The popular caller ID app, Truecaller, is currently under investigation in South Africa. This follows several complaints suggesting that the app may be in violation of the country’s data protection law, the Protection of Personal Information Act (POPIA).
South Africa’s regulator, the Information Regulator, has initiated an inquiry. The investigation stems from accusations that the app incorrectly labels some businesses as spam and demands payment for their removal from such listings. Truecaller has denied these allegations, asserting that it does not charge for "whitelisting" and that its contact permissions are compliant with POPIA.
The app, which is widely used for identifying unknown phone numbers and blocking spam calls, argues that access to users' contact lists is fundamental to its core functionality. It maintains that this access is not for the purpose of collecting or misusing personal data.
Privacy Concerns Regarding Truecaller's Data Practices
Despite Truecaller's defence, privacy experts remain sceptical about its data handling practices. Lucinda Botes, a senior associate at Phukubje Pierce Masithela Attorneys, highlighted a significant concern: Truecaller's ability to display information about non-users, individuals who have never downloaded or used the app. Botes explained that this capability poses a potential legal risk, even if the company does not technically upload contact lists from users.
Botes expressed concern that the app's data practices may conflict with a fundamental principle of the Protection of Personal Information Act (POPIA), which is "openness." This principle mandates that organisations must inform individuals about how their personal information is collected and used. The primary issue raised is that individuals whose phone numbers are included in other people's contact lists have not provided their consent for their data to be shared through the app.
Beyond individual privacy, the law also provides mechanisms for businesses to protect their reputations. They have the right to request clarification or removal if their details appear in databases like Truecaller's.
Truecaller maintains that its system is designed to protect users rather than exploit data. The company points to its "unlisting" feature, which allows anyone to remove their number from its database. Furthermore, Truecaller argues that individually notifying every non-user whose number might be in its database would be technically and logistically impossible.
The outcome of this investigation in South Africa could establish a significant precedent for how technology platforms manage user and non-user data within the country. As the digital economy continues to expand across Africa, the Truecaller case may serve as a defining moment in the ongoing effort to balance technological innovation with privacy rights. It will test the extent to which convenience can be prioritized before crossing the boundary of informed consent.