The Mandatory Registration of Prepaid SIM Card Users A WHITE PAPER - NOVEMBER 2013 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users CONTENTS Executive summary 4 1 Objectives 6 2 Background 3 Mandating prepaid SIM registration for national security: Perceptions and reality 4 4.1 4.2 7 10 Unintended consequences of mandatory prepaid SIM registration 12 Impact on society Impact on industry 12 14 The positive outcomes of SIM registration 15 5 5.1 Greater access to e-­Government services 15 5.2 Creating opportunities for m-Commerce 17 5.3 Making it easier for users to keep their mobile number when switching to another network operator 18 5.4 Supporting governments’ financial inclusion agendas 18 Impact assessment factors: Will mandatory prepaid SIM registration be effective? 20 6 7 Recommendations on developing effective registration rules 21 7.1 Consumer-­related issues 21 7.2 Industry-­related issues 27 7.3 Broader regulatory issues 29 8 2 Conclusion 31 3 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 1. Executive Summary In many countries around the world, consumers can buy prepaid or ‘Pay As You Go’ mobile SIM (Subscriber Identity Module) cards from retail outlets usually with little or no paperwork involved. Unlike pay-monthly mobile SIM contracts, the activation and use of prepaid SIM cards does not always require the customer to register or present any identity documents at the point of sale. In countries where prepaid SIM registration is not required, mobile users can access mobile services more easily, but can also voluntarily register with their mobile network operator (MNO) in order to use additional services that require identification, such as mobile banking. An increasing number of governments have recently introduced mandatory registration of prepaid SIM card users, primarily as a tool to counter terrorism and support law enforcement efforts. However, to date there is no evidence that mandatory registration leads to a reduction in crime. A number of other governments, including those of the United Kingdom, the Czech Republic, Romania and New Zealand, have considered mandating prepaid SIM registration but concluded against it. While these governments’ detailed policy assessments have not been published, reports have highlighted the absence of evidence— in terms of providing significant benefits for criminal investigations—as a key reason for rejecting this policy. In Mexico, mandatory SIM registration was introduced in 2009 and repealed1 three years later after a policy assessment showed that it had not helped with the prevention, investigation and/or prosecution of associated crimes. An analysis of case studies and media reports in countries where mandatory registration of prepaid SIM users has been introduced shows that such a policy may also lead to unintended negative consequences including: 1. 4 • Loss of access to communications services when mobile users’ SIM cards are deactivated (sometimes without warning) due to failure to register by a required deadline. Such failure may be caused by factors beyond users’ control, for example the fact that they live far from a registration centre, lack any formal identity documents, or were not made aware of the need to register and the relevant deadline; • Restriction of consumers’ accessibility to mobile communications by limiting the locations where new prepaid SIM cards can be purchased; • Emergence of black markets for fraudulently-registered or stolen SIM cards; • Increase in mobile users’ concerns over their privacy and freedom of speech, particularly in the absence of any national laws on data protection and freedom of expression; and • Disproportionate cost burdens on mobile operators, which could impact their ability to invest in new innovative services and in network infrastructure, particularly in remote and rural areas. It is important to differentiate the unintended negative consequences of a mandatory registration policy in a given country against the potential benefits that SIM user registration can deliver. For example: • Greater consumer access to e-Government services (as registered users can verify their identity and log in to such services using their mobile device); • Creating opportunities for mobile commerce (m-Commerce) as users will be able to benefit from a variety of relevant promotions and services that their operators might offer them; • Making it easier for users to keep their mobile number when switching to another network operator; and • Supporting governments’ financial inclusion agendas, particularly in underdeveloped regions where many people are unable to open normal bank accounts. For example, registered SIM users can sign up to mobile money services and send or receive money using their mobile devices. None of these benefits and positive outcomes depends on SIM registration being mandated by governments. Instead, they can be achieved through the voluntary registration of mobile users who may willingly register their prepaid SIM card in order to access services they consider valuable—such as mobile money, m-Commerce or e-Government services. Policymakers can therefore attain the benefits of mass SIM registration by incentivising investment in the development of services that encourage SIM users to register voluntarily. In doing so, they can potentially avoid or minimise the risks and negative consequences associated with mandatory prepaid registration. impact assessments before introducing regulation. The effectiveness of a mandatory prepaid SIM registration policy depends on certain local and regional market conditions that may either minimise or exacerbate the negative consequences outlined above. For example, whether citizen access to national identity documents is widespread throughout the country and whether the government maintains robust citizen identity records. Where a decision to mandate the registration of prepaid SIM users has been made, the GSMA recommends that policymakers can avoid common risks by: • Conducting a full impact assessment of the proposed policy including its costs and benefits; • Engaging and consulting with local mobile operators who are best placed to suggest implementation methods; • Taking into account global best practices and insights; and • Ensuring that their proposed rules are proportionate and relevant to the specific market. Governments considering mandating the registration of prepaid users should seek to consult with industry stakeholders and conduct http://www.senado.gob.mx/?ver=sp&mn=2&sm=2&id=28925 (Available in Spanish only) 5 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 1. 2. Objectives Background The objectives of this paper are to provide insights and recommendations to support public deliberation on the merits or otherwise of mandating prepaid SIM registration. In doing so, it: In many countries around the world, consumers can buy prepaid SIM cards from retail outlets without having to present any form of identification and with little or no paperwork. The process can be considerably more convenient compared to that of ‘pay monthly’ contracts where SIM card users are required to register their personal details and provide evidence of sufficient funds before they can access mobile services. • Highlights the potential unintended consequences of mandating prepaid SIM user registration; • Outlines the benefits that SIM user registration can deliver; • Recommends factors that policymakers should consider before any decision to mandate the registration of prepaid SIM users; and • Demonstrates best practices from a range of countries that policymakers should take into account if the decision to mandate prepaid SIM user registration has already been made. This convenience has driven the global popularity of prepaid SIM cards, which now account for 77 per cent of all SIM connections globally. This has contributed to the growth of mobile communications, particularly in developing countries. For example, in Africa, prepaid SIM cards account for 95 per cent of all SIM cards, representing c. 776 million prepaid connections and an annual growth rate of 12 per cent. 2 Mandatory registration for prepaid users emerged after the introduction of registration requirements in Brazil3 , Germany and Switzerland4 in 2003. Since then, an increasing number of governments have introduced mandatory registration requirements prohibiting mobile operators from selling or activating prepaid SIM cards unless the purchaser presents a proof of identity and registers the SIM in their real name. As of July 2013, at least 80 countries globally (including 37 on the African continent) have mandated, or are actively considering mandating, the registration of prepaid SIM users5 (see Figure 1). There are more than four billion prepaid SIM connections in these 80 countries.6 2. Source: GSMA Intelligence (Q3 2013 actual figures) 3. http://legislacao.anatel.gov.br/leis/469-lei-10703 4. Privacy Rights and Prepaid Communication Services: Accessed at http://blogs.sfu.ca/departments/cprost/wp-content/uploads/2012/06/0601.pdf According to this 2006 study, nine of 24 OECD countries surveyed required prepaid SIM users to register. These countries were Australia, France, Germany, Hungary, Japan, Norway, Slovak Republic, South Africa and Switzerland. 