The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) has proposed a mandatory registration of all mobile phone handsets, linking them to a central database via their International Mobile Equipment Identity (IMEI) numbers. Ostensibly, this move is framed as a necessary measure to combat cybercrime, phone theft, and fraud. But beneath the veneer of public security lies a deeply troubling expansion of state surveillance, one that threatens privacy, lacks legal justification, and risks entrenching authoritarian control over citizens’ digital lives.
POTRAZ claims that registering every mobile phone in Zimbabwe will help curb cybercrime and stolen devices.
Yet, the regulator has failed to provide convincing evidence that existing measures—such as SIM card registration—are insufficient. In neighboring South Africa, where SIM registration is mandatory under the Regulation of Interception of Communications Act (RICA), there is no widespread handset registration. Kenya’s Central Equipment Identity Register (CEIR) does track IMEI numbers, but even there, the system has been criticized for inefficacy in actually reducing theft or cybercrime.
If POTRAZ were serious about tackling cybercrime, it would focus on strengthening cybersecurity infrastructure, improving digital literacy, and enforcing existing laws against fraud—not on creating a sprawling database of every Zimbabwean’s phone.
The proposal suggests that the state views ordinary citizens with suspicion, treating them as potential criminals rather than rights-bearing individuals.
The legal opinion above makes it clear:POTRAZ has no authority to enforce handset registration under current law.The Postal and Telecommunications Act does not grant POTRAZ the power to mandate such intrusive data collection. Any attempt to impose this requirement without new legislation would beultra vires—an overreach beyond its statutory mandate.
More critically, the proposal violatesSection 57 of Zimbabwe’s Constitution, which guarantees the right to privacy. Linking IMEI numbers—unique identifiers tied to individual devices—to personal identities constitutes a severe intrusion into private life.
Without robust safeguards, this database could easily be abused for state surveillance, political repression, or even commercial exploitation.
Under theCyber and Data Protection Act, any data collection must be lawful, proportionate, and necessary. POTRAZ has not demonstrated that mass handset registration meets these standards. Are there less invasive ways to achieve the same goals? Absolutely.
Enhanced SIM registration, stricter penalties for cybercrime, and voluntary IMEI blacklisting for stolen phones could all be pursued without creating an Orwellian tracking system.
POTRAZ insists that this system is not for surveillance—but history suggests otherwise. Zimbabwe’s government has a well-documented record of monitoring dissent, from internet shutdowns during protests to the alleged use of spyware against activists. A centralized IMEI database would provide yet another tool for state overreach, enabling authorities to track individuals’ movements, communications, and transactions with alarming precision.
Even if POTRAZ’s intentions were pure (a dubious assumption), the lack of independent oversight mechanisms means there is nothing stopping future governments from weaponizing this database.
Who will ensure that law enforcement doesn’t abuse this power? What prevents political opponents, journalists, or ordinary citizens from being targeted under the guise of “cybercrime prevention”?
POTRAZ cites Kenya and South Africa as models—but this comparison is misleading. Kenya’s CEIR operates under specific legislation with judicial safeguards. South Africa’s RICA explicitly excludes mandatory handset registration.
Zimbabwe, by contrast, is pushing this scheme without clear legal backing or public consultation.
Moreover, Kenya’s system has faced criticism for failing to significantly reduce phone theft, while South Africa has resisted IMEI registration precisely because of privacy concerns. If POTRAZ is truly interested in best practices, it should explain why it is ignoring these lessons.
Source: Iharare
