DECLARATION AND CERTIFICATION

Declaration
I, JASMINE IDRISSA SAIDI, do hereby declare that this Mini-Dissertation is my own
original work and it has not been submitted for a similar or any other degree in any
University or learning institution prior to this date of submission at Mzumbe University.

Student’s Name……………………….
Signature……………………………….
Date……………………………………….

Certification
We the undersigned do hereby certify that we have read this work and find it acceptable
for examination by Mzumbe University.

Supervisor’s Name ……………………………………

Signature ……………………………………………...
Date………………………………………

Internal Examiner’s Name …………………………

Signature ……………………………………………...
Date………………………………………

i
 COPYRIGHT

This Mini-Dissertation is a copyright material protected under the Berne Convention of

1886, the Copyright and Neighbouring Rights Act, No. 7 of 1999 and any other relevant
laws on intellectual property. It may not be reproduced by any means in part or in full,
except for short extracts in fair dealings for research, private study, critical scholarly
review or discourse without prior permission of the author or Mzumbe University on that
behalf.
© Jasmine Idrissa Saidi,
Mzumbe University,
March, 2021.

ii
 ACKNOWLEDGEMENT

First and foremost special thanks to my almighty Allah for giving me good health and
power to do this research, and my special thanks should go to Mr. John Stephen who
supervised this work. I appreciate his academic criticism and positive advises, which I
took them into considerations which perfected this work, otherwise it could have another
picture.

Secondly I would like to present my sincere gratitude to my parents Mr. and Mrs. Idrissa
Saidi for their financial and material support, my brothers William, Revocatus and
Kibonde for their motivation.
I would like to record my appreciation to Librarians at Mzumbe University for their help
for taking their time to give me material, moreover I would like to give thanks to my
friends Tusekile Joel, Remi Justin, Hendrick Kashindye and Mkwabi Adam .and all
others. Classmate LLB III 2018-2021 at Mzumbe University Mbeya Campus College for
their help in one way or another.
A word of thanks to Advocate Wilson Magoti as my external supervisor who accepted me
to conduct my field at his Law Firms and for his support, assistance and experience from
the first day when I started the field.
There are numerous people who need to be acknowledged. To them all I say thanks a lot
only God almighty can reward them.

iii
 DEDICATION

This work is dedicated to My Parents Mr., and Mrs. Idrissa and My Young brother with
my gratitude for their support, tolerance and inspiration throughout my studies.
I LOVE YOU ALL

iv
 LIST OF ABBREVIATIONS AND ACRONYMS

AG Attorney General.
CEDAW Convention on Elimination of all forms of Discrimination Against Women
CPD Chief Parliamentary Draft man
EAC East African Community.
e- Government Electronic Government.
e-Id Electronic Identity Card.
EPOCA Electronic and Postal Communications Act of Tanzania.
EU European Union.
GN Government Notice.
ICCPR International Covenant on Civil and Political Rights.
ICT Information Communication Technology.
ID Identity Card.
NIDA National Identification Authority of Tanzania.
UK United Kingdom.
TCRA Tanzania Communication Regulatory Authority
TRDC Tanzania Human Rights Defender

v
 TABLE OF CONTENTS

DECLARATION AND CERTIFICATION ...................................................................i

COPYRIGHT .................................................................................................................. ii

ACKNOWLEDGEMENT ............................................................................................. iii

DEDICATION .................................................................................................................iv

LIST OF ABBREVIATIONS AND ACRONYMS ....................................................... v

LIST OF INTERNATIONAL LEGAL INSTRUMENTS ........................................... x

LIST OF LOCAL LEGISLATION ...............................................................................xi

LIST OF FOREIGN AND LOCAL CASES ............................................................... xii

CHAPTER ONE .............................................................................................................. 1

INTRODUCTION, BACKGROUND AND OBJECTIVES OF THE STUDY .......... 1

1.0 Introduction .............................................................................................................. 1

1.1 Background to the Problem ...................................................................................... 1

1.2 Statement of the Problem ......................................................................................... 3

1.3 Objectives of the Study ............................................................................................ 4

1.3.1 General Objective .............................................................................................. 4

1.3.2 Specific Objectives ............................................................................................ 4

1.4 Research Hypotheses ................................................................................................ 5

1.5 Significance of the Research .................................................................................... 5

1.6 Research Methodology ............................................................................................. 5

1.6.1 Data Collection Methods ................................................................................... 5

1.6.2 Secondary Data .................................................................................................. 6

CHAPTER TWO ............................................................................................................. 7

LITERATURE REVIEW................................................................................................ 7

2.0 Introduction .............................................................................................................. 7

vi
 2.2 The Legal Position of the Law Governing Protection of Individual Privacy ......... 11

2.2.1 The Constitution of the United Republic of Tanzania as amended from time to
time 1977 .................................................................................................................. 11

2.2.2 The Electronic and Postal Communication Act of Tanzania (EPOCA) .......... 13

2.2.3 The Electronic and Postal Communications (Sim Card Registration) ............ 14

CHAPTER THREE ....................................................................................................... 16

PRESENTATION OF FINDINGS, ANALYSIS AND DISCUSSION ...................... 16

3.0 Introduction ............................................................................................................ 16

3.1.1 Analysis on the Protection of Individual Privacy through Biometric registration.

.................................................................................................................................. 16

3.1.2 Protection of individual privacy on biometric registration into Government

Institutions in Tanzania. ............................................................................................ 16

3.1.3 Persons perceptions toward protection of individual privacy concern biometric

registration. ............................................................................................................... 18

3.2 The law concerning Individual Privacy in Tanzania, a case of biometric registration
...................................................................................................................................... 18

3.2.1 The Constitution of the United Republic of Tanzania as amended from time to
time 1977 .................................................................................................................. 18

3.2.2 The Electronic and Postal Communication Act of Tanzania (EPOCA) .......... 21

3.2.3 The Electronic and Postal Communications (Sim Card Registration) ............ 23

3.3.4 The Records and Archives Management Act of Tanzania .............................. 24

3.3 Seems few of Tanzanians are not aware on the technological effects of the Biometric
Registration. ................................................................................................................. 26

CHAPTER FOUR .......................................................................................................... 30

CONCLUSION AND RECOMMENDATIONS ......................................................... 30

4.1 Conclusion .............................................................................................................. 30

vii
 4.2 Recommendations .................................................................................................. 31

4.2.1 To the Government of the United Republic of Tanzania................................. 31

REFERENCES ............................................................................................................... 33

viii
 ABSTRACT
This is qualitative oriented research and it contains four chapters which analyzing,
identifying and reviewing the problem toward the Protection of Individual Privacy
through Biometric registration. In attempting to cover issues relating to individual privacy
and partly to issues related to biometric registration in particular. With that reason the
researcher chose Biometric registration as a case because the system seem to be new in
our jurisdiction. In Tanzania, privacy is the right which granted to everyone and given
under Article 16 (1) of the Constitution of 1977, which provides for the protection of
person information such as patient records. However Article 16 (2) of the constitution
provides for possibility of other laws to encroach by government agents. Although people
have conducted registration under that system. Findings of the study have revealed that
there is lacuna in various Legislation touching on protection of individual privacy in
Tanzania and also there is no piece of Legislation which is enacted to exclusively deal
with Protection of Individual Privacy matters exclusively, only that there are scattered
pieces of Legislations each attempting to provide for protection of individual privacy. Data
were obtained from different published materials and data key informants. In the
Conclusion and Recommendations, the Researcher has recommended that Data protection
is to be enacted so as to administer matter concerning with protection of individual privacy
in Tanzania. And lastly, this Research has opened doors for other Scholars to venture more
and come up with new findings regarding the protection of Individual privacy.