5. See: “The Rise of African SIM Registration: Mobility, Identity, Surveillance & Resistance” http://www.academia.edu/2494288/The_Rise_of_African_SIM_Registration_Mobility_Identity_Surveillance_and_Resistance 6. Source: GSMA Intelligence (Q3 2013 actual figures) 6 7 White Paper: The Mandatory Registration of Prepaid SIM Card Users Figure 1. MANDATORY REGISTRATION OF PREPAID SIM CARD USERS - STATUS, BY COUNTRY* White Paper: The Mandatory Registration of Prepaid SIM Card Users Already implemented UNDER CONSIDERATION / IMPLEMENTATION REJECTED *Source: GSMA from publicly available information, as of September 2013 8 9 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 3. Mandating prepaid SIM registration for national security: Perceptions and reality Governments that introduce mandatory prepaid SIM registration often base their decision to do so on the belief that it will improve the efficiency of law enforcement and counter-­terrorism efforts.7 While there is no doubt that criminals and terrorists use prepaid SIM cards to help stay anonymous and avoid easy detection8 , to date there has been no empirical evidence9 to indicate that: 1. Mandating the registration of prepaid SIM users leads to a reduction in criminal activities; and 2. The lack of any registration of prepaid SIM users is linked to a greater risk of criminal or terrorist activities. In fact, a publicly available policy assessment report from Mexico showed that mandatory SIM registration—introduced there in 2009— had failed to help the prevention, investigation and/or prosecution of associated crimes. As a result, policymakers decided10 to repeal the regulation three years later (see case study 1). The absence of a link between mandatory SIM registration and crime reduction suggests that criminals who are determined to remain anonymous will use other means11 to obtain active SIM cards or simply buy them from abroad and roam on their own countries’ networks. 10 A number of governments, including in Canada, the Czech Republic, New Zealand, Romania and the United Kingdom have considered the merits of mandating prepaid SIM registration but subsequently concluded against introducing it. In the United Kingdom for example, this issue was considered in detail by an expert group of law enforcement representatives, security and intelligence agencies and communications service providers following the terrorist attack on London in July 2005. A confidential report by experts concluded that “the compulsory registration of ownership of mobile telephones would not deliver any significant new benefits to the investigatory process and would dilute the effectiveness of current self-­registration schemes.”12 In the European Union, some Member States have adopted measures requiring SIM card registration, and the European Commission (EC) invited all Member States in 2012 to provide evidence of the actual or potential benefit of such measures. Following examination of the responses, Cecilia Malmström, European Commissioner for Home affairs noted that: “At present there is no evidence, in terms of benefits for criminal investigation or the smooth functioning of the internal market, of any need for a common EU approach in this area.”13 7. http://www.economist.com/news/international/21577044-tracking-mobile-phone-scares-guilty-and-innocent-alike-called-up?fsrc=rss%7Cint 8. When the Swiss Parliament was debating the introduction of mandatory prepaid SIM user registration in 2003, a government member, Doris Leuthard, indicated that some 60-70 per cent of intercept operations involved prepaid phones and that prepaid was used in 90-100 per cent cases of organized crime. Conseil national Suisse. (2003, Mar. 12). Conventions des Nations Unies pour la répression du financement du terrorisme et des attentats terroristes à l’explosif. Ratification. Amtliches Bulletin. Available at http://www.parlament.ch/ab/frameset/d/n/4617/77205/d_n_4617_77205_77220.htm 9. As concluded in a report on “Implications of Mandatory Registration of Mobile Phone Users in Africa” accessed at: http://www.diw.de/documents/publikationen/73/diw_01.c.394079.de/dp1192.pdf . Also see a survey examining prepaid mobile phone regulation and registration policies among OECD member states, in 2006. Accessed at: http://blogs.sfu.ca/departments/cprost/wp-content/uploads/2012/06/0601.pdf 10. http://www.senado.gob.mx/?ver=sp&mn=2&sm=2&id=28925 11. In Australia for example, some criminals reportedly bought mobile service retailer outlets so they had a ready supply of untraceable SIM cards. http://www.pc.gov.au/__data/assets/pdf_file/0003/91344/social-economic-infrastructure.pdf cited: (ACCAN,sub. DR92). 12. Lord West of Spithead in response to a parliamentary question from Viscount Waverley on the mandatory registration of SIM card users: http://www.theyworkforyou.com/wrans/?id=2007-07-16b.4.3&s=%22pay+as+you+go%22+mobile+phones 13. http://new.eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C:2013:182E:FULL, (17/7/2012) In the Philippines, the Parliament proposed the introduction of mandatory prepaid SIM registration in 2000 but the proposals remained dormant14 until early 2013 when domestic terrorist activities were linked to anonymous SIM card users. The Government is currently looking to revive the proposals. According to the presidential spokesperson “Any national security concerns should be balanced with the right to privacy.”15 PHILIPPINES: INDUSTRY OPPOSES SIM CARD REGISTRATION PROPOSALS In two position papers16 submitted to the House of Representatives, the Philippine Chamber of Telecommunications Operators (PCTO) opposed the SIM card registration proposal noting, among other things, that it: • Runs counter to the Government’s present and prevailing universal service policy as it impacts on citizens’ rights including their right to access telecom services; • Is an unpractical and ineffective solution due to the absence of a reliable identification system; • Is not based on any evidence that it would deter criminal activities in the country; and • Would face administrative challenges as more than 90 per cent of SIM cards are prepaid. Case study 1: Mexico repeals mandatory registration three years after implementation In Mexico, mandatory SIM registration was introduced in 2009 but repealed three years later after a policy assessment17 showed that it had not helped the prevention, investigation and prosecution of associated crimes. The reasons cited by the senate for repealing the regulation included: (i) Statistics showing a 40 per cent increase in the number of extortion calls recorded daily and an increase of eight per cent in the number of kidnappings between 2009 and 2010; (ii) The appreciation that the policy was based on the misconception that criminals would use mobile SIM cards registered in their names or in the name of their accomplices. The report suggests that registering a phone not only fails to guarantee the accuracy of the user’s details but it could also lead to falsely accusing an innocent victim of identity theft; (iii) The acknowledgement that mobile operators have thousands of distributors and agents that cannot always verify the accuracy of the information provided by users; (iv) Lack of incentives for registered users to maintain the accuracy of their records when their details change, leading to outdated records; (v) The likelihood that the policy incentivised criminal activity (mobile device theft, fraudulent registrations or criminals sourcing unregistered SIM cards from overseas to use in their target market); and (vi) The risk that registered users’ personal information might be accessed and used improperly. 