whilst the individual items of information appearing on the face of a national identity card, such as a person’s name, age, height, sex, or citizenship, may not, taken in isolation, be intrinsically private or confidential, in the sense that there is ordinarily no reasonable expectation of privacy in respect of the mere disclosure of such attributes; their collection, compilation, retention, and use as an aggregated set of identifiers on a national identification card triggers a duty of confidentiality in respect of the authority obtaining the said data and a corresponding and/or transferred responsibility of confidentially in the case of an entity that obtains the said body of collated information, whether through access to the database of the National Identification Authority or by virtue of, as in this case, the voluntary submission of the said information by the individual himself.
Purpose of the Act and its relation to Article 18(2)
The Data Protection Act, 2012 (Act 843) was enacted to give substance to article 18(2) and essentially protects data or information of/about a person in the custody or possession of, or likely to come into the custody of the data controller. The Act therefore subjects data controllers and data processors to strict privacy responsibilities or obligations and fleshes out some of these protections as they pertain to the protection of one’s personal information.
Sections 17, 18, 20, 28 and 29: duties of data controllers and processors
Rather, the Act establishes a structured framework of systemic safeguards intended to regulate the entire lifecycle of personal data in the custody of data controllers and processors. Beyond simply prohibiting unlawful disclosure, the Act imposes affirmative duties on entities that collect or process personal information to ensure that the systems through which such data are handled are designed to minimize the risk of unauthorized access, exposure or misuse.
The Data Protection Act thus places an onerous duty on the data processor to ensure to the highest standard possible, the protection of privacy. Therefore the 1st and 3rd respondents should have had recourse to these provisions as they designed the system of re-registration of SIM numbers to avoid a situation where any agent would commercialise the information provided by registering other SIM numbers without the person’s consent.
