Gazette 7481

GOVERNMENT GAZETTE OF THE REPUBLIC OF NAMIBIA

N$6.00

WINDHOEK - 15 March 2021

No. 7481

Page

GOVERNMENT NOTICE

No. 40

Regulations in terms of Part 6 of Chapter V of the Communications Act

MINISTRY OF INFORMATION AND COMMUNICATIONS TECHNOLOGY

No. 40

REGULATIONS IN TERMS OF PART 6 OF CHAPTER V OF THE COMMUNICATIONS ACT

Under section 77 of the Communications Act, 2009 (Act No. 8 of 2009), I have made the regulations set out in the Schedule after consultation with the Communications Regulatory Authority of Namibia, the Director-General of the Namibia Central Intelligence Service and all providers of telecommunications services who may be affected by the regulations.

P. MUSHELENGA
MINISTER
OF INFORMATION AND COMMUNICATIONS TECHNOLOGY

Windhoek, 1 March 2021

SCHEDULE

Definitions

Unless the context indicates otherwise, in these regulations any word to which a meaning has been assigned in the Act, bears that meaning and -

‘authorised staff member’ means -

(a) a staff member of a service provider who has been designated in terms of regulation 4 as a staff member that has been authorised to provide information stored in terms of section 71 of the Act; or
(b) a staff member of a service provider holding a position designated in terms of regulation 4 as a position the holder of which is authorised to provide information stored in terms of section 71 of the Act;

‘customer’, in relation to a service provider, means a person with whom a service provider has concluded a contract to provide a telecommunications service and if the service provider does not belong to a class of persons excluded by regulation 2(2) or regulation 2(3) and ‘customer’ includes a prospective customer;

‘customer information’ means the information that must be obtained from a customer in terms of regulation 7 and includes the copies of documents referred to in this regulation;

‘information relating to telecommunications’ means information required to be stored as provided by regulation 3;

‘interception target’ means a specific person whose telecommunications may be intercepted in terms of a law applicable in Namibia;

‘service provider’ means a provider of a telecommunications service to whom these regulations apply as specified in regulation 2;

‘the Act’ means the Communications Act, 2009 (Act No. 8 of 2009).

Application of regulations

(1) Subject to subregulation (2) and (3), these regulations apply in respect of all persons that render a telecommunications service or operates a telecommunications network as contemplated in section 37 of the Act.

(2) These regulations do not apply to any person who as an incidental part of a business other than the provision of telecommunications services -
(a) provides access to the internet or other telecommunications services to its customers or to people present on the premises of that person;
(b) allows its customers or guests of its customers to use telecommunications services obtained by that person from a different service provider.
(3) These regulations do not apply to a person who operates an electronic network for his or her own purposes and allows employees or other persons to access the internet or other telecommunications services through that network.

Information relating to telecommunications

(1) Service providers must in respect of all telecommunications of all customers store the following information for a period of at least five years from the date on which that telecommunications have occurred (insofar as the information is applicable to the form of telecommunications services in question) -

(a) the telephone number or other identification of the customer concerned;
(b) the internet protocol address allocated to a customer (irrespective of whether that address is allocated only for the duration of a telecommunications session or whether it is allocated permanently to a specific customer) in addition to any information that might be necessary to link a specific packet to a specific customer;
(c) the called number if the call is generated by the user of the service of the service provider and the calling number if the call is initiated by another party than the user of the service of the service provider;
(d) the source and destination of any other telecommunications in a form that is appropriate for the protocol or application in question: Provided that when a packet based protocol is used, it is not necessary to store the data relating to every packet, as long as a summary containing the total amount of data transferred and the source and destination of the transfer, is stored;
(e) the date, time and duration of the telecommunications;
(f) particulars similar to the information referred to in this subregulation relating to supplementary services or facilities used in association with the telecommunications such as multi-party conferencing, call diversion, abbreviated dialing and voice mail;
(g) intermediate numbers where the customer establishes conference calling or calls to link through services;
(h) identification of base station and cell site, in respect of all cellular phones or similar devices in such detail and at such resolution as is normally required to render an efficient service; and
(i) the nature of the telecommunications whether it is voice, fax, a message service or any other form of data.
(2) The service provider must store the information referred to in this regulation in such a manner that it is possible to retrieve that information in order to comply with the provisions of these regulations and any law authorising the interception of telecommunications or requiring the provision of information relating to telecommunications to another institution.
(3) When information stored in terms of this regulation is requested from a service provider, it must be identified with such specificity as may be provided for in conditions made by the authority in terms of section 72(4) of the Act.

Designation of authorised staff members

(1) Every service provider must designate staff members or positions the holder of which is authorised to provide information stored in terms of regulation 3.

(2) A service provider must in the manner determined by the Authority -
(a) inform the Authority which staff members and positions have been designated in terms of subregulation (1); and
(b) provide the particulars of such staff members and positions that the Authority may require.

