SIM card registration: How other countries do it

MANILA, Philippines – President Rodrigo Duterte vetoed the Subscriber Identity Module (SIM) Card Registration Bill, or the consolidated Senate Bill No. 2395 and House Bill No. 5793 on April 15.

The bill would have required anyone who buys a SIM card to register their name with telecommunication companies prior to card activation, while 180 days are given to those who already own a SIM card to register their name with their respective telecom providers. Failure to register would entail an automatic deactivation of the SIM card.

The Senate version included a provision on social media registration, with the aim of curbing crime, like fraud, and the proliferation of fake news. It included a provision intended to help uncover trolls on social media.

Communication and technology experts, as well as social media users, have raised concerns over the bill, saying it threatened data privacy and free speech. 

In the Philippines the bill was proposed to ensure a safer space online and combat crimes facilitated by automated and mobile devices. However, the experience of other countries with mandatory SIM card registration shows that there have been more drawbacks than advantages brought about by the policy.

According to Privacy International, 36 countries did not have mandatory SIM card registration laws as of 2021. 

Meanwhile, 157 countries enforced mandatory SIM card registration, as of 2021. These include democratic countries Norway, Uruguay, Japan, Switzerland, Australia, Germany, Italy, France, South Korea, and Brazil, among others, as well as communist countries China, Cuba, Laos, North Korea, and Vietnam. 

How do countries carry this out?

Hong Kong: Real name registration exempts foreign SIM cards 

Hong Kong is the latest to enact a compulsory registration of SIM cards. The new policy, passed on September 1, 2021, has the following provisions:

• Aim to tackle illicit activities, such as drug trafficking, terrorism, and phone fraud; protect China’s national security.
• Require the full name, date of birth, and a copy of the identity document of the subscriber.
• Place a limit of 10 prepaid SIM cards per user and 25 SIM cards for corporate users with each relevant telecom firm.
• Exempt foreign roaming SIM cards from regulation. 

Experts assert that using their real names adds to the “atmosphere of fear and self-censorship” in civil society and among dissenters in Hong Kong. 

However, Hong Kong citizens, according to Lennon Yao-chung Chang, a lecturer at Monash University in Australia, have been more vulnerable to email scams rather than mobile-related crimes in the past year. Some $31.3 million were lost to company email scams and $4.8 million to con artists on the phone, according to police data.

By February 24, 2023, all the unregistered prepaid SIM cards will be deactivated in the country.

Saudi Arabia: Access to communication industry services

In 2015, the government updated its measure to collect fingerprint data. This was after the failed attempt at cellphone regulation in 2012 due to the continuous black market resale of SIM cards registered to unknown buyers. 

The government and the Communication and Information Technology Commission (CITC):

• Aim to curb criminal activities that threaten national security, prevent terrorism, and crackdown on unauthorized SIM cards.
• Require national ID number, fingerprint data, and passport for foreigners.
• Include sharing of biometric data with the National Information Center for identity confirmation of the SIM card buyer.
• Include free of charge mechanism via text message to ensure that registered numbers are under subscriber’s real name.
• Limit 10 prepaid SIM cards for citizens and two in-voice or data cards for expatriates.
• Include access to services offered by the telecommunications industry.

Illegal migrant workers were adversely affected by the provisions. In 2012, over 4% of 10 million migrant workers – including Indians, Pakistanis, Egyptians, and Filipinos – were illicitly documented.

Human rights concerns were also raised. For example, Amnesty International and Human Rights Watch reported the Saudi government’s abuse of the terrorism legislation against dissenters and reformists.

Tanzania: Recalibration to fingerprint technology

After the unsuccessful implementation of the Electronic and Postal Communications Act in 2010, the United Republic of Tanzania Ministry of Works, Transport Communication released the SIM Card Registration Regulations 2020.

The advanced regulations:

• Aim to protect national security and preserve public safety and economic well-being.
• Provide proof for investigation of criminal activities, security measures, and litigation against criminals.
• Require biometrics with their corresponding licensee, seller, or authorized distributor.
• Limit to one SIM card per person, four SIM cards per automated machine, and 30 SIM cards for companies or institutions

With the updated ordinance in place, reported controversial charges linked to registered SIM cards have drawn attention. On December 28, 2020, a founder of Faithless Hijabi and a well-known women’s rights activist was arrested for a critical social media post about the president of Tanzania. 

A similar charge was filed on July 8, 2020, against a Tanzanian comedian after he laughed over an old photo of President John Magufuli dressed in an oversized suit in a video he posted on social media.

