Duties of TSPs and Customers
The Act also requires all TSPs to gather detailed personal data on individuals and companies (including photocopies of ID documents) before signing service contracts (or selling SIM cards and mobile phones for pre-paid mobile services) and obliges them to retain that data and make it available to law enforcement agencies when requested to. There is no limit specified for the length of time TSPs are required to retain personal data, and the Act obliges ISPs to keep proper records of all personal information gathered.
This means that before an ISP can conclude a service contract with a subscriber/customer, they must obtain and store the following information:
If the customer is a natural person: his or her full names, identity number, residential and business or postal address, and a certified photocopy of his or her identification document on which his or her photo, full names and identity number, appear. The ISP must then retain the photocopy provided and verify the photo, full names and identity number of that person with reference to his or her identification.
If the customer is a juristic person, i.e. a company: his or her full names, identity number, residential and postal address; the business name and address and, if registered as such in terms of any law, the registration number of that juristic person; a certified photocopy of his or her identification document on which his or her photo, full names and identity number, appear; and a certified photocopy of the business letterhead of, or other similar document relating to that juristic person. The ISP must then retain the photocopies obtained and verify the photo, full names and identity number, of that person with reference to his or her identification document; and name and registration number of that juristic person with reference to its business letterhead or other similar document; and may obtain from such person any other information which the TSP deems necessary for purposes of this Act.
