On February 4, 2016, Human Rights Watch sent this letter to the Prime Minister of Guinea in response to the Guinean government's recent request for access to parts of telecommunications companies’ phone records. The letter urges the Prime Minister to ensure respect for privacy and other rights.
His Excellency Mr. Mamady Youla
Prime Minister of the Republic of Guinea-Conakry
Re: Protecting the privacy of personal data in the telecommunications sector
Dear Mr. Prime Minister,
Human Rights Watch is an international nongovernmental organization that monitors and reports on human rights abuses in some 90 countries around the world. We have documented abuses and advocated for redress in Guinea for over 15 years, and we have similarly defended the freedom of expression and privacy online for a decade.
We are writing to request that your government ensure Guinea’s telecommunications regulator (Autorité de Régulation des Postes et Télécommunication, ARPT) adequately protects privacy and other rights with respect to access to data held by telecommunications companies, and to urge clarification on whether the ARPT has recently obtained access to the personal data of mobile phone users.
Media reports indicated that on January 6, 2016, the then-Director General of the ARPT sent a letter to the phone operators saying that the ARPT planned to “put in place a center for control and oversight of traffic (voice and data)” to verify revenues of service providers for tax assessment purposes. Such a system, if connected directly to the telecommunications company’s networks and billing systems, could allow the regulator to monitor all data and voice traffic and, if misused, give the operator, the regulator, and potentially other government departments, backdoor access to customers’ call records.
We also understand that in the January 6 letter, the ARPT requested access to parts of the companies’ phone records – known as “CDRs” – for the month of December 2015, as well as the necessary technical information to decode the CDRs.
Although CDRs do not reveal the contents of a phone call, they can include the phone numbers of both parties on the call, the time and date, the call duration, and even the approximate location of the people making the call. Such data can reveal sensitive information about a person’s contacts and movements, especially when aggregated. Indeed, this information often can be more revealing of private life than the actual content of conversations.
We understand that the ARPT seeks to establish a system for verifying the financial and revenue figures provided by the phone companies to the Guinean government. However, while governments should have the ability to enforce telecommunications and tax regulations, requests for documentation should not disproportionately burden the right to privacy and other related rights.
Indeed, article 116 of Guinea’s 2015 Law on Telecommunications requires mobile and internet service providers to protect the integrity and confidentiality of the data they hold.
Regulation for legitimate fiscal and tax purposes should not require collection of vast amounts of sensitive personal data, infringing on the privacy of all mobile phone users. If data is being sought for other reasons, such as national security or law enforcement, then any government request should require judicial supervision and specific justification, and should be targeted only at individuals suspected at wrongdoing.
We understand that three telecom operators – Cellcom, Orange, and MTN – originally stated in a January 19 letter that they would not comply with the request to hand over their records, and that they would not support the establishment of a central control system without greater clarity as to the system’s objectives and legal basis.
In follow-up letters to telecom operators reviewed by Human Rights Watch, ARPT officials threatened a daily fine of 5 million Guinean Francs (US $650) if companies delayed in complying with the request, along with unspecified criminal and civil sanctions. At the time of writing, we understand that two of the companies had agreed to comply with the government’s request.
In light of the above, we urge your government to ensure the necessity and proportionality of any method used to verify tax revenue and prevent fraud that involves intrusion on privacy. In regards to accessing data held by telecommunications companies, to respect privacy and other rights, we request that your government and the ARPT:
- Enact protections to ensure that personal data will only be collected when necessary for use towards legitimate aims that are clearly defined in law, and that collection must be the least intrusive in terms of means and scope to achieve those legitimate aims;
- Clarify whether, in requesting phone records for December 15 from phone operators, the ARPT or any other government agency obtained or will obtain sensitive customer information, such as who a customer has called; the date, time, and duration of calls; and approximate locations of the phone;
- Delete any sensitive customer information acquired pursuant to the January 6 request;
- Ensure that, in future, any system or controls put in place to monitor company’s revenue does not provide the ARPT, or any other government agency, with access to customer’s sensitive personal information;
- Enforce restrictions on access to any data collected to only specified officials in the ARPT;
- Enact protections to prohibit sharing of data collected for the purposes of enforcing telecom regulations with other government agencies or third parties; and
- Promptly delete data when it is no longer needed for regulatory purposes.
We would welcome the opportunity to discuss these issues with you.
Sincerely,
Cynthia Wong
Senior Internet Researcher, Business and Human Rights
Human Rights Watch
Corinne Dufka
West Africa Director
Human Rights Watch
CC:
Oumar Said KOULIBALY, Acting Director General, Authority for Regulation of Mail and Telecommunications, Republic of Guinea-Conakry
Me. Cheick SAKHO, Minister of Justice, Republic of Guinea-Conakry
Moustapha Mamy DIABY, Minister for Mail, Telecommunications and the Digital Economy, Republic of Guinea-Conakry
