An alleged cartel of detectives is cashing in on search warrants it uses to access people’s call logs and confidential financial statements to share with third parties, Weekend Nation’s interview with a victim and review of various documents has revealed.
According to data specialists, while the country’s laws are designed to protect personal data, the practice does not only threaten individual privacy rights but is also an issue bordering on identity theft.
Detective Maria Nyondo alleges she is one of the victims of the practice. She got disturbed last year when she discovered her confidential data was with Press Corporation Limited (PCL) plc auditors and National Bank of Malawi (NBM) management.
She knew about the illegal sharing of her confidential data through her husband who was then working for NBM after that auditors sent him an email with his wife’s call logs and mobile money statements for 365 days.
The auditors were reportedly investigating the husband and wanted to confirm his location details from the wife’s confidential data that included call logs, mobile money statements and know your customer (KYC) information.
Nyondo later learnt that PCL and NBM got her data from Airtel Malawi plc and Telekom Networks Malawi (TNM) plc through search warrants whose affidavits were filed by a fellow detective Amos Katundulu.
According to the search warrants, Katundulu and the court were listed as the only executors.
Section 113 of the Criminal Procedure and Evidence Code (Cpec) states that a court only issues search warrants after a police officer or a State agent applies, and satisfies the court with reasonable grounds for the application.
Said Nyondo in an interview last week: “Neither PCL nor NBM were listed as executors. Further, they are neither law enforcement agencies nor the courts. How they got my confidential personal data I don’t know.
In August last year, Nyondo wrote the newly-established Data Protection Agency (DPA) through the Malawi Communications Regulatory Authority (Macra), formally lodging a complaint regarding breach of her privacy and unlawful handling of her personal data.
She wanted DPA and Macra to investigate the issue and take appropriate measures against the individual or entities responsible for illegal disclosure and sharing of her personal data.
In an interview, Macra director general Daud Suleman confirmed receiving the letter, saying the matter was addressed as per the DPA 2024, but he declined to divulge much.
But in an email, DPA data protection enforcement officer Tamanda Kamundi advised Nyondo that according to law, the authority could not institute an investigation into the matter as it happened before the Data Protection Act was enforceable.
Government enacted the DPA, which came into force on June 3 2024 to provide a comprehensive legal framework for protecting personal data and designates Macra as the data protection authority. The Act aims to consolidate existing data protection provisions and align with international standards.
In October last year, Nyondo wrote Airtel and TNM, demanding K 470.4 million and K410.9 million, respectively, as compensation for unauthorised access and sharing of her confidential data to third-parties.
She argued: “These actions constitute serious violations of my constitutional right to privacy, as protected under Section 21 of the Constitution of Malawi, and breaches of the Electronic Transactions and Cyber Security Act.
“I am seeking compensation for the distress, loss of privacy, and damage to my personal and professional reputation resulting from the unauthorised access and sharing of my data.”
She told Weekend Nation, Airtel advised her that the matter was undergoing internal investigation. “Unfortunately, they have never come back to me,” she said.
On its part, TNM, through its lawyer Lusungu Mtonga, told her that the firm was taking the issue seriously and was conducting a thorough investigation.
“It is our client’s belief that this matter can be resolved without resorting to litigation. We, therefore, kindly request that in the meantime, all steps related to litigation should be put on hold,” wrote Mtonga on November 11 2024.
In an interview yesterday, Katundulu distanced himself from the issue, saying he had no hand in how Nyondo’s personal details found themselves in the hands of a third-party.
However, Weekend Nation has seen search warrants which Katundulu obtained from Blantyre Magistrate’s Court dated May 13 2024.
Airtel Malawi plc’s head of brand, public relations and corporate social responsibility Norah Chavula did not respond to our inquiry while TNM marketing director Sobhuza Ngwenya said they were not ready to comment on the matter.
An expert in data privacy and protection Harrison Chisonga said issues of data privacy breaches were becoming increasingly serious and noticeable in the country.
He said this was a result of the growing digital services across sectors such as banking, telecommunications, health, and e-government.
“While comprehensive national statistics are limited, there have been rising concerns about unauthorised access to personal information, poor data handling practices, and limited public awareness of data rights.,” he said
In Malawi, an individual whose personal data has been illegally shared with a third-party is at liberty to seek remedies such as lodging a complaint with the DPA for investigation and enforcement action, pursuing legal redress through the courts for compensation or injunctive relief, and requesting the offending party to delete or correct the shared data.
Judiciary chief corporate affairs and public relations officer Ruth Mputeni said in a written response that to ensure search warrants have legal grounds, an application for a search warrant must be supported by information in writing.
“The police officer making the application is required, under Section 113 (3) to answer on oath any question that the court may put to him,” she said
On his part, Legal Affairs Committee of Parliament chairperson Albert Mbawala said his committee has never received any complaint regarding the issue but it was ready to take up the matter.
He said: “As a committee, one of our mandates is to make sure rule of law is observed in the country. If anyone breaks the law, it’s our mandate to inquire into that.
