Abby May is an intern at Open Secrets.

In late 2020 South African credit bureau agency Experian suffered a large data breach in which the credit and income information of more than 24 million South Africans and 800,000 businesses was leaked on to a Swiss website. This occurred after Experian handed the data over to a fraudster with a fake identity. Three years before this, South Africa was affected by an extensive data breach, where 60 million South Africans’ personal details, from death certificates to home addresses, were leaked on to the web due to the Master Deeds Office not securing the data properly.

The mismanagement of data is an issue South Africans tend not to think about. But as data breaches and theft continue to increase in South Africa’s vulnerable data security network, the consequences will prove significant. What is our government doing about it? Are we as citizens protected?

South Africa’s 4IR

The answers are unclear. While the state continues pushing for the Fourth Industrial Revolution (4IR), there is uncertainty how our entry into the digital age will be regulated. Local and international experience demands scrutiny of the private companies that will profit from the digitisation of our economy and society. President Cyril Ramaphosa has said that the 4IR will be fundamental to South Africa’s economic recovery.

The country’s approach will be guided by the Presidential Commission on the 4th Industrial Revolution, which will report directly to Ramaphosa. On 23 October 2020, the commission’s first report was published in the Government Gazette. Though there was no fanfare surrounding the publication, it offers us important insight into this administration’s plans.

In the report, the presidential commission defines 4IR as “an era where people are using smart, connected and converging Cyber, Physical and Biological systems and smart business models to redefine and reshape the social, economic, and political spheres” (emphasis in original text).

Thus, South Africa’s interpretation of the 4IR is a human-centric one, and the commission focuses on the use of innovative converging technologies to enhance economic competitiveness and the social well-being of people.

A recent example of the country’s seriousness in leveraging the 4IR for economic growth involves the partnership of the Council for Scientific and Industrial Research (CSIR), an entity of the Ministry of Education, and Siemens, a multinational conglomerate focused on technology and digitisation.

The CSIR says that the partnership includes working together to train workforces in critical digital skills and harnessing “the potential of 4IR technologies such as artificial intelligence, blockchain and big data for societal advancement”. This is one of a growing number of public-private partnerships being created to seek ways to boost the economy. Debates vary on how profits are made with converging technologies. But what is clear is that big data is usually at the centre of any such activity.

Big data = big profits

Gaining economic value in the 4IR relies on the ownership and management of data. Data are units of information. In market terms, this information is often about consumers – including where we go, what we purchase, and what we interact with online – and the value this may hold for a company or customers, such as advertisers, seeking that information. Thus, data is the first crucial component in turning information into revenue.

Another core component is digital infrastructure, which refers to an infrastructure that collects, stores, and provides access to digital data across a range of systems and devices. The presidential commission’s recommendations include the need to shift towards digital infrastructure as a new form of economic infrastructure and to digitise government service delivery.

The report also calls for leveraging private investment and expertise towards building digital infrastructure. In other words, if the government is unable to digitise itself, then the solution is outsourcing the function to private companies. Overall, the report’s stance on the 4IR is very much: “The opportunity is in our hands”.

However, while such 4IR narratives focused on digitisation can be positive, the reality is more complex. We need to ask how regulation and legislation on data storage, collection and management will keep pace with the corporations that stand to profit from their role in a new “digital infrastructure”.

The risks

Many private tech companies have their own rules and regulations regarding data management and storage, which may not align with South African legislation in the long run. The recent outrage at WhatsApp’s “Big Brother” changes in privacy policies is just one case. Government departments such as Home Affairs and Sassa hold vast amounts of citizen data and with their move to digitisation – a recommendation of the 4IR commission – private companies creating the digital infrastructure will have access to millions of South Africans’ data. Many will undoubtedly seek to monetise that access.

With our data regulation landscape in its infancy, this could pose a potential threat down the line if not handled properly. Risks include security, privacy, and accessibility of digital services for vulnerable people. The commencement date for the Protection of Personal Information (Popi) Act was 1 July 2020 with a grace period of one year, meaning most sections within the Popi Act will only come into effect on 1 July 2021.

Recently the Information Regulator, which is tasked with enforcing Popi and overseeing the regulatory framework, did signal its intent to tackle companies that are not compliant, most notably looking into Facebook/WhatsApp privacy policy changes. Yet, doubts remain over whether the Information Regulator will be an energetic and effective regulator.

As a result of Popi only coming into effect from 1 July, firms implicated in both the Experian and Master Deeds breaches will remain unpunished. This shows not just the potential inefficiencies in our regulatory system to effectively pursue data breaches that enable fraudsters to steal this information, but also the lack of accountability for the companies that built the data security infrastructure in the first place.

Furthermore, vulnerable groups need to be protected. The increasing digital divide between those who have access to the internet and those who do not makes this vital. Key questions such as how one capitalises off data, where and how the data get stored and what companies are at the forefront of creating digital infrastructure within South Africa must be asked.

The 4IR and capitalising from data is still an emerging field in South Africa, but regulating these activities has only recently gained global attention. The implication is that while relying on the private sector for investment towards a digital future may appear a viable option, it cannot be successful if the necessary regulations and legislation to protect consumers and individuals’ rights are not in place. DM