the absence of comprehensive data protection legislation and oversight, SIM users' information can be shared and matched with other private and public databases, enabling the state to create comprehensive profiles of individual citizens, and enabling companies and third parties to access a vast amount of data. SIM registration is being taken to the next level and incorprating biometric registration in some countries, such as fingerprints and facial recognition. This means that the data processing required for the creation of a biometric subscriber database will also often occur in a legal void, so that information collected as part of registration today could be kept for an indefinite amount of time and used for different purposes in the future, as technology, corporate incentives, or governments change.
By facilitating the creation of an extensive database of user information, mandatory SIM registration places individuals at risk of being tracked or targeted, and having their private information misused. SIM registration undermines the ability of users to communicate anonymously and one’s right to privacy. This poses a threat to vulnerable groups, and facilitates surveillance by making tracking and monitoring of users easier for law enforcement authorities. Mandatory SIM registration can enable profiling with several consequences. An individual's phone number could potentially be matched with their voting preferences or health data, enabling governments to identify and target political opponents, for example, or people living with HIV/AIDs. In countries with political and ethnic tensions, pairing data with political activity might result in physical risks for the people involved. While communications surveillance systems may help a government improve national security, they are equally likely to enable the surveillance of human rights defenders, political, immigrants, and other groups.
Discrimination and Exclusion
SIM registration also brings the potential for discrimination and even exclusion from basic services. This practice disproportionately disadvantages the most marginalised groups and can have a discriminatory effect by excluding users from accessing mobile networks.When mobile phones are the most common form of accessing important avenues such as banking and finance, this could result in exclusion from numerous vital public services. In some countries, the poorest individuals are often unable to buy or register SIM cards because they don't have identification documents. Undocumented migrants can face a similar problem. In addition, given the extra burdens that SIM registration places on telcos, this may result in additional costs being passed on to customers.
What is the solution?
Mandatory SIM card registration is yet another way for government and industry to build identity systems to support their needs to administer, govern, and profit. In turn, they are being used to facilitate targeting, profiling and surveillance. It is essential to limit the purposes for which any identity system is built and used.
Such laws are often defended on the flawed assumption that they help fight crime. A 2016 GSMA report states there is no empirical evidence that mandatory SIM registration directly leads to a reduction in crime. The practice has been exposed as ineffective and inefficient in some countries that have adopted its use. For example, in Pakistan, requiring SIM card registration resulted in the emergence of black markets for unregistered SIM cards, and a rise in identity fraud. Mexico’s card registration law was enacted in 2009 but was repealed just three years later after yielding no improvement in the prevention, investigation, and prosecution of associated crimes. Canada, the Czech Republic, Ireland and the Netherlands have all rejected proposals to establish a similar measure.
With a lack of evidence to support the reasons governments give for introducing mandatory SIM card registration and the negative impacts on a range of rights, PI questions the need and justification for the practice.
What is PI doing?
Closely tied with our work on identity, PI supports civil society partners in our network and beyond to push back on mandatory SIM card registration proposals and hold governments to account. This enables us to:
- Scrutunise the justification of governments adopting mandatory SIM card registration and encourage public justification based on evidence, cost and public debate.
- Advocate for stronger data protection.
- Challange the procurement of such systems where they are found.