Request for stored information

(1) Subject to subregulation (7), a member of the Namibian Police Force or a staff member of the Namibia Central Intelligence Service who requires any information stored in terms of regulation 3, must submit a request to a judge or magistrate to authorise the obtaining of that information from a service provider.

(2) A request referred to in subregulation (1), must, in the case of a member of the Namibian Police Force -
(a) state the offence that is being investigated;
(b) specify the person whose information is required;
(c) contain a description of the required information with the specificity contemplated in regulation 3(3).
(3) A request referred to in subregulation (1), must, in the case of a staff member of the Namibia Central Intelligence Service -
(a) state the reason why the information is required;
(b) specify the person whose information is required;
(c) describe the required information with the specificity contemplated in regulation 3(3).
(4) A request referred to in subregulation (1) must also be accompanied by a statement under oath by the member in question that -
(a) gives the reasons why the required information is necessary or relevant for the investigation concerned;
(b) gives the reasons why it is not expedient to obtain the information in any other manner.
(5) If the judge or magistrate is satisfied -
(a) that the requested information is necessary or relevant for the investigation concerned;
(b) that there is no other expedient manner of obtaining the information concerned; and
(c) the obtaining of the information is authorised by the law of Namibia,

he or she must sign the request indicating the approval thereof.

(6) If a police officer or a staff member presents a request approved in terms of subregulation (5) to an authorised staff member that service provider must provide the information requested to that officer against payment of the fees prescribed in regulation 6.
(7) An authorised officer must also provide stored information if he or she is requested to provide stored information by a member of the Namibian Police Force if the authorised officer on reasonable grounds belief that information is required urgently and the delay in obtaining a request referred to in subregulation (1) would defeat the purpose for which the request is made and that a request would have been granted if it had been made.
(8) If a request is made as contemplated in subregulation (7), the member who made that request must when the request is made or as soon as possible after the request has been made, provide the authorised officer with an affidavit in which he or she states all the information provided to the authorised officer as well as the information that must be provided in the affidavit referred to in subregulation (4).
(9) The provisions of these regulations are not construed in such a manner that it precludes the following of a procedure authorised by any other law: Provided that when such other procedure is followed, the service provider must still be compensated for the provision of the information in question in terms of regulation 6.

Forms of assistance and compensation

(1) Subject to section 75 of the Act,telecommunications service providers must provide the forms of assistance specified in subregulation (2) and service providers must be compensated by the institution requesting the assistance as specified in that subregulation.

(2) The compensation that must be paid to service providers is -
(a) N$400 per interception target for the establishment or setup of a connection or process whereby duplicate signals or data packets are routed or sent to an interception centre or other institution;
(b) N$30 per interception target for every month or part thereof for which a connection or process referred to in paragraph (a) is active;
(c) N$30 for every request for information relating to telecommunications as provided by regulation 5 or any other law;
(d) in addition to the compensation referred to in paragraph (c), N$4 per page if the information is provided in printed form;
(e) in addition to the compensation referred to in paragraph (c), N$12 for copying the information to an electronic medium provided by the institution requesting the information or if the information is transferred electronically to the requesting institution;
(f) N$12 for every compact disk or other medium if the medium is provided by the service provider.
(3) If the service provider is required to provide assistance outside of normal working hours the service provider must be compensated an additional N$250 per interception target or request.
(4) For the purpose of subregulation (3) ‘normal working hours’ means 08h00 to 17h00 on all days except Saturdays, Sundays and public holidays.

Customer information

(1) From a date three months after the commencement of these regulations, a service provider must obtain the information and documentation referred to in this regulation in the manner prescribed in regulation 8 or 9, from each customer, including foreign nationals, prior to providing a service to that customer.

