“Please send your ID and proof of address.”
It is one of the most normal requests in South Africa, whether you are buying a car, applying for a rental, starting a new job, opening an account or signing up for a service. Increasingly, the response is simply a photograph sent over WhatsApp.
But once you hit send, where does that photograph actually go?
It could remain in a WhatsApp chat, be saved to someone’s phone gallery, downloaded onto a laptop, attached to an email, uploaded to cloud storage or stored inside a company’s CRM. If it is forwarded internally, there could be several copies sitting in different places without you ever knowing.
That is where the seemingly harmless “just WhatsApp me your ID” becomes more complicated.
POPIA places obligations on organizations that collect and process personal information, including identifying information such as ID numbers. The issue is not necessarily whether a business has a legitimate reason to request your ID. In many cases, it does. The bigger question is what happens to the information after it has been collected, including how it is stored, who can access it, how long it is retained and when it should be deleted.
And that WhatsApp message from three years ago? It could still be sitting on someone’s phone.
We have become so accustomed to sending sensitive documents through messaging apps that the process barely registers anymore. A photograph of your ID can feel like just another attachment, even though it contains information that can be used to identify you.
“How many copies of my identity are sitting on other people’s phones?”
So perhaps the bigger question is not “Who has my ID?” It is “How many copies of my identity are sitting on other people’s phones?”