14. http://thenextweb.com/asia/2011/01/28/philippine-government-wants-mandatory-sim-registration-maybe-its-a-good-idea/ 15 http://www.manilachannel.com/legal/albeit-presidents-opposition-sim-card-registration-may-undergo-study-palace/ (last accessed on 13 November 2013) 16. http://www.philstar.com/business/2013/10/23/1248215/telcos-nix-sim-card-registration 17. http://www.senado.gob.mx/?ver=sp&mn=2&sm=2&id=28925 (Available in Spanish only) 11 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 4. Unintended consequences of mandatory prepaid SIM registration An analysis of case studies and media reports from countries where the registration of prepaid SIM users had been mandated indicates that such a policy often leads to negative unintended consequences including: 4.1 IMPACT ON SOCIETY (i) Loss of access to communications services when mobile users’ SIM cards are deactivated (sometimes without warning) due to failure to register by a required deadline Many socially and economically disadvantaged consumers rely on prepaid SIM cards for access to mobile communications. Poorly drafted rules mandating prepaid SIM registration tend to have an adverse impact on vulnerable people including those who: • Are homeless, live in informal housing or in remote communities, or are from less well documented groups18; • Are family dependents who may be unable, or find it inconvenient, to leave the family home to register; • Fail to hear about or understand regulations and relevant deadlines due to inadequate or poor awareness raising campaigns; and • Are reluctant to register due to concerns over the possible violation of their privacy or freedom of expression. These groups are most at risk from being cut off from access to convenient and affordable communications, as a result of mandatory registration rules that are inflexible, disproportionate and which may fail to take into account national and regional conditions. SIM deactivations in Rwanda In many cases the national regulators had to extend the ‘cut-off’ deadline repeatedly to give mobile users more time to register. In Rwanda, over 485,000 SIM cards were recently19 deactivated, as their holders failed to register them by the latest deadline, despite this having been pushed back on several occasions. 18 In Afghanistan for example, while mandatory registration rules require users to present a formal identity document, many people lack such documents See: http://www.operationspaix.net/DATA/DOCUMENT/4816~v~Afghan_Refugees_in_Pakistan___Push_Comes_to_Shove.pdf 19 http://m.allafrica.com/stories/201308020113.html/ 12 (ii) Restricting consumers’ accessibility to mobile communications by limiting the locations where new prepaid SIM cards can be purchased In many countries, consumers can buy prepaid SIM cards from a variety of locations including mobile operators’ and other retail stores, kiosks, supermarkets, vending machines or online. Mandatory registration policies act as barriers to widening the range of SIM distribution channels. For example, prepaid SIM registration regulations in some countries, including China, prohibit20 the sale of SIM cards in shops that are not owned or controlled by licenced mobile operators or retailers. Requiring mandatory registration of prepaid SIM cards at the point of sale may also deprive people of their livelihood, if their income relies on the sale or distribution of SIM cards and earning a commission on such sales from mobile operators. (iii) Emergence of black markets for fraudulently-­registered or stolen SIM cards While a key government objective of mandating registration may be to curb crime associated with the anonymity of unregistered SIM users, in some countries, including many in Africa, the introduction of such regulation risks having the opposite effect. For example through: • Criminals importing and using active, but unregistered, SIM cards from countries that have no registration regulations; • The creation of black markets in stolen phones and fraudulently-registered SIM cards or ‘pirate’ cards as they are known in Mexico;21 • The commission of identity fraud crimes, as suggested by a study among the Organisation for Economic Co-operation and Development (OECD) member countries.22 Identity fraud can also lead to innocent citizens being wrongfully implicated and accused of a criminal offense, for example if registered SIM cards fall into the wrong hands.23 (iv) Increase in mobile users’ concerns over their privacy and freedom of speech, particularly in the absence of national laws on data protection and freedom of expression Mobile technologies and social media continue to empower citizens around the world to engage with political and decision making processes and provide an effective voice mechanism to help ensure governments are accountable. 24 Reports have also cited25 the enormous power of mobile communications and social networking in upholding democratic principles and individuals’ freedom of speech. Unless clearly defined in law, mandatory SIM card registration policies may undermine users’ trust in their governments out of fear that authorities might abuse the policy, for example to trace the identity of mobile users who post anti-government comments online. 26 “Where privacy laws are wanting or where anonymity is the only means to dissent against a repressive regime, secret governmental agencies can use mobile phones to find or identify potential civil or political opponents, with no preliminary warning or justification, eliminating thus the rights to free thought and free expression.”27 A recent academic report notes that “in Africa, SIM registration has been pursued without appropriate consultation, transparency, or ameliorative reforms such as fair information or privacy laws.” 28 Privacy concerns may also impact users’ willingness to engage with valuable mobile 20 In China for example, under the new Chinese SIM registration regulations, news-stands and convenience stores were prohibited from selling SIM cards. This has been criticised as it could restrict consumer choice and accessibility. See: http://www.pcworld.com/article/204616/article.html 21 http://www.priv.gc.ca/information/research-recherche/2011/hosein_201109_e.asp 22 http://blogs.sfu.ca/departments/cprost/wp-content/uploads/2012/06/0601.pdf 23 http://consumer.ncc.gov.ng/publication/pub/SIM.pdf 24 http://www.u4.no/publications/use-of-mobile-phones-to-detect-and-deter-corruption/ 25 http://www.academia.edu/1911044/Smartphones_in_the_Arab_Spring 26 http://www.issafrica.org/iss-today/mandatory-registration-of-sim-cards-ingenious-idea-or-misplaced-focus-on-crime-control 27 http://kosmopolitica.org/2013/05/09/global-crackdown-on-phone-anonymity/ (last accessed on 05/08/2013) 28 “The Rise of African SIM Registration: Mobility, Identity, Surveillance & Resistance” http://www.academia.edu/2494288/The_Rise_of_African_SIM_Registration_Mobility_Identity_Surveillance_and_Resistance 13 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 5. services and mobile commerce, as shown by several consumer research studies globally, including those of the GSMA. 29 Case study 2: Privacy concerns in China In China, the introduction of mandatory registration in 2010 led to consumer privacy concerns and some mobile users were reportedly30 unwilling to give out personal information for fear it would be resold to third parties. The absence of any privacy laws protecting Chinese users’ private data meant that the mobile operators had an even higher responsibility to manage such information properly.31 “[Mandatory registration] should be a good thing. No one would send that rubbish [spam messages] to a phone if the [sender’s] number is registered under a real name. But I am afraid once my personal information is provided, it could be leaked, and abused.” Xiao Wang, Beijing Mobile. Critics also said that “the move gave the government a new tool for monitoring its citizens…[and] help police track down ordinary people who take part in spontaneous protests [such as those] sparked by labour disagreements, anger over pollution and other issue.”32 4.2 Impact on industry (v) Disproportionate cost burdens on mobile operators which could impact investment in new innovative services and network infrastructure, particularly in remote and rural areas In countries where prepaid users represent the majority of the mobile communications market, the costs to mobile operators of implementing new registration processes can be significant including: • Training staff and retailers i.e. on how to register users, what the acceptable forms of identity are and how to verify them; • Investing in public awareness campaigns to inform their customers about the need to register; • Ensuring that customer data databases are accurately updated, maintained and secured; • Monitoring compliance and deactivating all unregistered SIM cards after the imposed deadline; and • Verifying, copying and storing users’ identity documents. In some countries, mobile operators are required to pay additional fees to the relevant regulator or government department to verify each customer’s personal identification details against a central government database. In Australia, the cost of the mandatory prepaid SIM user registration regime to the industry was at around USD 10 million a year. 33 In Pakistan the government (as of October 2013) is proposing that mobile operators install biometric verification equipment at their retail outlets and link these to the national biometric database. The system is to cost the telecom industry around Rs2.5 billion (USD 24 million). 