ix
 LIST OF INTERNATIONAL LEGAL INSTRUMENTS

European Union Directive on Data Protection [Directive 95/46/EC]

x
 LIST OF LOCAL LEGISLATION

The Constitution of the United Republic of Tanzania of 1977 as amended

Electronic and Postal Communications Act [Act No.3 of 2010]
Registration and Identification of Persons Act [CAP 36 R.E 2014]
The Electronic and Postal Communication [ Sim Card Registration Regulation 2020]
Records and Archives Management Act [ Act No.3 of 2002]

xi
 LIST OF FOREIGN AND LOCAL CASES

FOREIGN CASES
Olmstead v. United States (277 U.S. 438:1928).
Parry Jones v. Law Society [1969] 1 Ch 1

LOCAL CASES
Christopher Mtikila v. Attorney General, Miscellaneous Cause No.10 of 2005, High Court
of Tanzania, at Dar es Salaam (Unreported).
Julius Ishengoma Francis Ndyanabo v. Attorney General, Civil Appeal No.64 of 2001,
Court of Appeal of Tanzania, at Dar es Salaam (Unreported).
Kukutia Ole Pumbun and Another v. Attorney General and another [Civil Appeal No. 32
of 1992]
Legal and Human Rights Centre v. Attorney General, Miscellaneous Civil Cause No.77
of 2005, High Court of Tanzania, at Dar es Salaam (Unreported).

xii
 CHAPTER ONE

INTRODUCTION, BACKGROUND AND OBJECTIVES OF THE STUDY

1.0 Introduction

This chapter introduce about the examine protection of individual privacy: a case study of
biometric registration in Tanzania, historical background up to date, also the problems
which facing the protection of individual privacy on biometric registration. The role of
authors toward protection of individual privacy concern biometric registration into their
literary works, and there is other research methods which are taken to conduct this study.
The study examines protection of individual privacy: a case study of biometric
registration.

1.1 Background to the Problem

Historically, the phrase right to privacy it was claimed to be used even before 18801 it was
much developed the year 1880 where Thomas Cooley defined privacy as a right of
complete immunity: to be let alone. Two generation later on, the famous American Justice
Louis Brandeis dissenting in Olmstead v. United States2 declared that, the right to privacy
is the right to be let alone.
Tanzania’s legal system is based on English Common Law system, which derived this
system from British colonial, historically the protection of information in Tanzania traced
from colonial era, where both Germany and British colonial administration drafted laws
so as to protect their confidential records3. In 1912 the Germany colonial administration
was enact the East Africa Newspaper Decree4 which aimed to control newspaper industry
and maintained confidentiality of their administration information.

1
Glenn, R.A (2003) The Right to Privacy: Rights and Liberties under the law, p3-4.
2
(277 U.S. 438:1928).
3
East Africa Newspaper Ordinance of 1912
4
ibid

1
After independence some provisions of these colonial laws was retained and some were
amended. In 1977 the Constitution of United Republic came into force, still there were
silent on the protection of privacy matters against citizens, no any Article which was
stipulate about the right of privacy. But in 1984 the bill of rights adopted by the Tanzania
Constitution amendment, the bill proposed the privacy right under Article 16 of the
Constitution5.
Article 16 of the Constitution establishes a right to privacy in one’s own person, family
and matrimonial life. The protection of individual privacy is guaranteed by the
Constitution, because biometric registration are the component integral of privacy. Also
Art.16 (2) provides for the possibility of other laws to encroach the right to privacy, the
said article stipulates clearly that the law maker will enact law to stipulate how privacy
right may be protected, pursued or encroached by government agents6. Unfortunately this
requirement has not been put into implementation. There is no specific law which is
dealing with privacy in Tanzania.
The right is most comprehensive and valued by civilized society.7 For almost two decades
now, the world has witnessed the mushrooming of the introduction of Biometric systems
around the world in various Countries in Europe, Asia and some of the Latin America.
Before embarking into the operability of the biometric system. On 1st May, 2019 Tanzania
became one of the countries in Africa to introduce mandatory Biometric SIM card
registration following issuance of Public Notice by the Tanzania Communication
Regulatory Authority (TCRA) in April, 2019. The information obtained from registered
SIM cards is directly linked to a subscriber’s national identification card ensuring there is
no more misinformation or forgery of the documents; no one can forge fingerprints. In
addition, the number of mobile phone lines an individual can own is limited to one per
network operator, unless permission for multiple ownership is received from TCRA8.
Biometric technology is becoming increasingly used as a “Know Your Customer” tool for

5
CURT of 1977
6
Ibid
7
Op cit. Glenn, p 4.
8
Comms update (2019) Tanzania sets to roll-out Biometric registration retrieved from htpps: //www.
Commsupdate.com/articles/2020/12/15/Tanzania-set-out-to-roll-out-biometric. Accessed on 16th
December, 2020 at 15:27 pm

2
keeping fraudsters out of the customer base, particularly for banks, telecom, and other
businesses that rely on some level of trust to the customers they serve. A biometric search
enables a service provider to detect whether an applicant is real who he is and that he is
not attempting to conceal the real identity.
Technology in never and has never being static, but ever changing. This changing nature
of Technology has brought about many influences on various disciplines including that of
Biometric systems.9

1.2 Statement of the Problem

Privacy is the right which recognized and granted under Art.16 of the Constitution of
United Republic of Tanzania10 as amended from time to time provides for the protection
of person and matrimonial life, respect and protection of his or her residence and private
communication that include even protection of biometric registration records. However
Art.16 (2) of the CURT provides for possibility of other laws to encroach the right of
privacy, the said Article stipulated clearly that the law maker will enact law to stipulate
how privacy right may be protected, pursued or encroached by government agents.
Unfortunately, this requirement has not been putted into implementation.
In Tanzania of today, registration of Citizens, Refugees and Legal Residents is inevitable.
The Law requires each one at the age of eighteen to register himself with the biometric
system so as to get the National Identity card.
It has been further stated that, the long term vision towards the design and development
of National Biometric is that The National must provide the foundation to position itself
to participate in the e-Government information exchange Networks. The National
Biometric system is part of a larger vision that will further enable integration with other
national wide Governmental and Administration systems as well as be the starting point
for secure access and usage of forthcoming e-Government services in Tanzania11 . The
Spirit of the e-Government Information Exchange Network is to facilitate a sharing of

9
See Article 29 of Data Protection Working Party and the European Data Protection Supervisor whom have
opined widely on the use of Biometric data.
10
Of 1977
11
Gotham International Ltd, (2006),op.cit, at P.104

3
common systems and Infrastructure to provide for optimal utilization of resources with
increased efficiency. The above vision clearly emphasize the emergence of a situation
whether Biometric system would act as Central Unit to enable integration of various
Government and other Administrative and private businesses to work together.
there are lacuna in various Legislation touching on protection of individual privacy in
biometric registration in Tanzania and also there is no a piece of Legislation which is
enacted to exclusively deal with Protection of Individual Privacy matters exclusively, only
that there are scattered pieces of Legislations each attempting to provide for protection of
individual privacy on few area of the society for instance cyber, DNA’s to mention a few
but none of them was designated or specific on the protection of individual privacy on
biometric registration.

1.3 Objectives of the Study

The research aimed at having two categories of objectives namely; general objective and
specific objective as explained hereunder.

1.3.1 General Objective

The main objective of the study is to make Analysis on the Protection of Individual
Privacy through Biometric registration. So as to suggest the possible solution to the gap
of law which is found in the Tanzania’s data management system especially to the
protection of individual privacy on biometric registration.

