Stranger got my number from visitor book

I recently visited an office building in Dar where I was required to enter my personal details in a registration book. There was a man waiting behind me who was the next person to register. Later that evening, I received a WhatsApp message from him saying that he had noticed me at the entrance, found me attractive and wanted to get to know me. When I asked how he got my telephone number, he told me that when it was his turn to register, my details were immediately above where he was writing and he simply copied my number. Is the building management allowed to keep visitor information in this manner under Tanzania’s laws?

MN, Dar es Salaam

Your admirer may have been very resourceful, but a visitor registration book should certainly not become a dating directory.

Under the Personal Data Protection Act, information such as your name, telephone number and identification details constitute personal data. There may be perfectly legitimate reasons for the management of a building to collect certain information from visitors, particularly for security and access control purposes. The problem is not necessarily the existence of the visitor book itself, but the manner in which the personal data contained in it is collected and protected.

The Act requires personal data to be collected for a lawful, specified purpose and protected by reasonable security safeguards against risks including unauthorized access, use and disclosure. Further, the Personal Data Protection Regulations, 2023 require a data controller to limit the personal data collected to what is necessary for the intended purpose. This means that building management should consider whether it genuinely needs your personal details merely for you to enter the premises and, where such information is necessary, how it will be protected from persons who have no reason to access it. In the circumstances, reasonable data protection measures should therefore address not only deliberate disclosure by employees but also whether the system itself unnecessarily enables one visitor to access another visitor’s personal information.

If you believe your personal data has been improperly handled, you may lodge a complaint with the Personal Data Protection Commission.