34 According to some reports35 however, the Pakistani government may use a universal service fund to cover the cost of the biometric devices that will need to be placed at SIM retail outlets. 29 See GSMA research on mobile users’ general privacy attitudes: http://www.gsma.com/publicpolicy/mobile-and-privacy/resources 30 http://www.theguardian.com/world/2010/sep/01/china-mobile-phone-number-identity 31 http://www.internetgovernance.org/2010/09/07/real-name-registration-required-for-china-mobile-users/ 32 http://news.xinhuanet.com/english2010/video/2010-09/01/c_13473049.htm and http://www.theguardian.com/world/2010/sep/01/china-mobile-phone-number-identity 33 http://www.pc.gov.au/__data/assets/pdf_file/0003/91344/social-economic-infrastructure.pdf (pg 151) 34 http://www.thenews.com.pk/Todays-News-3-200410-Body-formed-for-biometric-verification-of-SIMS 35 http://www.sananews.net/english/senate-body-demands-closure-of-unverified-sims-non-registered-imei-numbers-in-country/ 14 The positive outcomes of SIM registration While the unintended consequences of a mandatory registration policy can be severe, achieving a high volume of registered SIM users in a country can deliver positive outcomes for consumers. These include: G reater consumer access to e-Government services Making it easier for users to keep their mobile number when switching to another network operator Creating opportunities for mobilecommerce (m-commerce) Supporting governments’ financial inclusion agendas 5.1 Greater access to e-­Government services In countries where mobile penetration is high, a comprehensive register of (both prepaid and contract) SIM users could increase the adoption of mobile e-­Government services by offering registered citizens the ability to verify their identity using their mobile device. For example, in Egypt, a pilot study on a prototype mobile voting (m-Voting) system found that the ease of use, usefulness, trust, and mobility that the platform offered had a significant positive impact on citizens’ intention to use it.36 36 Assessing Citizens Acceptance of Mobile Voting System in Developing Countries: The Case of Egypt (accessed at http://www.igi-global.com/article/assessing-citizens-acceptance-mobile-voting/67137) 15 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 5.2 Case study 3: United Arab Emirates: ‘My Number, My Identity’ In 2012, the Telecommunications Regulatory Authority (TRA) of the United Arab Emirates (UAE) issued a mandate requiring all mobile subscribers to re-­ register their SIM cards within an 18 month time-­frame. Following a recent spike in the number of civil and criminal cases in which serious legal and financial issues had arisen over subscribers giving away their SIM card to other people, the directive required all mobile SIM users in the UAE to present a valid identity document at one of the 105 Eitsalat and 46 ‘du’ sales outlets throughout the country. Any unregistered SIM cards in operation by the end of the 18 month period were to be disconnected. The country’s two mobile network operators, Etisalat and ‘du’, were each required to conduct their own awareness campaigns around the re-­registration. A key theme37 used throughout the campaign was the symbolic link between the subscriber’s unique identity and the secure SIM which they carried with them at all times. The campaign also highlighted the importance of the mobile subscribers’ role to protect their SIM cards, which are ‘national resources’ that should be used responsibly. A further motivation for initiating the registration campaign, according to TRA, was to encourage UAE residents to ‘support the government’s efforts in promoting the Emirates ID card as the sole identification document’ by requiring the identification card as a registration document. (The registered and re-­registered mobile numbers stay active as long as the customer’s identification is valid. Once the identification expires, the customer is required to re-­register the mobile numbers again.) Through collaboration with the national government the operators led a successful SIM registration campaign. Etisalat is also working with the National Identity Authority to place the credentials of the Emirates National identification Card onto Near-­Field Communications (NFC) enabled phones and SIM cards. This is likely to encourage38 the use of mobile NFC technology for a wide range of use cases including transport, retail and access to government services. “In essence, any activity that requires identity verification could be achieved through a smartphone or mobile device that has the relevant application and is paired with an Emirates ID.”39 Creating opportunities for m-­commerce Registering users’ real names against their SIM card can enable a broad range of additional m-Commerce services which may improve economic growth as users are likely to be offered—and engage with—services that are more relevant to their needs and preferences. In Nigeria for example, one of the objectives for mandating prepaid SIM registration was to enable operators to create profiles about their users so that they can better plan and develop “tailormade products and services to address the needs of the various user profiles and demographics” (see case study 4). In Finland, while prepaid SIM registration is not mandatory, three mobile operators (TeliaSonera, DNA and Elisa) offer their Case study 4: SIM CARD registration and m-­commerce in Nigeria and Kenya In Nigeria the objectives of the Nigerian Communications Commission’s (NCC) when it mandated nationwide registration of SIM users in March 201140 were to: • Assist security agencies in resolving crime and by extension to enhance the security of the state; • Facilitate the collation of data by the Commission about phone usage in Nigeria; • Enable operators to have a predictable profile about the users on their networks; and • Enable the Commission to effectively implement other value added services like Number Portability among others. Mobile operators have been allowed to use the SIM user registration data for targeted marketing activities. This led to a significant increase in customer take up of offers. In Kenya however, operators are not allowed to use customer registration data for 37 http://www.tra.gov.ae/news542.php 38 http://www.uaeinteract.com/news/default3.asp?ID=143 39 Dr Al Khoury, Director-­General at the Emirates Identity Authority, quoted in Gulf News on 7 July 2013 http://gulfnews.com/news/gulf/uae/general/smartphones-to-renew-emirates-ids-by-end-of-2013-1.1206426 16 users an option to register for a mobile signature which they can use to access a wide variety of services provided by third parties, including retailers, banks but also government and others. Through this solution the three operators formed an agreement under which they accept each other’s customers’ mobile signatures and, by allowing ‘signature roaming’ across their networks, make use of the single agreements that each individual operator has with third party service providers. This benefits the mobile users of these three operator networks by giving them access to a wider range of services. cross-­marketing. To do this they must have obtained customer data during their own promotional campaigns or through other services that the customer knowingly signed up to, such as M-­PESA41, Safaricom’s mobile money service. By July 2013, the NCC in Nigeria had reportedly uploaded more than 110 million entries to its database facility, including users’ biometric details (thumbprints) which all SIM card users now have to provide when registering their SIMs. With an estimated 117 million mobile phone subscribers, this could provide the largest and most comprehensive biometric database ever assembled on one platform in Nigeria, through the SIM registration exercise. Despite the NCC’s initial objectives for collecting this data, there appears to be no guarantee that the rich database with mobile users’ personal information would not be harvested for other purposes in the future. 