Driving licence card scanner warning for estates

Managers and oversight bodies of estates, office parks, and other properties that scan driving licence cards or discs for access control should ensure these outsourced systems comply with the Protection of Private Information Act (Popia).

Information Regulator chair Advocate Pansy Tlakula recently told radio station 702 that she believed some gated communities and office parks violated Popia by collecting too much personal information.

“When you go into gated communities and office parks, what happens is they scan your licence disc, which contains a lot of personal information,” said Tlakula.

“They scan your driver’s license, and some even take your photo.”

Tlakula said that Popia only allowed for minimal personal information collection when done with a specific purpose in mind — such as security.

For gated communities, she argued that the driver’s name, vehicle registration number, and car colour were sufficient.

Tlakula said that the regulator could focus on consulting with and potentially creating a code of conduct for personal data collection for the surveillance sector, after its work on the direct marketing sector.

One major access management system provider, At the Gate (ATG) Digital, has maintained that it consulted a specialist privacy and data protection corporate law firm to ensure that its system complied with Popia.

The company explained that the old practice where visitors could only access controlled areas by writing their information into a physical book was more problematic than fit-for-purpose digital systems.

“For years, visitors have been asked to provide their name, cell phone number and signature — at a minimum — to gain entry into lifestyle estates,” ATG Digital sales head Ariel Flax explained.

“Popia throws these practices into question — but not for reasons one might assume.”

“Visitor registration is allowed. However, often the visitors’ information is handwritten in a book that’s vulnerable to prying eyes — and therein lies the problem.”

Flax emphasised that Popia does not disallow the collection of personal information but enforces rules on what is collected and why, how it is stored, and if shared, with whom and why.

“The answers to these questions must be made known to the owner of the information before they share it,” Flax said.

Flax’s view aligned with Tlakula’s regarding minimal information collection at access control points.

He said that lifestyle estates, complexes, and community schemes should not collect more information than necessary to fulfil a “specific and reasonable” purpose, like for protection services.

“Features like ‘de-identification’, where unnecessary information that has been captured from driver and motor vehicle licences is redacted, eliminate non-compliance risks,” Flax explained.

He added that ATG Digital’s system could be set to hide the information on the scanning devices or in reports stored on the backend system.

The scanning devices also store none of their captured personal data.

That means security guards, other visitors, site managers, and criminals have no data to access on the devices.

ATG Digital said once the data is scanned, it is immediately encrypted and uploaded to secure cloud-based storage.

Additional mitigations

ATG Digital staff can only access data on the backend upon a written request from an authorised representative of the Responsible Party — such as the estate, complex, or office parks management authority.

The data also requires a password to access, and ATG said it regularly performs penetration testing to ensure the security of its platform.

Flax also said that ATG Digital’s system included a preset for deleting data records after a specified period, another requirement of Popia.

“It is deleted as soon as reasonably possible following the client’s [estate, office park, etc.] requirements,” the company said.

All ATG Digital employees are trained in information security and contractually obligated to keep personal information confidential.

ATG Digital also provides signage and other notices that make it clear to drivers what information is being collected and for what purpose.

“Guards are empowered with lanyard cards and boards to assist in communicating to data subjects the reasons for the data being collected,” it explains.

It also maintains a comprehensive Complaints Policy with a dedicated email address to help people who require additional information about the company’s Popia policy.