1.3.2 Specific Objectives

Basing on Biometric registration the specific objective was as follows:
i. To identify the gap or legal problem on the protection of individual privacy on
biometric registration in Tanzania.

ii. To assess the level of awareness and recommend for the solution of the legal
problem toward the protection of individual privacy on biometric registration in
Tanzania.

4
1.4 Research Hypotheses

The researcher aimed to answer the following research hypotheses namely;

i. It appears that there is a legal gap in protection of individual privacy especially
on biometric registration in Tanzania.
ii. The Tanzanians are not aware on the technological effects of the Biometric
Registration.

1.5 Significance of the Research

The research is very significance in matter concerning with protection of individual

privacy under the Biometric registration. Hence the researcher add valuable knowledge
by establishing ways through which the Individual Privacy can be protected accordingly.
Analyze existing laws, identify gaps and advise the Tanzania Government and Tanzania
Identification Authority on how to improve the existing Policy, Laws and Regulations in
improving Protection of Individual privacy under the Biometric system.
The Findings of the Research is useful to Law Makers, Academicians, Potential
Researchers and other actors dealing with identification and registration of persons,
privacy matters and Data protection issues at large. It enable Biometric base to protect its
Databases and general information during interfacing activities with other stakeholder.
The Study shade light on this aspect.

1.6 Research Methodology

This study actually based on purely doctrinal Therefore, the research method of data
collection.

1.6.1 Data Collection Methods

Since the research is doctrinal in nature, hence data pertaining to Protection of Individual
Privacy: A case of Biometric registration. This were successfully through effective use of
skills of legal research in collection of secondary methods.

5
1.6.2 Secondary Data
Secondary data collection method which is on the theoretical perspective, the researcher
undertake the library research so as to lay the theoretical frame work for the study. This
were also conducted in order to assess work of other researchers and identify the
knowledge gap to cover.
An extensive review of available documentary sources such as books, journals, case law
materials, presentation papers both published and unpublished, articles as well as access
to internet sources were used by the researcher to obtain data in conducting this study.

1.6.2.1 Documentary Review

Documentary review gave a significant contribution to this research. The researcher

visited Library in order to gather secondary data to enrich the study. This included the
review of written documents like books, journals, magazines, government and non-
government reports and others.

1.6.2.2 Data Analysis

The analysis of data under this study were qualitatively demonstrating content analysis as
the analytical technique whereby the data were translated and interpreted into themes, the
combination of themes was made by conceptualizing meanings into research objectives.
After the collection of data were processed before analysis and interpretation. That is to
say data were analyzed through reduction of unwanted data to a manageable proportion.

6
 CHAPTER TWO

LITERATURE REVIEW

2.0 Introduction

This chapter discuss about the theories and concepts toward protection on individual
privacy on biometric registration in Tanzania. Everyone has the right to have his honor
respected and his dignity recognized. Privacy is the integrity while integrity is reputation
and dignity, when the reputation and dignity have been damage automatically the right to
privacy would be also infringed as these concepts are depending on each other. Privacy is
the desire of an individual to be free of intrusion.
2.1 Overview of the clarification of Previous Investigated Problem
Syed et al. (2017)12 argue that, people were confused and suspicious of the registration
process, and protests began to take place across the country Citizen groups also voiced
concerns surrounding the impact that the program had on people’s privacy rights. They
argued that Biometric registration was designed to be used as a tool to conduct
surveillance and to this they had reservations that;
Regardless of how important surveillance is for national security, from the citizens’
point of view these programs can be interpreted as being authoritarian or exploitative. In
addition, surveillance programs can be used to diminish political voice. A person develops
a political opinion through their social values, observations, readings, discussions, and
debates. Surveillance can curtail the freedom with which people are able to share their
ideas and opinions and reduce the diversity of public opinion and competing voices
Therefore being a new system recently introduced in Tanzania Biometric registration,
there is no study of this nature in Tanzania. Many references have been taken from
countries outside Tanzania that have implemented it, this therefore prompted the
researcher to undertake this study to understanding the process of Biometric registration
by determining the protection of individual privacy a case study of biometric registration.

12
Syed et al. (2017) Privacy, Security, and Surveillance in the Global South: A Study of Biometric
Mobile SIM Registration in Bangladesh. Department of Information Science, Cornell University, Ithaca,
NY, USA.

7
Rainie, L(2012)13 in his research on American privacy he found that, there is more
personal information which are online like photos of us, our date of birth, email address,
companies we work, our home address. He further provides that, such aforesaid
information, large number of majority says consumers have lost control of such
information, so the consumer cannot control the collection and usefulness of personal
information by companies. This is very true and exposes us to violation of our right to
privacy for instance now it is not a surprise to get unsolicited email (message) from
commercial companies like Google when you have email account, again social media like
in face book, twitter, you may receive aforesaid messages.
Jain et al. (2006)14 in there book maintain that biometric refers to identifying a person
based on his or her physiological or behavioral characteristics; it has the capability to
reliably distinguish between an authorized person and an imposter. A biometrics system
is a recognition system which operates by acquiring biometric data from an individual,
extracting feature sets and comparing it with the template set in the database. Depending
upon the application context, the identity of a person can be resolved in two ways:
verification and identification. In the former, a person to be identified submits a claim;
which is either accepted or rejected. In the latter, a person is identified without a person
claiming to be identified.

Makulilo (2011)15 argues that the requirements for SIM card registration introduced by
the EPOCA Act, 2010 does not protect privacy of the people and there needs to be a proper
safeguard of the privacy of the people as contained under Article 16 (1) of the Constitution
of the United Republic of Tanzania of 1977 (as amended from time to time).
All in all this being a new system recently introduced in Tanzania Biometric registration,
there is no study of this nature in Tanzania. Many references have been taken from

13
Rainie, L (2012), Privacy in Digital Age, Public Attitudes about Personal Information and Veillances, p5-
23 available at http//:www.pewinternet.org. Accessed on 20 th August 2020 at 18:13 pm
14
Jain et al. (2006) Biometrics: A Tool for Information Security. IEEE Transactions on Information
Forensics and Security, Vol. 1. PP. 259-269
15
Makulilo, B.A., (2011), “Registration of SIM cards in Tanzania: a critical evaluation of the
Electronic and Postal Communications Act 2010”, Computer and Telecommunications Law Review

8
countries outside Tanzania that have implemented it, this therefore prompted the
researcher to undertake this study to understanding the process of Biometric registration
by determining the protection of individual privacy a case study of biometric registration.
Mir A.H, R, & Jhat, Z. A (2018)16 Biometric registration refers to an automatic
verification of a person based on some specific biometric features derived from his/her
physiological and/or behavioral characteristics. A biometric verification system has more
capability to reliably distinguish between an authorized person and an imposter than the
traditional systems that use a card or a password. In biometrics, a person could be
recognized based on who he/she is rather than what he/she has (ID card) or what he/she
knows (password). Currently, biometrics finds use in ATMs, computers, security
installations, mobile phones, credit cards, health and social services. The future in
biometrics seems to belong to the multimodal biometrics (a biometric system using more
than one biometric feature) as a unimodal biometric system (biometric system using single
biometric feature) has to contend with a number of problems concerning with the
individual privacy in one way or another.

Habibu, T.S (2018)17 the increase in terrorism and identity fraud has forced government
worldwide to make a combined effort to enhance the security of national borders.
Biometric passports are the emergent identity travel document deployed in guaranteeing
the safekeeping of the entry point of the border and limiting the usage of counterfeit
document. All in all factors impacting fear of technology like disclosure of personal
privacy data, improper data transmission and the issue of awareness and perceived
usefulness was confirmed. It is important for policymakers and security expertise to
understand that biometric registration evoke fear of privacy and public liberties
infringements. Therefore end users acceptance of biometric system will be dependent on
the degree of trust in the technology itself and in those operating the applications.