40 http://consumer.ncc.gov.ng/publication/pub/SIM.pdf 41 M-­PESA is a mobile payments system based on accounts held by a mobile operator and accessible from subscribers’ mobile phones. The conversion of cash into electronic value (and vice versa) happens at retail stores (or agents). All transactions are authorised and recorded in real-­time using secure SMS. 17 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 5.3 Making it easier for users to keep their mobile number when switching to another network operator Another benefit often cited (e.g. in Nigeria42) in support of SIM registration is that it makes it easier for registered SIM users to keep their mobile number and ‘port’ it to another network if they wish and where this is allowed. The exercise in Nigeria was also said to have “boosted competition as operators have become even more creative, working hard to further improve their network quality and offer more value to their subscribers to discourage porting from their networks.”43 5.4 Supporting governments’ financial inclusion agendas The overwhelming majority of mobile users in underdeveloped countries use prepaid SIM cards and do not have traditional bank accounts. In the last few years, ‘mobile money’ services offered by mobile operators, such as the M-PESA in Kenya and Tanzania, have become extremely popular. Mobile money provides new channels for registered SIM card users to access traditional retail financial services such as remittances, payments, savings, credit and insurance among others. In order to benefit from mobile CASE STUDY 5: Spotlight on Dialog (Sri Lanka) In Sri Lanka, where prepaid SIM registration is mandatory, the Central Bank developed a regulatory framework for mobile money that allows both banks and MNOs to operate mobile money services. The relevant guidelines were approved in 2011 and, in 2012, the Central Bank relaxed its KYC (Know Your Customer) requirements adopting a more proportionate approach to customer due diligence. This created an open and level playing field for both banks and MNOs to launch mobile money deployments and offer a competitive set of products. In 2012, mobile operator Dialog launched a telco-­led mobile money service under the name eZ Cash. Customers can money services, prepaid SIM users have to register their SIM with their mobile operator, by submitting some personal information including proof of identification. There were almost 30 million active users of mobile money services who performed 224.2 million transactions totalling USD 4.6 billion during the month of June 2012. In Sub-Saharan Africa alone there were more than twice as many mobile money users than Facebook users in June 2012.44 In conclusion, none of the SIM registration benefits and positive outcomes outlined in this section depends on registration being mandated by governments. Instead, they can be achieved through the voluntary registration of mobile users who may eagerly register their prepaid SIM card in order to access services they consider valuable, such as mobile money, m-Commerce or 42 Nigeria: Assessing the Impact of SIM Registration On Network Quality, accessed at http://allafrica.com/stories/201307180363.html?viewall=1. 43 http://www.thisdaylive.com/articles/assessing-the-impact-of-sim-registration-on-network-quality/153625/ 44 http://www.gsma.com/mobilefordevelopment/wp-content/uploads/2013/02/MMU_State_of_industry.pdf 18 sign up for a ‘Basic Account’ on their mobile phones using the identification already stored in Dialog SIM card registration database. The maximum transaction allowed with this account is 10,000 rupees (USD 80), but customers can make more transactions by upgrading to a ‘Power Account’; they simply need to reconfirm their identity at a mobile money agent. This regulatory change had significant implications for Dialog. In June 2012, more than 370,000 customers had signed up to eZ Cash, reaching 810,000 by early 2013. Four thousand of these customers have already signed up for a ‘Power Account.’45 e-Government services. Policymakers can therefore attain the benefits of SIM registration by creating the right conditions for industry to innovate and invest in the development of services that encourage SIM users to register voluntarily. In doing so they can potentially avoid or minimise the risks and unintended consequences of mandatory registration, outlined in section 4. 45 Extract from Claire Pénicaud, 2013, “State of the Industry: Results from the 2012 Global Mobile Money Adoption Survey”, accessed at http://www.gsma.com/mobilefordevelopment/wp-content/uploads/2013/02/MMU_State_of_industry.pdf 19 White Paper: The Mandatory Registration of Prepaid SIM Card Users 6. 7. Impact assessment factors: Will mandatory prepaid SIM registration be effective? Recommendations on developing effective registration rules Where governments are considering the introduction of a mandatory prepaid SIM registration policy, the GSMA recommends that they should first assess its viability, feasibility and likely impact by: When governments decide to mandate prepaid SIM registration they should consider the following recommendations, which draw on the experience and insights from countries where registration is already mandatory: (i) Examining the local and regional conditions, including market dynamics and cultural factors; (ii) Engaging and consulting with mobile operators, for example allowing operators to propose implementation methods based on their expertise, specific market knowledge and global best practices; (iii) Conducting impact assessments of the proposed regulation before introducing it. Impact assessment questions for analysis can include: • Is there any evidence that the registration exercise would improve the reliability of data available to law enforcement agencies and contribute to crime reduction? And, how easily could a criminal obtain a SIM card—locally or from another country—in order to avoid registration? • What proportion of the population holds valid identification and what impact would the policy have on those who lack such documents (in terms of their ability to access mobile communications)? • Does the government keep an up-to-date and robust citizen identity record? (Poor record keeping increases the likelihood of forged documents being used by criminals.) 20 White Paper: The Mandatory Registration of Prepaid SIM Card Users • Are there any geographic, demographic or cultural characteristics that may affect how readily consumers could physically register a SIM in their name (e.g. those in remote areas, living in informal housing or those who are disabled)? • Can the state support online registration of prepaid SIM users (e.g. through remote verification of citizens’ identity documents)? • Are there any other requirements for mobile operators to verify and store users’ identity and/or other personal information (such as those applicable to providers of mobile money services)? • What is the impact of any data protection and privacy laws on how consumers’ personal details are collected, stored and potentially shared with government agencies and third parties? • Will the registration exercise impose disproportionate burdens on mobile operators (e.g. do they already have the equipment to collect and verify consumers’ data or are there new costs involved? To what extent could the government fully or partly subsidise the operators’ costs of implementing the mandatory registration requirements)? 7.1 Consumer-­related issues (a) Identity verification and registration channels How can prepaid SIM users verify their identity and can the various registration channels cater for all consumer groups (e.g. those living in remote or rural areas)? Context: Mandatory SIM registration regulations sometimes require that mobile users register their prepaid SIM cards at the point of sale (typically at operators’ and their retailers’ stores). Where mandatory prepaid SIM registration is first introduced, existing users are often required to physically register at those prescribed registration points, by presenting proof of identification. Challenge 1: Regulations that require SIM cards to be registered at specific points of sale are likely to: • Limit mobile operators’ ability to distribute prepaid SIMs by innovative means (such as through vending machines) or via selected partners (such as high street newsagents/kiosks); • Deprive people of their livelihood, if their income relies on the sale or distribution of SIM cards and earning a commission on such sales from mobile operators; • Reduce the range of locations from which consumers could previously access prepaid (and cheaper) mobile communications services; and • Disregard the needs of some vulnerable users of unregistered SIM cards who may be unable to register in person (see section 4.1). 