(2) Information is deemed to have been obtained as contemplated in subregulation (1), if the information has been obtained by an agent of the service provider who has been appointed by means of a contract with the service provider and that information has been communicated to the service provider.
(3) In spite of the provisions of subregulation (2), the service provider in question remains liable for compliance with these regulations.
(4) The duty referred to in subregulation (1) as well as the duty referred to in regulation 10(1), may be enforced in the manner provided for in section 116 of the Act.
(5) The following information must be obtained if the customer is a natural person -
(a) the full name of the customer;
(b) the address at which the customer ordinarily resides or if the customer ordinarily resides outside Namibia, the address at which the customer resides while he or she is in Namibia and the address at which the customer works or from which he or she conducts his or her business;
(c) a Namibian identity number or, if the customer in question does not have a Namibian identity number, the number of the document referred to in paragraph (d);
(d) a copy of -
(i) any identity document containing a recent photograph of him or her issued under any law governing the identification of persons in Namibia or any such official document of identity issued by the government of any other country;
(ii) if the customer ordinarily resides outside Namibia or does not have a document referred to in subparagraph (i), a passport issued to the customer;
(iii) if the customer in question does not have a document referred to in subparagraph(i) or (ii), a driving licence or permit containing a recent photograph of him or her, whether issued in or outside Namibia.
(6) The following information must be obtained if the customer is a juristic person -
(a) the information referred to in subregulation (5) of the natural person representing the juristic person in the conclusion of the contract with the service provider as well as that information of the natural person who will be using the service on behalf of the juristic person or if the service is not being used by a specific natural person, a statement of that fact and an explanation of the purpose of the service;
(b) the full name of the juristic person;
(c) the registration number of the juristic person, if any;
(d) the business address of the juristic person;
(e) a copy of a letter on the letterhead of the juristic person specifying that the person representing the juristic person has the authority to represent the juristic person in the conclusion of a contract with a service provider to provide telecommunications services.
(7) A service provider must store the information referred to in this regulation in such a manner that it is possible to identify the communications of a specific customer with reference to the customer’s full name and surname.
(8) A service provider must, for a period of at least five years following the cancellation of the relevant contract, store -
(a) the information and documentation obtained in terms of this regulation; and
(b) the telephone number and other identification issued to the customer concerned.
(9) This regulation does not apply in respect of a customer of a telecommunications service provider who is a customer of a service provider outside of Namibia and to whom telecommunications services are rendered by a Namibian service provider in terms of an agreement between the foreign service provider and a Namibian service provider.

Manner of obtaining and recording information obtained from customer

(1) Subject to subregulation (2), the information referred to in regulation 7 must be recorded in a form which -

(a) states the provisions of subregulation (3);
(b) contains a statement that the person completing the form or the juristic person on behalf of which the form is completed intends to be a customer for the service concerned;
(c) states the service to be provided to the customer concerned;
(d) contains a certificate in which the person completing the form certifies that all the information is true and correct; and
(e) is signed by the person completing the form.
(2) If a customer is unable to fill in the form referred to in subregulation(1), due to illness, disability or because the customer is unable to visit the office of a service provider or an agent of a service provider referred to in regulation 7(2) -
(a) the form may be filled in by another person;
(b) the reason why the customer did not fill in the form, must be stated on the form; and
(c) the person who fills in the form must state that he or she is authorised to obtain the service from the service provider and is authorised to provide the information required by these regulations.
(3) A person who -
(a) provides false information while completing a form or requests or instructs a person to provide such false information while completing a form as contemplated in subregulation (2);
(b) provides a copy of a document in terms of regulation 7 that is not a true copy of such document;
(c) requests or instructs another person to provide that person’s information as contemplated in regulation 7 for the purpose of avoiding the provision of his or her own information,

is guilty of an offence and is on conviction liable to a fine not exceeding N$10 000 or on failure to pay such fine to imprisonment for a period not exceeding two years.

Digital process instead of form

(1) A service provider may with the permission of the Authority use a digital process instead of a form and all references to a form in regulation 8 is construed as a reference to the equivalent step in the digital process.

(2) A digital process referred to in subregulation (1), must be designed in such a manner that -
(a) it allows and requires the recording of all the information which must be obtained from the customer in terms of these regulations;
(b) it causes all the information to be displayed to the user which must be contained in the form;
(c) it allows and requires the creation of a digital copy of all the documents that must be obtained as provided by regulation 7; and
(d) it enables the customer or other person to sign the customer information.
(3) A digital copy referred to in subregulation (2)(c) must be of sufficient quality that the text of the document must be legible and that photos and other markings on the document must be identifiable.
(4) The signature referred to in subregulation (2)(d) must be recorded in a digital manner which must be of sufficient quality that it should be reasonably possible to recognise it as the signature of the person who signed the customer information.
(5) A digital process must also have such safety and usability requirements as are agreed between the Authority and the service provider.

Existing customers
10. (1) If the telecommunications service provider is already providing a service to a customer on the date of commencement of these regulations, the telecommunications service provider must obtain the information set out in regulation 7 from each customer within 12 months from the date of commencement of these regulations: Provided that the Minister may extend the period in respect of a specific service provider or in respect of all service providers

(2) If the information referred to in subregulation (1) has not been obtained by a service provider within the period referred to in subregulation (1), the service provider must subject to subregulation (4) cancel the service to the customer concerned.
(3) A service provider must as soon as possible after the commencement of these regulations provide a warning to the customer by means of sms, a voice mail message or in any other manner appropriate for the service in question indicating that the information referred to in regulation (7) must be provided to a service provider and that if the information is not provided within the period provided for by these regulations, the service will be cancelled and that warning must be repeated at least every three months.
(4) If the customer information has not been provided within the period referred to in subregulation (1), the service must be suspended for a period of three months and if the customer attempts to use the service, a warning must be provided to the customer in so far as such warning is technically feasible.
(5) The Authority may extend the period referred to in subregulation (4) in respect of a specific service provider or in respect of all service providers.
(6) If the customer provides the information during the period of suspension, the service must be reinstated as soon as possible thereafter.
(7) If the period of suspension has expired, the service provider must cancel the service.