16
Biometrics Verification: a Literature Survey. Journal of Computing and ICT Research, Vol. 5, Issue 2,
pp. 67-80. http://www.ijcir.org/volume5-number2 /article7.pdf accessed on 20th August 2020 at 18:13 pm
17
Habibu, T.S (2018) Assessment of Vulnerabilities of the biometric template Protection Mechanism.Int.J.
Technol. Eng. Explor pp. 243-254.

9
This being a new system recently introduced in Tanzania Biometric registration, there is
no study of this nature in Tanzania. Many references have been taken from countries
outside Tanzania that have implemented it, this therefore prompted the researcher to
undertake this study to understanding the process of Biometric registration by determining
the protection of individual privacy a case study of biometric registration.
Herman,M & Daniel,K (2016)18 The application of biometrics for human identification
and verification is not a new concept, it is believed that the first use of biometrics was for
identification of children in China and Babylon, thousands of years ago whereby
fingerprint and palm prints were used for that purpose. Recently, massive deployment of
biometric systems has been witnessed in several organizations, especially for security and
attendance monitoring purpose in areas such as airports, borders, and work places to
mention just a few. However, the situation has been different in the Tanzania’s financial
sector. It is estimated that in Tanzania, financial institutions have lost about $1billion
between 2013 and 2014 through electronic related frauds. Most of these high tech frauds
were taking place by using Automated Teller Machines (ATMs). Perpetrators of these
frauds were involved in illegal ATM’s transactions by hijacking different customer’s
accounts using special devices that are used to record customers’ Personal Identification
Number (PIN). In attempt to redress this situation, the central bank of Tanzania has
directed all commercial banks in the country to conduct awareness raising campaigns on
safely using ATMs, carefully handling of PIN and proactively deploying Closed Circuit
Television (CCTV) in ATM cabins. However, the directives of the central bank of
Tanzania have not been properly honored. Despite the usefulness of biometric
technologies, most financial institutions, especially in developing countries and Tanzania
in particular, have been slow in adopting them.

18
Herman,M & Daniel,K (2016) Biometric Authentication in Financial Institutions: The intention of Banks
to Adopt Biometric Powered ATM

10
Vakul Sharma (2011), on his book of ‘Information, technology-law and practice and
practice’19 argued that privacy in the technology it became a kind of double-edged sword
which equips the person to safeguard his privacy and in the other hand it helps blowing
the privacy cover20. Privacy is the claim of individual, groups, or institutions to determine
for themselves when, how and to what extent information about them is communicated to
others. Even the biometrics data on registration are kept into the technology devices like
computer and they may leak and to injure a particular person, but to what extent is the
biometric data into the technology devices are protected? Do our law recognized the
protection of biometric data into technology’s arena? The author tried to emphasize the
protection of individual privacy into technology devices, this study try to develop his ideas
and suggesting them to our law to adopt them if possible21.

2.2 The Legal Position of the Law Governing Protection of Individual Privacy

To date, the Tanzania has no a one compounded piece of Legislation which is providing
for the Data protection and privacy matters in Tanzania. The Parliament of Tanzania has
not so far enacted this kind of Legislation.

2.2.1 The Constitution of the United Republic of Tanzania as amended from time to
time 197722
The Constitution of the United Republic of Tanzania (hereinafter, ‘The Constitution’),
which is currently in force, is that of 1977 and has been amended on various occassion.
This is the Supreme Law of the Land in Tanzania and all laws in force are inevitably have
to be in conformity with it, short to that, such other Law is rendered Null and Void23.

19
Vakul Sharma, Information, technology-law and practice,3rd edition, New Delhi University law
publishing co. pv Ltd, 2011
20
Ibid, p.249
21
Ibid, p.354
22
[Cap 2 R: E 2002]
23
See the case of Kukutia Ole Pumbun and Another v. Attorney General and Another [Civil Appeal
No. 32 of 1992]
In this Case, the Court of Appeal of Tanzania, held inter alia, that certain provisions of the Government
Proceedings denied the Appellant of his Constitutional right of Accessing justice form the Court of Law by
requiring him to first obtain Consent of the Minister to be able to sue the Republic, and therefore declared
S.6 of Government Proceedings Act of 1967 as amended by Act No.40 of 1974, as Unconstitutional

11
On its side, the Constitution has provided for the Right to privacy and recognising the
Constitutionality of that right in Tanzania. On this, it provides that;
“Every person is entitled to respect and protection of his person, the privacy of his
own person, his family and of his matrimonial life, and respect and protection
of his residence and private communications”24

However, the same Constitution has not granted this right with absoluteness, but it has
subjected it to certain bureaucracies of the Government during such processes of
granting it. Here, the Constitution further provides that;
“For the purpose of preserving the person’s right in accordance with this Article,
the state authority shall lay down legal procedures regarding the circumstances,
manner and extent to which the right to privacy, security of his person, his property
and residence may be encroached upon without prejudice to the provisions of this
Article”25

Conclusively, one may say that, though the right to privacy has been thoroughly stated in
the Supreme law of the Land, the many limitations imposed in unto its absoluteness and
its enjoyment may render it non-existent to the judgement that it has not been provided
for within the Constitution or it is better for it not to appear there under the auspices of
Article 16 of the same Constitution. But also it can be said that, the law does not clearly
and adequately secures the right to privacy in Tanzania. Due to this fact, it falls short
below the international standard of judicial oversight. Again due to this there is the chance
of violation of the right to privacy by the law enforcement officers, and thus the right to
privacy on corporations and individual are at risk of being violated and prejudiced.
Furthermore the study found that, there is little awareness to the people toward their right
to privacy as incorporated under the biometric registration.

24
Article 16(1) of the Constitution of the United Republic of Tanzania.
25
Ibid at Article 16(2)

12
2.2.2 The Electronic and Postal Communication Act of Tanzania (EPOCA)26
The Electronic and Postal Communication Act (Hereinafter EPOCA for purposes of this
Dissertation) is an Act of Parliament of the United Republic of Tanzania which was
enacted to harmonise the postal and communications regulation in the Country.
EPOCA was passed by the Tanzanian Parliament on January 29, 2010 and assented to by
the President on March 20, 2010. The Act came into force on May 7, 2010. It repealed
and replaced two pieces of legislation in the Tanzanian communication sector: the
Broadcasting Services Act and the Tanzania Communications Act. It also amended the
Tanzania Communications Regulatory Authority Act and the Fair Competition Act.
However, it saved all regulations made under the repealed laws to the extent that they are
not inconsistent with EPOCA and not expressly revoked27.
On the part of the protection of Data and even privacy of the Data subjects subscribing
themselves with the various Mobile Companies, the Act requires that every mobile phone
owner to register his or her Sim Card with the respective Company which he previously
subscribed him or herself with. This requirement is provided for by EPOCA by stating
that;
“Every person who owns or intends to use detachable SIM card or built-in SIM
card mobile telephone shall be obliged to register SIM card or built in SIM card
mobile telephone”28

However The concern comes up due to the fact that, the excercise of this right which
favours for the Data protection is again subjected to the procedural requirements similar
to that of Article 16(2) of the Constitution of the United Republic of Tanzania of 1977 as
amended. It empowers certain Agencies to ask from the Phone Companies for certain
informations which they find fit for the improvement of security issues. But not only does

26
Act No.3 of 2010
27
Makulilo, B.A., (2011), “Registration of SIM cards in Tanzania: a critical evaluation of the
Electronic and Postal Communications Act 2010”, Computer and Telecommunications Law Review, at
P.3
28
Section.93(1) of the Electronic and Postal Communication Act of Tanzania [Act No.3 of 2010]

13
the Act provides for that, it has also provided some other circumstances which it find
suitable to allow the information of a person to be revealed.29

Therefore, if this privilege of disclosing such information given to the certain categories
of person as stated above is abused, then Data of that particular individual which has been
obtained may fall into wrong hands maybe due the influences of corruption or element of
unfaithfulness on the part of an Employee of the registering Company.