21 White Paper: The Mandatory Registration of Prepaid SIM Card Users Challenge 2: White Paper: The Mandatory Registration of Prepaid SIM Card Users As noted in section 4.1, the effectiveness of mandatory prepaid SIM registration policies can be affected by the lack of reliable identification documents, poor government identification records of citizens, and consumers having limited physical access to registration channels. Furthermore, in many countries46 mobile users may register multiple SIM cards under a single identity card which may lead to users gifting or selling prepaid SIMs to relatives and others. In such cases where the current user of the SIM is not the original (registered) owner, the perceived benefits of mandatory SIM registration are questionable (at least in the context of criminal investigations). However, registration rules that impose strict limits on how many SIM cards a person can own may lead to lost savings opportunities for users who buy multiple SIM cards to take advantage of differing tariffs across operators. Challenge 3: Businesses that had traditionally provided their employees with corporate prepaid SIM cards, may find that these SIMs are deactivated unless the rules specifically allow for corporate SIM cards to be registered under a company name. Recommendations: 1. Regulations should encourage, but not mandate, ‘point of sale’ registration. Instead, consumers should be able to obtain SIM cards that are inactive or with limited credit from a range of distribution channels and then be given flexible options on how to register and fully-activate them. Existing, but unregistered prepaid SIM card users should be offered a wider range of registration channels through which they can register their SIM card. 2. Where technically possible, governments should develop systems to enable real-time, online (identity) verification and registration of prepaid SIM users, for example, systems through which mobile operators can verify their users’ identity by cross-referencing that information in real-time with a government database which accepts or rejects the identity document information (see case study 6). Australia has had regulation of mobile prepaid SIM service identity checks since 2000. In 2007, in response to issues with compliance, the Australian Mobile Telecommunications Association (AMTA) worked with the regulator, the Australian Communications and Media Authority (ACMA) to co-­ordinate an industry approach in relation to what customer information is captured at the point of sale. This system was paper-­based and often relied on compliance by third party retail outlets. The ACMA began a review of the regulations in 2009, involving consultations with industry as well as a formal public consultation process in 2013. The aim of the review process was to establish a more efficient and effective set of identity verification processes for mobile prepaid service users, either at point of sale or at the time of service activation, including online verification, over the phone or face-­ to-­face (see Table 1). The resulting proposed new system will distinguish between users who purchase mobile prepaid services using a credit/debit card and those who use other forms of payment. In the former case, the purchaser will not be required to show any additional proof of identity. This is because the identity verification processes undertaken by the financial sector when a person obtains a credit or debit card are considered to be sufficiently stringent. Under the proposed new system, mobile service providers will also be given access to a national online verification system, managed by the Attorney-­General’s Department, to perform real-­time checks on the validity of selected government-­issued documents such as passports and Medicare cards (see Table 2). Verification is obtained from the source database maintained by the government organisation that issued the relevant document. The system verifies the identity information with a ‘blind check’—accepting or rejecting it with a ‘yes’ or ‘no’ answer. Mobile service providers would not have access to the issuing organisation’s database. For privacy reasons, the proposals prohibit mobile service providers from recording the identifying number of the document. They are only allowed to use the information, during the verification process, to check that the document is authentic, accurate and up-­to-­date. Table 1: Identity verification methods under the new proposals Methods of verifying identity Additional or existing method Verifying the details of government-issued documents using a government online verification service such as the Document Verification Service Additional method Confirming the existance of: • an Australian bank account (credit/debit card) or • a trusted email address (edu.au, gova.au) or • an exisiting post-paid account (e.g. broadband internet) Additional methods Using a secure courier or registered mail service to deliver enduser equipment to the service activator’s residential address Additional method • An online identity verification system is set up which is linked with a central government database. Collecting and, if required, sighting identification at a retail shopfront (this is the current point-of-sale method) Existing method to be maintained for at least two years, pending review 4. Regulations should clarify how, if at all, the registration of corporate SIM cards might differ from that of consumer SIM cards (i.e. whether in the name of the employee or the employer/company) name. Alternative arrangements approved by the ACMA on application by the mobile provider (no alternative compliance plans approved to date) Existing method to be maintained 3. The effectiveness of registration methods can be improved where: • Governments seek to ensure that as many citizens as possible hold a valid identification document before mandating prepaid SIM registration; • SIM registration channels take into account the accessibility needs of vulnerable groups; • Staff in charge of verifying and storing users’ identity details are properly trained; and 22 Case study 6: ONLINE IDENTITY VERIFICATION IN AUSTRALIA 46 Including Pakistan, Turkey, many African countries and others 23 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users Case study 7: SIM card registration in Turkey Table 2: Acceptable government documents for online verification commonwealth state and territory (subject to state and territory agreement) Medicare card Driver’s licence Passport Learner’s permit Citizenshop certificate Birth certificate Australian-issued visa Marriage certificate Change of name certificate The Australian Government announced that it would extend access to the online system to the private sector from 2013–14 to assist businesses in meeting their identity verification requirements under law. The proposed changes are intended to result in: (i) Improved convenience and privacy for consumers (by restricting the recording of certain Identity data); (ii) More efficient and effective identity verification processes for industry; and (iii) More accurate and timely information for law enforcement and national security agencies. The proposed new system also includes exemptions for people who may have difficulty verifying their identity as a result of an emergency or natural disaster. While the objective of the new system was to move to a more efficient online process at the point of activation, rather than a paper-­based system at the point of sale, industry members have raised the following fundamental concerns regarding the obligations with the ACMA: • The new system can still be circumvented because: o Prepaid mobile services are easily transferable between end-­users; oS tolen identity information can be used to verify identity (identity theft); and oP repaid mobile services can be imported from