Taiwan: Crime investigation, quarantine tracking

Unlike other countries, Taiwan has a data privacy framework. The mandatory registration of SIM cards:

• Aim to help respective agencies in crime investigation and prevent falsified applications for telecom services.
• Require name and identification number, passport for visitors, or secondary cards namely student ID, driver’s license, or residency card.
• Require foreigners to purchase a SIM card at the airport for quarantine tracking purposes.
• Limit to one SIM card purchase per operator for visitors of at least 20 years old. 

Data Privacy Framework is exercised through regular discussion on the management of complaints and carrying out double-certificate monitoring between the National Communications and Communication Commission and telecom companies.

Telecom company that violate the law will pay a fine of NT$300,000 (₱527,000 or $10,000) to NT$3,000,000 (P5,367,000 or $102,000) and, for grave circumstances, can have their license cancelled.

As of February 2022, mobile cellular connections in Taiwan had reached 120% (28.65 million) of its population of 23.87 million. 

Malaysia: National security, value-added services

SIM card registration in Malaysia started in 2006. The law provides:

• Oblige age 12 and above, regardless of nationality, to register the prepaid SIM card after purchasing.
• Aim to restrain misusage of public mobile communications services and secure national security against terrorism and criminal activities.
• Require the full name, valid ID or MyKad, permanent address, and mailing address; passport for foreigners, including the number, and issuing country; company or university address for students.
• Limit five prepaid SIM cards for end-users.
• Grant value-added services – such as birthday treats, personal greetings, and mobile money – from service providers.
• Ensure the integrity of the database of prepaid subscribers, and correct service providers’ information on the database with the Industry Task Force for Data Verification.

Malaysia pays serious attention to those who fail to meet the provisions. The Malaysian Communications and Multimedia Commission imposed a fine of RM700,000 (₱8,500,000 or $161,000) on six telecom companies which, without further verification, registered prepaid SIM cards in 2019.

Similar cases also arose in 2020. Five telecom companies were penalized for improper verification of prepaid subscribers’ identities that emerged during an inspection in 2019. 

Mexico: 18th country with a biometric requirement

Mexico authorized the use of biometrics registration for mobile phone subscribers, making them the 18th country to have such a requirement in 2021. 

These are the latest provisions:

• Aim to prevent mobile-aided crimes.
• Require the name, national ID, telephone number, SIM card activation date, social security number, and biometric data.

The cellphone registration, otherwise known as Registro Nacional de Usuarios de Telefonía Móvil or RENAUT, was the first nationwide implementation. However, it was later abolished in 2012 because of its ineffectiveness. It previously sought to curb kidnapping from 2009 to 2012. However, the kidnapping rate in the country rose to its highest since 1971, even after the enforcement in 2010.

As of 2021, civil society organizations had petitioned and put forward amicus curiae to Mexico’s Supreme Court of Justice, admonishing the threat and violations to free speech, privacy, and ICT accessibility of the SIM registration law.

Indonesia: Data protection concerns

In March 2018, five months after the implementation in 2017, Kominfo, Indonesia’s Ministry of Communications, blocked approximately 101 million prepaid SIM cards due to the failure of users to re-register their prepaid numbers with a valid identity card.

The regulations: 

• Require Kartu Tanda Penduduk (KTP) or national ID card and Kartu Keluarga or family card for citizens; name, passport number, and boarding pass for tourists. 
• Enforce International Mobile Equipment Identity (IMEI) registration that contains a 15-digit number specific to their phone.

For the data privacy framework, Kominfo issued a regulation on Personal Data Protection in Electronic Systems, but the bill was halted due to conflict between the government and the House of Representatives.

The government was not surprised, given the fact that for the past decades Indonesians without valid IDs or family cards have used fake names. In most cases, it has been known that the buyers purchase new SIM cards under counterfeit identities to avail themselves of bargains and promotional bundles.

Currently, particular regulations under the telecommunications and public information sectors advance concerns for data protection in Indonesia. 

What happens to the bill vetoed by Duterte?

While President Duterte has vetoed a similar bill in the Philippines, the House of Representatives and the Senate can separately refile the SIM card registration bill and reconsider the vetoed items, which in this case was the incorporation of social media registration. 

In his One News PH Agenda interview, Senator Sherwin Gatchalian, one of the authors of the original bill, said he intends to refile the bill in the next Congress. – Rappler.com

Joana de Guzman is a Rappler intern from the Far Eastern University.