2.2.3 The Electronic and Postal Communications (Sim Card Registration)30

The regulation came in force on 7th May 2020 under this regulation individual are
prohibited from owning/using more than 1 SIM card from the same operator for use on
voice, short message and data services. On the other hand, an individual is allowed to
own/use a maximum of 4 SIM cards from different operators for use on machine to
machine communication. In case of a company or an institution, the Regulations prohibits
owning of more than 30 SIM cards from the same operator and not more than 50 SIM
cards from different operators for use on machine to machine communication. However,
a customer may be allowed to register/own more than the maximum specified number of
SIM cards upon being granted an approval from Tanzania Communications Regulatory
Authority.
To ensure implementation on the limit of SIM cards an individual or a company can own,
the regulations provide a grace period up to 30 June 2020 for customers who own more
than the required number of SIM cards to choose SIM cards that are to remain active
because the Authority expects to deactivate the remaining numbers.

However in accordance with regulation 2031 it is an offence on misuse of information by

any licensee, dealer or agent who misuses information of a customer for Sim Card
registration commits an offence and upon conviction shall be liable to a fine of not less

29
Section 99 of Act No.3 of 2010.
30
Regulations, 2020
31
The Electronic and Postal Communications (Sim Card Registration) Regulations, 2020

14
than five million Tanzania shillings or imprisonment for a term not less than twelve
months or both.

As seen above, most of the Legislation denies the disclosure of certain personal Data but
on the other hand allows such disclosure by only observing the permission of the Minister
responsible in that Ministry but without mentioning of the prior consent of the data Subject
whose Consent is paramount under the Principle of Privacy protection regard the
processing of personal Data

2.3 Conclusion

Conclusively, one may say that, though the right to privacy has been thoroughly stated in
the Supreme law of the Land, there are many limitations imposed in its absoluteness and
its enjoyment may render it non-existent to the judgement that it has not been provided
for within the Constitution or it is better for it not to appear there under the auspices of
Article 16 of the same Constitution

15
 CHAPTER THREE

PRESENTATION OF FINDINGS, ANALYSIS AND DISCUSSION

3.0 Introduction

The obligation of protection of biometric registration data must go beyond undertaking

not to divulge confidential information but to include a responsibility to make sure that all
records containing biometric registration are kept securely. This chapter emphasize the
notions above through examining the regulations and other findings in relation to
objectives.

3.1.1 Analysis on the Protection of Individual Privacy through Biometric registration

Findings was collected from the different sources of secondary data basically library,
literally works, internets, and online open forums. To address the hypotheses, data were
obtain through library materials.

3.1.2 Protection of individual privacy on biometric registration into Government

Institutions in Tanzania
The legal basis of the duty to maintain individual privacy arises from both statute and
common law. Statutes can make it an offence to disclose biometric data to a third party,
while in common law the duty developed in cases where people sued institution which
have allegedly disclosed biometric data without justification. The government
institution’s data collectors has the duty of maintain confidentiality to their customers, in
the case of Parry Jones v. Law Society32it has been suggested that biometric data
collectors must have legal duty to maintain individual privacy, on the issue of legal duty
which may arise from the biometric registration of an individual data, Lord Denning
argued that “that the law must implies a term into the contract whereby a professional
man is to keep his client’s affairs secret and not to disclose them to anyone without just
cause.” The duty of protection of individual privacy during registration of biometric data

32
[1969] 1 Ch 1

16
patient records must be subjected to government institutions which specifically collect and
keep biometric data such as NIDA, TCRA, NEC just to mention few.
This hypothesis was well investigated by divide it into two distinguish qualities, firstly is
how government institution like NIDA are protect individual privacy during biometrics
registration, and how the limitation of the access of the individual data which are privacy
are protected from interference to third parties and un authorized persons? And secondly,
is how biometrics data which are collected from individuals are protected in absence of
specific law which may facilitate the protection of biometrics data and provide for the
liabilities toward access of biometric registration data.
Findings shows that government workers who are employed to work biometrics
registration of data/records they agree that they never heard any law or regulation which
stipulate clear about protection of individual privacy during biometric registration rather
than their institution’s code of conduct which it only applicable to them, so the question
was which law, regulation or any document which at least stipulate about the procedures
to follow by individual when his or her information are illegal disclosed by the biometrics
data collectors? The materials show that respondents were not aware about any law or
regulation which guide the procedures of claims against illegal disclosure of individual
records during biometric registration.

The researcher found out that, that the code of ethics and profession conduct of
government institutions of biometric data registries are bind only the workers of that
institution particularly biometric data collectors department and only to maintain
confidentiality of the institution and them code of conduct has nothing to do with other
who are used to corporate or interact with that particular institution for instance NIDA to
TCRA, not only that, the code of conduct didn’t stipulate about the liability on penalties
toward the illegal disclosure of individual records which are found on biometrics data.
Also the procedures to follow by the breached party. So the protection of individual
privacy concern biometric data registration into the government institutions which deals
with biometric registration still it is on dilemma.

17
3.1.3 Persons perceptions toward protection of individual privacy concern biometric
registration
The researcher collects findings from the different secondary data which shows data which
are collected from the first hand where individuals was interviewed from different few
areas, mostly of respondent they said they are not comfortable with protection of their
information which was collected during biometric registration. Also they said that there is
speculation of disclosure of individual privacy to the machinery institutions like Police by
the government biometric data collection institutions.
literary works, articles and other publish findings shows that Science and technology is
the new challenges on how to handle the protection of individual privacy on biometric
registration especially when the law is silent, even people are not comfortable with the
way how their records are protected into the institutions that may easily disclosed.

3.2 The law concerning Individual Privacy in Tanzania, a case of biometric

registration

To date, the Tanzania has no compounded piece of Legislation which direct is providing
for the Data protection and privacy matters in Tanzania. The Parliament of Tanzania has
not so far enacted this kind of Legislation.

3.2.1 The Constitution of the United Republic of Tanzania as amended from time to
time 197733
Although Tanzania’s Constitution guarantees the right to privacy, the country does not
have a comprehensive law to regulate the collection, processing and sharing of personal
data including safeguards against the possible violations of the personal data collected.
The constitutional provision and other provisions within other existing laws are too
general to address the vulnerability of the ongoing personal data collection programmers,
and as such the protection of individual privacy the vast amounts of data remains at risk.34

33
[Cap 2 R: E 2002]
34
Tanzania Human Rights Defender (THRDC) ‘’The Report on the Right to Privacy in Tanzania” 2015.p.1

18
The Constitution of the United Republic of Tanzania (hereinafter, ‘The Constitution’),
which is currently in force, is that of 1977 and has been amended on various occassion.
This is the Supreme Law of the Land in Tanzania and all laws in force are inevitably have
to be in conformity with it, short to that, such other Law is rendered Null and Void35.

On its side, the Constitution has provided for the Right to privacy and recognising the
Constitutionality of that right in Tanzania. On this, it provides that;
“Every person is entitled to respect and protection of his person, the privacy of his
own person, his family and of his matrimonial life, and respect and protection of
his residence and private communications”36

However, the same Constitution has not granted this right with absoluteness, but it has
subjected it to certain bureaucracies of the Government during such processes of
granting it. Here, the Constitution further provides that;
“For the purpose of preserving the person’s right in accordance with this Article,
the state authority shall lay down legal procedures regarding the circumstances,
manner and extent to which the right to privacy, security of his person, his property
and residence may be encroached upon without prejudice to the provisions of this
Article”37

If you look at the Sub-Article 2 of Article 16 of the Constitution, you can see that the right
to privacy which has been provided substantively, its grant may be put into jeopardy buy
the technicalities which may put brought up by the procedures which are set and said to
be the once to provide on how that right to privacy may granted.

