MTN scores a dismal 16% for data security in global accountability index

Ranking Digital Rights, an international group working to protect digital rights and internet freedom, released its Corporate Accountability Index on 15 May 2019. The Index evaluates 24 of the most powerful internet, mobile, and telecommunications companies around the world on their disclosed policies affecting the privacy and freedom of expression of users. MTN, the only company from Africa on the list, scored dismally.

Africa’s largest telecommunications company was found wanting in multiple categories, including internal governance, freedom of expression and privacy. Overall, it ranked 8th out of the 12 telecommunications companies rated, with a score of 16%. Despite a marginal increase, the MTN Group still trailed behind other international companies such as Vodafone and AT&T.

Daily Maverick asked MTN South Africa, the company’s largest branch on the continent, for comment on its Ranking Digital Rights placement. The telecommunications company said it was still studying the report to understand the “mechanisms” behind it, but would not comment further on its placement.

In regard to user privacy, MTN found itself near the bottom, with a final score of 12%. Although the company did make it easier for users to access its privacy policy, the report found that:

“MTN South Africa provided minimal information about the types of user information it collects and why, and no information about what information it shares, or for how long it retains user information.”

Jacqui O’Sullivan, executive of corporate affairs at MTN South Africa, told Daily Maverick:

“MTN South Africa processes user data for the purpose (of) delivering a service to customers. This is done in accordance with Icasa regulations, which require strict confidentiality as well as a privacy policy available on our website. MTN South Africa is prohibited by law to disclose user information to anyone. MTN would only disclose information to the government in terms of a legitimate legal process (subpoena).”

According to the group’s privacy policy, anyone signing up for a contract with MTN allows the company to share their personal information with third parties MTN has a business relationship with “in order to provide the service you have requested”, as well as MTN partners, agents and sub-contractors. And the government, if it asks.

Daily Maverick called five MTN shops — traditional telecommunication stores that everyday people would shop at — to ask their employees what information about customers they store, how long it is stored for and what it is used for.

The overwhelming response was that MTN user data is secure. Although user information is kept after a customer’s contract ends, it is kept “behind lock and key”, as one store employee said. Another employee told Daily Maverick the company encourages first-time customers not to click “permission to market” when signing a contract, as this allows information to be shared.

Lazola Kati, national communication rights focus organiser for Right2Know, says that the organisation is advocating for service providers to stop selling their customers’ data without their knowledge or consent.

“During the recent election campaigns, how many people got unsolicited phone calls from political parties? How did they get that information? There is no other place they could have got your number.”

Kati also told Daily Maverick that “customers believe they are creating contracts with MTN only, not MTN and affiliated companies”.

“They are still passing on your information to a party unknown to you, and that’s violating your rights,” said Kati.

Other MTN employees referred to the Protection of Personal Information Act of 2013. According to the Act, a person has the right to request that a company confirms what information it has on them, and whether that information has been shared with a third party. While there are some exceptions, overall the Act should protect South Africans from nefarious online forces, such as Cambridge Analytica and Bell Pottinger.

Citizens’ data should be protected, at least by South African companies (the Act cannot prevent Facebook from mining South African profile data, for example).

“We do have reason to believe that our service providers don’t necessarily protect our digital rights,” Kati told Daily Maverick.

Right2Know advocates that service providers such as MTN protect how customers use their airtime and data.

The MTN Group, with its headquarters in South Africa, operates in 22 markets in both Africa and the Middle East, serving about 220 million people. Although the company’s employees believe the telecommunications giant is doing everything it can to protect user information, Ranking Digital Rights suggests MTN should “be more transparent about the handling of user information and external requests affecting user rights”. DM