overseas. • The proposed cost to mobile service providers of using the government’s national online verification service is high in comparison with the revenue associated with many prepaid services, which deliver far lower average revenue per service than post-­paid services. In Turkey, mandatory ‘real-name’ registration all SIM card users was introduced on the government’s expectation that the policy would curb criminal activities associated with the anonymity of unregistered SIM users. To date, no public information exists to indicate whether this expectation has been fulfilled. While mobile operators spent significant resources in their efforts to reach unregistered SIM users they faced a number of challenges, mainly involving the nature of the registration requirements. Mobile users are required to physically go into a designated point of sale, provide proof of identification and sign a paperbased contract with their chosen mobile network operator. The manual process of verifying a user’s identity has not been 100 per cent flawless as it remains open for exploitation by people who may present a fake or stolen identification document to maintain their anonymity. As a result, the national regulatory authority, BTK, imposed monetary penalties on all three mobile operators (Avea, Turkcell, Vodafone) claiming they had failed to keep proper records of all their customers’ true identities. These penalties seem to place a disproportionate burden on the mobile operators and their retailers as they are effectively blamed for registering a SIM card in the name of a user who, without their knowledge, presented a fake or stolen identification document. How can a Turkish citizen check which mobile numbers are registered against their identity number? The national regulatory authority, BTK, limits the number of personal SIM cards any user can own to 15 for Turkish citizens and three for foreigners. BTK has also established an online e-Government portal (linked to the three mobile operators’ user databases in real-time), through which a citizen can find out how many mobile SIM card numbers are registered against their unique identity number (the ‘TCKN’). Citizens can submit an inquiry on this portal by inputting their TCKN and a password. The system then retrieves the mobile numbers associated with that specific TCKN but omits the last two digits of the numbers for security purposes. If they see numbers in their unique lists which they do not recognise, they can ask for those numbers to be deactivated. BTK offers an alternative but similar method for mobile users to check their registered SIM numbers. A user can enter their TCKN and their mobile phone number on the BTK website. The system then sends a unique code by SMS to that phone number for authentication, which the user has to enter. If correct, the website then generates the list of numbers registered under that TCKN. • Any regulation (current and proposed) requiring prepaid identification checks is an unreasonable burden on industry as no verification system yet proposed can guarantee the identity of every registered user. There is also no business requirement to verify customer identification for these services. 24 25 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users 7.2 (b) Effective public awareness campaigns Are consumers aware that they need to register their SIMs and how to do this? Context: When SIM registration is mandated, existing mobile users have to be notified about the need to register their SIM cards, how to do so and the consequences if they do not. Mobile operators tend to notify their customers through ‘push’ communications such as text and voice messages, as well as through television, radio and other types of advertisements. Challenge: Mobile users who fail to understand the requirements or consequences of not registering risk having their SIM cards deactivated and their access to mobile communications cut off. Recommendations: The relevant regulations should include provisions that require national governments and regulators (not just mobile operators) to commission public awareness campaigns to ensure that as many prepaid SIM users as possible clearly understand what they need to do and the implications of not registering by a deadline (see case study 8). Case study 8: Awareness raising campaigns in Uganda Following several extensions to the deadline for SIM card user registration, the Uganda Communications Commission made it clear47 that mobile operators would have to block all SIM cards that remained unregistered by the (final) deadline of 31 August 2013. In an effort to beat this deadline, mobile operators Airtel and Warid, launched an innovative campaign to encourage more people to register; in addition to sending their customers SMS reminders of the final registration deadline they also offered free minutes and texts to those who registered before the deadline. They also gave customers an option to text their unregistered number to 197 toll-free in order to avoid having their SIM deactivated and by doing so these customers were given more time to register in person. Industry-­related issues (c) Timescales for mobile operators to implement registration processes Are they practical and realistic? Context: When governments introduce new mandatory registration rules, they usually require mobile operators to register all their existing SIM card customers by a set deadline, after which the operators are required to deactivate any unregistered SIM cards. The duration of the registration period typically reflects the number of prepaid SIM users that need to register within a country. In several countries, including Japan, Norway and Singapore, mobile operators were given six month deadlines but these were then extended as they proved unachievable: • In Singapore, a week before the six month deadline, approximately half of the existing prepaid SIM users had been registered.48 • In Mozambique, the mobile operators were initially given one month to register their customers’ SIM cards. This was not achieved as some provinces only had a handful of offices serving millions of inhabitants. Challenge: The registration deadline can sometimes fail to take into account factors that might prolong the implementation process. Deadlines that are too short may lead to premature deactivation of mobile users’ SIM cards. Recommendations: 1. When governments consider what registration deadline to impose on mobile operators they should take into account factors such as: • The number of unregistered prepaid SIM users who will be required to register; • Time for mobile operators to introduce and test secure electronic registration processes (where technically possible); • Time for mobile operators’ employees/resellers to be trained on how to verify and store the required user details at the point of sale or registration; • Time for public awareness to be raised and for users to be notified of the proposed processes (and relevant deadlines); and • Whether any public holidays or events fall within the registration period for existing SIM users (Christmas, Easter, Ramadan, etc). 2. The implications for an active SIM card if its user fails to register by the set deadline should be transparent and proportionate. For example, if mobile operators are asked to deactivate any unregistered SIM cards, this should not happen unless a reasonable period of time has passed from the date when users were personally notified of the registration requirements and the consequences of not doing so. A ‘warning period’ with no incoming calls may precede any actual deactivation of the SIM. 47 http://pctechmag.com/2013/07/airtel-and-warid-innovate-as-sim-registration-deadline-draws-near/ 26 48 http://www.mha.gov.sg/news_details.aspx?nid=MzU5-QGjVYy0G0nI= 27 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users (d) The use, sharing and retention of SIM users’ registration details Are data retention and disclosure requirements proportionate and do they preserve mobile users’ privacy? Context: SIM registration rules typically require mobile operators to collect, store and retain SIM card users’ personal data for a specified period even if they stop using their SIM card. Mobile operators are also required to share such data with law enforcement agencies, where necessary. These requirements vary from country-to-country and have an impact on the privacy of mobile users particularly where the regulations are unclear on what the due process for data disclosure to law enforcement agencies is. Challenge: In some countries legal frameworks lack clarity, for example over data retention periods or over the disclosure of SIM users’ data to law enforcement agencies. This creates challenges for industry with respect to the privacy of mobile users’ information.49 Recommendations: 1. The legal frameworks dealing with disclosure of users’ data should: • Be clearly defined, adequate, relevant and proportionate; and • Balance governments’ obligation to protect its citizens against serious crime and the need to also protect rights to privacy of citizens. 