35
See the case of Kukutia Ole Pumbun and Another V. Attorney General and Another [Civil Appeal
No. 32 of 1992]
In this Case, the Court of Appeal of Tanzania, held inter alia, that certain provisions of the Government
Proceedings denied the Appellant of his Constitutional right of Accessing justice form the Court of Law by
requiring him to first obtain Consent of the Minister to be able to sue the Republic, and therefore declared
S.6 of Government Proceedings Act of 1967 as amended by Act No.40 of 1974, as Unconstitutional
36
Article 16(1) of the Constitution of the United Republic of Tanzania.
37
Ibid at Article 16(2)

19
The Second instance where the Constitution bars the absolute enjoyment of the right to
privacy is through maintaining the provisions of Article 30(2)38 which provides that;

“It is hereby declared that the provisions contained in this Part of this Constitution
which set out the principles of rights, freedom and duties, does not render unlawful
any existing law or prohibit the enactment of any law or the doing of any lawful
act in accordance with such law for the purposes of.....”

Regarding Article 30(2), of the Constitution, the High Court of the United Republic of
Tanzania once held that;
“A law which seeks to limit or derogate from the basic right of an individual on the
grounds of public interest, will be saved by Article 30(2) of the Constitution, if it satisfies
two requirements: firstly, such law must be lawful in the sense that it is not arbitrary. That
means it should make adequate safeguards against arbitrary decisions and provide
effective controls against abuse of those in authority when using the law. Secondly, the
limitation imposed by such a law must not be more than is necessary to achieve the
legitimate object. This is also known as the principle of proportionality.39

Conclusively, one may say that, though the right to privacy has been thoroughly stated in
the Supreme law of the Land, the many limitations imposed in unto its absoluteness and
its enjoyment may render it non-existent to the judgment that it has not been provided for
within the Constitution or it is better for it not to appear there under the auspices of Article
16 of the same Constitution. But also it can be said that, the law does not clearly and
adequately secures the right to privacy in Tanzania. Due to this fact, it falls short below
the international standard of judicial oversight. Again due to this there is the chance of

38
This Sub-Article has provided may Instances where the Human and other provided can be denied for
various reasons provided therein from para (a)-(f)
39
See the for example various cases of Kukutia Ole Pumbun v Attorney General [1993] T.L.R. 159;
Julius Ishengoma Francis Ndyanabo v Attorney General , Civil Appeal No.64 of 2001, Court of Appeal
of Tanzania, at Dar es Salaam (Unreported); Legal and Human Rights Centre v Attorney General,
Miscellaneous Civil Cause No.77 of 2005, High Court of Tanzania, at Dar es Salaam (Unreported);
Christopher Mtikila v Attorney General, Miscellaneous Cause No.10 of 2005, High Court of Tanzania,
at Dar es Salaam (Unreported).

20
violation of the right to privacy by the law enforcement officers, and thus the right to
privacy on corporations and individual are at risk of being violated and prejudiced.
Furthermore, the study found that, there is little awareness to the people toward their right
to privacy as incorporated under the biometric registration.

3.2.2 The Electronic and Postal Communication Act of Tanzania (EPOCA)40

The Electronic and Postal Communication Act (Hereinafter EPOCA for purposes of this
Dissertation) is an Act of Parliament of the United Republic of Tanzania which was
enacted to harmonise the postal and communications regulation in the Country.
It repealed and replaced two pieces of legislation in the Tanzanian communication sector:
the Broadcasting Services Act and the Tanzania Communications Act. It also amended
the Tanzania Communications Regulatory Authority Act and the Fair Competition Act.
However, it saved all regulations made under the repealed laws to the extent that they are
not inconsistent with EPOCA and not expressly revoked41.
EPOCA was enacted with three fundamental objectives. The first was to address the
challenges posed by modern technologies, especially the convergence of technologies.
The second was to harmonise and consolidate communication laws in order to overcome
regular conflicts in their implementation, and the third was to introduce the Central
Equipment Identification Register (CEIR) and registration of SIM cards

On the part of the protection of Data and even privacy of the Data subjects subscribing
themselves with the various Mobile Companies, the Act requires that every mobile phone
owner to register his or her Sim Card with the respective Company which he previously
subscribed him or herself with. This requirement is provided for by EPOCA by stating
that;

40
Act No.3 of 2010
41
Makulilo, B.A., (2011), “Registration of SIM cards in Tanzania: a critical evaluation of the
Electronic and Postal Communications Act 2010”, Computer and Telecommunications Law Review, at
P.3

21
 “Every person who owns or intends to use detachable SIM card or built-in SIM
card mobile telephone shall be obliged to register SIM card or built in SIM card
mobile telephone.42

During registration, an Applicant is required, apart from filling the registration form
provided by the respective Company, to supply the following attachment bearing his or
her particulars. The full name of the potential subscriber; identity card number or any
other document which proves identity of the potential subscriber; and residential and
business or registered physical address, whichever is applicable43. The element of
confidentiality to be maintained by the subscribing Company regarding the information
obtained during registration is clearly imposed. EPOCA requires the subscribing
Company to treat the information obtained during registration of the Sim Card as
confidential. EPOCA has clearly stated this position by stating that;
“A person who is member, employee of application service licensee, or its agent,
shall have a duty of confidentiality of any information received in accordance with
the provisions of this Act
The concern however comes up due to the fact that, the excercise of this right which
favours for the Data protection is again subjected to the procedural requirements similar
to that of Article 16(2) of the Constitution of the United Republic of Tanzania of 1977 as
amended. It empowers certain Agencies to ask from the Phone Companies for certain
informations which they find fit for the improvement of security issues. But not only does
the Act provides for that, it has also provided some other circumstances which it find
suitable to allow the information of a person to be revealed. It provides that;
“A person shall not disclose any information received or obtained in exercising his
powers or performing his duties in terms of this Act except

(a) Where the information is required by any law enforcement agency, court of
law or other lawfully constituted tribunal;

42
See S.93(1) of the Electronic and Postal Communication Act of Tanzania [Act No.3 of 2010]
43
S.93(2) (a), Ibid

22
 (b) Notwithstanding the provision of this section, any authorized person who
executes a directive or assist with execution thereof and obtains knowledge of
information of any communication may -

(i) Disclose such information to another law officer to the extent that such
disclosure is necessary for the proper performance of the official duties of the
authorized person making or the law enforcement officer receiving the disclosure;
or

(ii) Use such information to the extent that such use is necessary for the proper
performance of official duties”44.

Conclusively, if this privilege of disclosing such information given to the certain

categories of person as stated above is abused, then Data of that particular individual
which has been obtained may fall into wrong hands maybe due the influences of
corruption or element of unfaithfulness on the part of an Employee of the registering
Company.

3.2.3 The Electronic and Postal Communications (Sim Card Registration)45

The regulation came in force on 7th May 2020 under this regulation individual are
prohibited from owning/using more than 1 SIM card from the same operator for use on
voice, short message and data services. On the other hand, an individual is allowed to
own/use a maximum of 4 SIM cards from different operators for use on machine to
machine communication. In case of a company or an institution, the Regulations prohibits
owning of more than 30 SIM cards from the same operator and not more than 50 SIM
cards from different operators for use on machine to machine communication. However,
a customer may be allowed to register/own more than the maximum specified number of
SIM cards upon being granted an approval from Tanzania Communications Regulatory
Authority.

