A university student was sentenced last week to 25 years in prison, after a SIM card registered in his name was used in a drug-trafficking operation. He and his family have insisted that he never used the SIM card and had not even bought the card in the first place.

His case prompted many to check their own digital profiles and discover that dozens of phone numbers had been registered to their names without their knowledge.

In a wave of anger and concern about digital security, personal data security has become the topic of the hour as the scale of fraudulent phone line registration becomes clear.

The issue has been described as stemming from inadequate checks by mobile operators, who are supposed to demand passport or ID verification in person before allowing customers to establish a mobile phone number.

But permitting phone lines to be issued to customers showing digital copies of passports  leaves the door wide open to fraud, with commentators pointing to dozens of photographed IDs floating around digital platforms and messaging apps ripe for the taking.

The National Telecom Regulatory Authority has referred Egypt’s four mobile operators — Vodafone, Orange, e& and WE — to the Public Prosecution.

The NTRA has also proposed the introduction of biometric identity verification for the registration of new mobile network subscribers.

But why did the NTRA not detect or address the problem before it escalated? How are mobile companies held accountable for the data they collect and retain?

And while steps have been taken to hold the companies legally responsible, is it enough to get to the root of the problem and ensure that biometric data handed to the NTRA will be handled securely?

The proposed biometric verification comes as Egypt’s personal data protection framework continues to face questions. Unlike data that can be changed, such as passwords, biometric data, such as facial scans, finger prints or eye scans, is permanently linked to the individual, and there is no going back if it is leaked.

Its use across different services and platforms could also allow for the collection and collation of data belonging to the same person, to build an online data profile of them.

Mada Masr spoke to Mohamed al-Taher, the cofounder of and researcher with Masaar, an organization dedicated to digital rights and freedoms in Egypt, as well as Hassan al-Azhary, a lawyer and researcher with the organization, to unpack the implications of the NTRA’s decision.

Azhary describes to Mada Masr the NTRA’s regulatory responsibilities and the legal ramifications of citizens discovering mobile lines registered in their names without their knowledge. He also talks us through data protection in Egypt and the loopholes in the regulatory framework and its enforcement.

And Taher, meanwhile, points to the government’s inclination to begin using biometric data.

Together, the pair express doubt as to whether biometric identity verification will solve the issue of fraudulent SIM card registration. Instead, they say, it could merely add another dimension to what they dub Egypt’s “privacy chaos.”

The interviews have been lightly edited for clarity.

Mada Masr:

The national regulator, the NTRA, said on Monday that it had referred Egypt’s four mobile operators to the Public Prosecution. Can we expect the referral to bring about better regulation and security in the handling of mobile data?

Hassan al-Azhary:

The statement acknowledges that the incident is real, meaning there is a problem that concerns citizens complaining that lines have been registered in their names when they didn’t buy those lines.

SIM card distributors used to sell what were called “old” lines: there was this broad, vague and unclear discussion around the issue. This is the first clear and official acknowledgment that there is a problem.

Referring the matter to the Public Prosecution is important because it opens the door more broadly for affected citizens to start bringing lawsuits against the companies, depending on the harm they suffered. Some may seek compensation because they suffered direct harm. Others may seek compensation because they fear that they could be harmed, while some may seek to terminate their contracts. It depends on the extent of the harm each person has suffered.

The third point is that this referral shifts the matter from a question of administrative accountability to one of criminal accountability.

MM:

The statement …