2. The retention and disclosure of SIM users’ data for law enforcement or security purposes should take place only under a clear legal framework and using the proper process and authorisation specified by that framework. 7.3 Broader regulatory issues (e) Regulatory enforcement and consequences of non-­compliance for mobile operators What are the regulator’s enforcement powers after the registration deadline has passed? Context: In most countries where mandatory registration was introduced, regulators have had to extend50 the initial registration deadline to minimise the number of SIM card deactivations. In some cases, they imposed fines on mobile operators who still had active but unregistered SIM cards after the required deadline. Challenge: Lack of clarity on how the relevant authority will monitor or support regulatory compliance, before requiring mobile operators to deactivate all their unregistered SIM cards and potentially imposing fines or revoking their licenses.51 Recommendations: 1. Governments should seek to: • Engage and consult with mobile operators, for example allowing operators to propose implementation methods based on their expertise, specific market knowledge and global best practices; and • Conduct impact assessments before introducing regulation, in order to anticipate and minimise any unintended consequences (see section 6). 2. Regulations should specify the nature of any sanctions related to the non-implementation of any provisions. Any fines should be calculated in a fair and transparent way. Case study 9: Court dismisses SIM registration challenge in Uganda52 In Uganda, two consumer advocacy groups took the Uganda Communications Commission (UCC) to court in 2013 claiming that the UCC had no legal right to disconnect SIM cards that were not registered by the prescribed date—as over a million SIM cards still needed to be registered. However, the court ruled in favour of the UCC, stating that the advocacy groups failed to prove their case. “… there are criminals and like-­minded people 49 http://manypossibilities.net/2012/09/35-reasons-to-worry-about-privacy-in-africa/ 28 who would not like to register their SIM cards irrespective of the circumstances” the judge said during the proceedings. UCC Executive Director Godfrey Mutabazi reportedly said he was not surprised by the outcome of the petition since UCC was acting within the Regulation of Interception of Communications Act of 2010. The GSMA understands that the two advocacy groups are considering appealing the decision as of October 2013. 50 http://www.telegeography.com/products/commsupdate/articles/2013/08/05/artp-senegal-extends-deadline-for-sim-registration/ 51 Regulators in countries such as Nigeria, Germany and the Kingdom of Bahrain have the power to issue financial penalties on mobile operators for not complying with the registration rules. See http://www.telecomsmarketresearch.com/blog/?p=281 (Nigeria), http://www.bfdi.bund.de/EN/DataProtectionActs/Artikel/TelecommunicationsAct-TKG.pdf?__blob=publicationFile (Germany) and http://www.tra.org.bh/en/pdf/Telecom_Law_final.pdf (Bahrain) 52 http://www.itnewsafrica.com/2013/09/uganda-court-dismisses-sim-registration-case/ 29 White Paper: The Mandatory Registration of Prepaid SIM Card Users White Paper: The Mandatory Registration of Prepaid SIM Card Users (f) Harmonisation with other relevant regulations Are there any other relevant data-­collection requirements on mobile operators? Context: As examined in section 5, operators offering mobile money services are subject to a set of requirements that relate to the collection and verification of users’ personal data before they sign up to such a service. Consequently, previously unregistered prepaid SIM users have to register in order to benefit from such a service. Challenge: Possible inconsistencies between newly imposed SIM registration rules and other, similar user registration rules that mobile operators have to comply with (e.g. if they offer mobile money services). Recommendations: 1. In countries where mobile money or mobile identity services play an important role in governments’ financial inclusion agendas, policymakers should aim to harmonise any prepaid registration identity requirements with those that mobile money service providers already have to comply with. 53 onsistency in law is likely to drive the provision and adoption of C such services without imposing disproportionate and unnecessary burdens on the industry. Countries where the two sets of requirements are aligned, such as Tanzania54 and Sri Lanka55 benefitted from a rapid growth of the mobile money sector (see case study 5). Where a government has finalised their draft regulation on mandatory SIM registration it may wish to conduct a pre-implementation pilot trial to assess the feasibility of the regulatory provisions. Furthermore, post-implementation reviews may be used to examine the effectiveness of the process and the extent to which the initial objectives of the policy had been achieved. 8. Conclusion An increasing number of governments have recently introduced mandatory registration of prepaid SIM card users, hoping that the policy would support law enforcement and counter-terrorism efforts. However, to date there is no evidence that mandatory registration leads to a reduction in crime. This paper highlights a number of unintended consequences that may be brought about if prepaid SIM user registration is mandated in countries where certain conditions are absent. For example, where a high proportion of consumers lack official identity documents or where vulnerable consumers are at risk from being cut off from access to convenient and affordable mobile communications, as a result of failing to register by a deadline for reasons beyond their control. Despite these unintended consequences of mandatory registration, compiling a comprehensive national registry of mobile SIM card users can also lead to the creation of valuable services for consumers. For example, registered users could access e-Government services on their mobile phone, benefit from mobile commerce or sign up to mobile money services to send or receive money using their mobile devices. Such benefits however, can still be achieved without governments having to mandate the registration of prepaid SIM users; In fact, case studies in this paper show that mobile users will register willingly in order to access mobile services that they consider valuable. Mobile operators and governments are therefore incentivised to offer such services and encourage consumers to register voluntarily. The GSMA urges governments that are considering the introduction of mandatory prepaid SIM registration to: • Examine national and regional market conditions; • Consult with industry to analyse costs, benefits and implementation options; and • Conduct impact assessments before deciding whether to introduce or review existing mandatory registration rules, as was the recent case in Australia (see case study 6) and Mexico (case study 1). Where a decision to mandate the registration of prepaid SIM users has already been made, the paper outlines a number of recommendations for governments to take into account in order to develop registration mechanisms that are effective, flexible and proportionate. 53 Simone di Castri, “Mobile Money: Enabling Regulatory Solutions”, GSMA, London, 2013 54 http://www.gsma.com/mobilefordevelopment/wp-content/uploads/2012/03/What-makes-a-successful-mobile-money-implementation.pdf 55 http://www.gsma.com/mobilefordevelopment/wp-content/uploads/2013/07/Enabling-Mobile-Money-Policies-in-Sri-Lanka-GSMA-MMU-Case-Study-July2013.pdf 30 31 For further information please contact: Yiannis Theodorou Regulatory Policy Manager Government & Regulatory Affairs Email: ytheodorou@gsma.com GSMA Head Office Level 7, 5 New Street Square, New Fetter Lane London, EC4A 3BF, United Kingdom Tel: +44 (0)207 356 0600 http://www.gsma.com/publicpolicy/public-policy-resources ©GSMA 2013