44
S.99 of the Electronic and Postal Communication Act of Tanzania [Act No.3 of 2010]
45
Regulations, 2020

23
To ensure implementation on the limit of SIM cards an individual or a company can own,
the regulations provide a grace period up to 30 June 2020 for customers who own more
than the required number of SIM cards to choose SIM cards that are to remain active
because the Authority expects to deactivate the remaining numbers.

However in accordance with regulation 2046 it is an offence on misuse of information by

any licensee, dealer or agent who misuses information of a customer for Sim Card
registration commits an offence and upon conviction shall be liable to a fine of not less
than five million Tanzania shillings or imprisonment for a term not less than twelve
months or both.

3.3.4 The Records and Archives Management Act of Tanzania47

The Records and Archives Management Act (hereinafter the Act for the purposes of this
part of the Dissertation), is the creature of the Parliament of the United Republic of
Tanzania enacted in the year 2002 and is the Act No.3.It was assented by the late President
of Tanzania, President Benjamin William Mkapa on 28th March,200248.
In its long title, the Act has stated the purpose of its enactment to the following effect;
“An Act to establish the Records and Archives Management Department to
provide for the proper administration and better management of public records
and archives throughout their life cycle, to repeal the Records (Disposal)
Ordinance,1931, and the National Archives Act, 1965, and for connected matters49

Just from the explanation of the Long title of the Records and Archives Management Act
as stated above, it is doubtful that, amongst the information which would be managing by
the said Department created, would include the personal information of individuals whom
by the virtue of their employment or any other reason which justified such collection,
made them the subject of such records.

46
The Electronic and Postal Communications (Sim Card Registration) Regulations, 2020
47
[ Act No.3 of 2002]
48
Retrieved from http://bunge.parliament.go.tz/PAMS/docs/3-2002.pdf. Accessed on 21st December
2020 at 16:13 pm
49
The Long title of the Act No.3 of 2002 of Tanzania

24
Now, of interest regarding issues of Data Protection and privacy issue revolves within the
provision of Section.1650 regarding the so called ‘Thirty (30) years rule ‘which allows for
the Records or Archives to be destroyed after they attain the period of thirty years since
they were created. The Act reads as follows;
“Subject to any written law prohibiting or limiting the disclosure of information
any public record, public records in the National Archives, in any other archival
repository under the control of the Director or in a place of deposit appointed
under section 15 of this Act, shall be available for public inspection after the
expiration of a period of thirty years from their creation, calculated as prescribed
in subsection (2) of section 4 of this Act, except in so far as a longer or shorter
period may have been prescribed by the Minister by regulations made in
accordance with section 28 of this Act at the request of the head of the public'
office which created the records or its successor in function”51

The Act further provides that;

“A longer period than thirty years may be prescribed under subsection (1) only when there
is a continuing need to restrict public access on grounds of -
(a) National Security;
(b) Maintenance of Public Order;
(c) Safeguarding the Revenue; or
(d) Protection of the Privacy of living Individuals”52.

Now analysing the two Subsections above, yes it is a good approach to allow the access
by the Public of the said Documents after such a long time of retention, and again
restricting the same access to some other Document by prolonging the time of thirty (30)
to more as the Minister may stipulate53 in the Government Gazzette.

50
Ibid
51
Section 16(1) of Act No.3 of 2002 of Tanzania
52
Section 16(3) Ibid
53
For the Powers of the Minister regarding duration of Records and Archives retention as provided by
Section.16(1), Ibid

25
But issues relating to Data and Privacy Protection, it would be sounding for the sake of
protection of personal Data, for it to be provided in the same Act that personal data are
not subject for public scrutiny not just by elongating the time from thirty (30) years to
more years, but by exempting completely personal Data and subjecting them to other
Legal Mechanism of Data Protection principles on the processing of Personal Data, and
not simply by saying now this personal Data can go Public. This is due to the fact that
personal data is personal Data regardless how they were obtained. Therefore, this is
another piece of Legislation which has tried to set up some initiatives54 on protecting
personal Data and the privacy of the individuals but there should be set principles of world
standard on how Data concerning private life of an individual can be protected. They not
be subjected to thirty (30) years Rule only, but to a special category of Information and
its own mechanisms on how to handle them.

All in all, as seen above, most of the Legislation denies the disclosure of certain personal
Data but on the other hand allows such disclosure by only observing the permission of the
Minister responsible in that Ministry but without mentioning of the prior consent of the
data Subject whose Consent is paramount under the Principle of Data protection regard
the processing of personal Data.
3.3 The Tanzanians are not aware on the technological effects of the Biometric
Registration.
Biometric system has the capability to reliably distinguish between an authorized person
and an imposter. A biometrics system is a recognition system which operates by acquiring
biometric data from an individual, extracting feature sets and comparing it with the
template set in the database.55
The emergence of Biometric system in the various parts of the world has resulted into the
extraction of huge amount of personal information from the people resident in the
respective Countries. The application for one to be included in the Biometric system is the
mandatory as these people are required to do so by the law and not by their will. A good

54
Section.16 (3) (d) of Act No.3 of 2002.
55
Jain et al. (2006) A Tool for Information Security. IEEE Transactions on Information Forensics and
Security, Vol. 1. p.68

26
example of such establishment by the statute regarding Registration and Identification of
persons here in Tanzania, is the presence of the Registration and Identification of persons
Act of 1986.All current registration and Identification of persons here in Tanzania form
2012 to date is executed under the mandate provided so by this Legislation.

These Data once collected and the registered under biometric system is done, the next
thing one has to consider is the administration and processing of such massive amount of
Data collected during their use, extraction, access to such Data and the ultimate
destruction of the same personal Data previously collected. For the case of Tanzania for
example, as it has been stated in the efficacy study56 that, after the execution of
registration and identification of persons and the Data already collected, then they may be
used for various purposes such as to issue the Sim Card.
It was stated that;
“ The Biometric system is part of a larger vision that will further enable integration with
other nationwide governmental and administration systems as well as be the starting point
for secure access and usage of forthcoming e-Government services in Tanzania. It is also
open for controlled access and usage by private businesses allowing using the high level
of trust provided by the program also for increasing the security of transactions between
Citizens and Businesses”.57

If clearly observed, once the Biometric system is complete here in Tanzania in a full fledge
scale, then the massive individual Data collected during the registration and identification
of persons would be shared with other stake holders through interfacing mechanism as
experience from other Countries with the already established system does so.

With this kind of practice therefore, though these stakeholders are given information under
certain strict conditions and under legal obligation of not disclosing such information

56
Bazazi, B (2020), Efficacy and Challenges of Implementation of Biometric SIM card Registration by
Mobile Network Operators Using the National Identification Card in Tanzania: A Case of Dar es Salam
Region at. P 21
57
Ibid at p. 21

27
during the conduct of their businesses, there is a need of these Stakeholders of having
known-about the Data Protection Principles58 so as to properly handle such personal data
of which some are sensitive. Once there is a firm Legal framework providing for such
protection, automatically, during interfacing, the Key Data Players being Data Controller,
Data Subject and the Data Processor each would know his rights and obligations and
therefore a complete avoidance of abuse of such personal Data given to them by the
Tanzania Communications Regulatory Authority (TCRA) . This example may be
sufficient to explain. We expect after proper establishment of the Biometric systems,
Banks as one of the Private Stakeholders to interface with TCRA in order for them to
identify certain individuals who apply for loans from the Bank.

Further, in the presence of Data and Privacy protection Legal Framework Regime, it will
have a positive impact to the reactions of individuals whom are required to provide for
their information. The Data Subjects here would not worry of the abuse of their personal
information which they have provided to the Data Controller. Moreover, the presence of
the Legal framework for Data and Privacy Protection will boost the urge of Westerners in
the participation in the Biometric registration project as they would know that the
requirements of Article 2559 of the European Union on the Transfer of personal data to the
third party Countries has been satisfied. This provision provides that;

“The Member States shall provide that the transfer to a third country of personal
data which are undergoing processing or are intended for processing after
transfer may take place only if, without prejudice to compliance with the national
provisions adopted pursuant to the other provisions of this Directive, the third
country in question ensures an adequate level of protection”

So putting into place of a firm Legal Framework for Data Protection and Privacy would
simply the entire work of Data processing after the system is well established and devoid

58
Article 6 of European Union Directive on Data Protection (Directive 95/46/EC)
59
Ibid

28
Biometric registration of a burden of reminding its Stakeholders of the duty of fair and
lawful processing of such Data given to them by TCRA during interfacing.

Conclusively, Data Subjects whom are registered with Biometric system may well be
protected by TCRA under the duty of non-disclosure of the such personal information
gathered during registration before this information leaves TCRA through interfacing, but
are not well covered if TCRA will start interface with other Stakeholders whom will
request such information for various purposes in the transactions. With the enactment of
Data Protection Act, the Data Subjects will be much secure.
Moreover, Inadequate of public awareness on the technology remains to be the
cornerstone for any project involving the public to succeed. Respondents from mobile
operators raised a concern that much of the attention was aimed at putting the systems
ready for registration while people were not fully prepared. Additionally, much of the
focus was to register SIM cards while on the other hand a focus would have been to work
hand in hand with NIDA to ensure that many people were registered and issued with NIDA
IDs/NINs. The importance of public awareness helps also the public to be part of the
project and embrace the outcomes. This shortcoming can better be referenced with what
happened in Bangladesh where implementation of Biometric registration60 was met with
initial resistances from some groups of individuals who were concerned that this method
will give opportunity to the government to conduct surveillance against them which would
intrude and violate personal privacy.61

60
Syed et al. (2017) Privacy, Security, and Surveillance in the Global South: A Study of Biometric
Mobile SIM Registration in Bangladesh. Department of Information Science, Cornell University, Ithaca,
NY, USA p.6
61
Bazazi, B (2020), Efficacy and Challenges of Implementation of Biometric SIM card Registration by
Mobile Network Operators Using the National Identification Card in Tanzania: A Case of Dar es Salam
Region p.83

29
 CHAPTER FOUR

CONCLUSION AND RECOMMENDATIONS

4.1 Conclusion

After analyzing the general background of protection of individual privacy on biometric

registration as the case study in chapter one of this work, then definitions and explanations
of some concepts from literature review which are used in this work under chapter two,
and also successfully pointing out the research findings in chapter three of this work.
The hypotheses proves the problem existence. This study reveals that, the failure of
interpretation of Art. 16(2) of the CURT62 which led to inadequacy of effective legal
framework to facilitate the protection of individual privacy on biometric registration. The
presence scattered legislations are seems to restricting some individual privacy on
different perspective of the records management in government institution patient rather
than granting absolute fully protection especially on biometric data collected from
individuals. There Legal challenges face the protection of individual privacy during
biometric registration in Tanzania, and it’s observed that there is no specific regulation
which dare to protect individual privacy on biometric registration data. It’s time now
authorities which vested power by the Constitution to put Article 16 into implementation
and let right of privacy protect by specific statute.

The researcher concluded that for the smooth running of the Biometric system there must
be the establishment of the Legal framework for Data and privacy protection. Once the
massive personal Data are collected for the purpose of issuance of the Identity Card, and
later for the other purpose of sharing with the stake holders for their own business use,
then the principles of Data Protection are inevitable. What is actually created are typically
different Actors of Data Processing similar to those in the Data and Privacy protection
regime, being the Data Controller, Data Subject and the Data Processor. Again, how these

62
Of 1977

30
Actors conduct their activities by using the personal data in their custody are strictly
guided by the Data protection principles.

The proposed Bill of Privacy and Data Protection Act63 which it’s been on progress since
the ministry of communications, science and technology announced it. But the bill
developed as part of cyber security initiative and there is no provision which stipulate
about protection of individual privacy on biometric registration by the government
institutions.
So in order to ensure proper and effective protection of individual privacy concern
biometric registration in different circumstances like normal environment and digital
environment, there is a need of updating legal and institutional framework in terms of
provisions of the law and enforcement strategies so as to cover this loop-holes which are
seems to exist in our laws.

4.2 Recommendations

Having observed various Lacuna in the various existing Legislations which attempted in
one way or another to provide for Data and Privacy protection regime in Tanzania, it is in
the Opinion of the Researcher as follows;
Data Protection Act is to be enacted so as to properly administer matters relating to Data
protection and privacy in Tanzania. The Government may start this process in the same
manner as done in other enactments which includes other legislative processes before the
actual enactment.

4.2.1 To the Government of the United Republic of Tanzania

The Government may start this process in the same manner as done in other enactments
which includes other legislative processes before the actual enactment.
This may be done effectively by firstly formulating the Data Protection Policy, where all
the purposes and the framework of the Data Protection may be discussed and ultimately
helping the future enactment to become comprehensive. Then part of the procedure may

63
Of 2014

31
be taken care by the Office of the Chief Parliamentary Draftsman (CPD) and the respective
Ministry which would be deemed to be the Custodian of the particular Legislation.
Then other legislative processes can be observed for example the collection of the opinion
from other stakeholders so as to get their views on what they think should be the of
paramount in the proposed legislation for the protection of individual privacy which would
suit for the Tanzanian situation. Further, the Government of the United Republic of
Tanzania may contemplate on establishing the Supervisory Agency regarding Data
Protection which would then act as an Implementer of the newly enacted Data Protection
Act.

32
 REFERENCES

BOOKS
Glenn, R.A. The Right to Privacy: Rights and Liberties under the law, 2003
Herman, M & Daniel, K. Biometric Authentication in Financial Institutions: The intention
of Banks to Adopt Biometric Powered ATM, 2016
Rainie, L. Privacy in Digital Age, Public Attitudes about Personal Information and
Veillances, 2012.
Vakul Sharma, Information, technology-law and practice,3rd edition, New Delhi
University law publishing co. pv Ltd, 2011.

JOURNALS & ARTICLES

Bazazi, B , Efficacy and Challenges of Implementation of Biometric SIM card Registration
by Mobile Network Operators Using the National Identification Card in Tanzania: A Case
of Dar es Salam Region, 2020.
Biometrics Verification: A Literature Survey. Journal of Computing and ICT Research,
Vol. 5, Issue 2
Jain et al. Biometrics: A Tool for Information Security. IEEE Transactions on Information
Forensics and Security, Vol. 1, 2006
Makulilo, B.A. “Registration of SIM cards in Tanzania: a critical evaluation of the
Electronic and Postal Communications Act 2010”, Computer and Telecommunications
Law Review, 2011.
Syed et al. Privacy, Security, and Surveillance in the Global South: A Study of Biometric
Mobile SIM Registration in Bangladesh. Department of Information Science, Cornell
University, Ithaca, NY, USA, 2017

REPORT
Tanzania Human Rights Defender (THRDC) ‘‘The Report on the Right to Privacy in
Tanzania” 2015

33
WEBSITES
Comms update Tanzania sets to roll-out Biometric registration retrieved from htpps:
//www.Commsupadate.com/articles/2020/12/15/Tanzania-set-out-to-roll-out-biometric.
Accessed on 16th December, 2020 at 15:27 pm, 2019
http://bunge.parliament.go.tz/PAMS/docs/3-2002.pdf
http://www.ijcir.org/volume5-number2 /article7.pdf accessed on 20th August 2020 at
18:13 pm

34