Four years after the issuance of the Personal Data Protection Law No. 151 of 2020, most of its provisions remain suspended pending the issuance of its executive regulations. Despite the importance of issuing them, the Ministry of Communications and Information Technology has not taken any step since the data protection law was issued.
There were some parliamentary moves by MP Ayman Mehseb and MP Amira El-Adly, but their efforts did not succeed in pushing for the regulations to be issued, which has resulted in the continued violation of citizens’ data without any official body to complain to, such as the data protection centre that was supposed to be established as soon as the executive regulations were issued and the suspended law activated.
In this report, Zawia3 documents some citizens’ complaints about caller ID apps violating their private lives and causing them severe harm on many levels.
“This app, GetContact, ruined my upcoming marriage.” Seham (a pseudonym) opens her conversation with Zawia3 by saying she did not know about this app before, but she and her fiancé used Truecaller. When her fiancé used GetContact and searched for her name, he found an offensive tag about her and confronted her. She denied knowing about it and asked him to be reasonable, as it might have been someone with a grudge. His reply was: “Even if what you say is true and you are not to blame, in the end it affects my reputation that someone could look up your number and find my wife labelled with such names.”
She continues: “I felt insulted and told my family, and the conversation between them and my fiancé developed into a quarrel. After the date for the marriage contract had been set, the engagement was broken off because of an offensive tag I was not to blame for! I am still trying to absorb the shock. What benefit does whoever did this gain? And how can I even know who it is, since they are anonymous? Frankly, I wish I knew who did it, so I would have an idea of who has my number and hates me this much.”
Information security expert and adviser to the Supreme Cybersecurity Authority at Al-Qada Foundation, Walid Haggag, says: “We do not want to reduce caller ID and data apps to Truecaller and GetContact, despite their popularity; they are the least dangerous apps, because they work by obtaining the caller’s name when the number is entered. But other apps (which we do not want to become known and widely circulated) work by entering a name or position, and everything about the person appears, from the phone number to the home address and email, and even the driver’s number if the person holds a senior position.”
Haggag adds that the number of these apps is countless, explaining: “To delete a person’s data from them, a certain amount of money must be paid to each app separately. And the way these apps collect data is known: it happens through all of us, when we agree to the terms and conditions of any free apps that allow access to the phone’s contact list.”
Between Benefit and Loss of Privacy
“I have good experiences with Truecaller.” This is what Marwa El-Gendy (who lives in Giza Governorate) told us as she recounted her positive experience with this app.
She explains that the Truecaller app helps her identify phone harassers: “When my phone rings with a number I do not know, I make sure to check it through the app. If the number is registered as a nuisance or harasser, it saves me the trouble of answering and dealing with it. It also relieves me of dealing with advertising companies whose calls I do not want to receive either. Frankly, I find Truecaller useful for an introvert like me who does not want to receive many random calls.”
Asked her opinion about the annoying tags on GetContact, she says she does not feel comfortable with it and sees no reason to use that app, sticking to Truecaller, although she was curious to know what her tags were, but later backed away from the idea for fear of her privacy being breached.
She adds: “I know that these apps breach the privacy of our phones, and I decided one of them is enough on my phone, and I advise everyone to download only one of these apps on their phone. I have a friend who went through a difficult time because of GetContact; some of the offensive tags about her revealed that many of her classmates hated her. The tags did not damage her reputation, but expressed their dislike of her personality, which caused her a bout of depression. In my opinion, there was no need to create these apps; they are a kind of gossip and encourage the spread of hatred among people.”
Returning to Haggag and asking him about a way to remove offensive tags, he answers: “There is a way to remove them, and another that prevents personal data from appearing on GetContact specifically, but in return it prevents me from using the app on that number. As for Truecaller, there is a simpler way, such as removing lists manually, or if the user is unlucky and bought a line registered on Truecaller under someone else’s inappropriate name, they can clear the related cache and start using the app again. This is the most we can do, because there are no cooperation protocols between these data-owning platforms and many countries. In my personal view, these apps do more harm than good, but this varies according to people’s needs. I cannot be sure how useful they are to some, but I can be sure that all these apps are means of collecting personal data. The provider of this free service must benefit from it, and this is the benefit here. This applies to Facebook, Gmail, X, TikTok and YouTube; everyone benefits. Only the way they benefit differs: some is strategic and political, some is information gathering, and some is for intellectual manipulation and knowledge piracy.”
Anwar, who lives in Cairo Governorate and works at a promotional company, says: “I do not think the matter deserves all this fuss; they are just apps to identify callers and do not deserve much attention.”
Anwar, who believes talk about offensive tags and these apps’ violations should be ignored, says: “I do not pay attention to it; my knowledge of people is what determines who they are and what they are like, and I do not need the opinion of someone who knew them before me to classify my circles of acquaintances. Frankly, I see anyone who relies on these tags to get information about particular people as childish and lacking maturity. What is to stop whoever wrote those names from being narrow-minded, or even deliberately putting tags out of revenge? The only time I know something is wrong with a number is when I use Truecaller and find the number marked as a nuisance by more than two thousand numbers, for example, so I avoid answering then, because I avoid promotional calls and advertisements.”
Asked about the privacy of his data, he answered that apps of this type cannot be downloaded onto the phone without accepting the terms and conditions, all of which relate to accessing the phone’s contact lists and some other features such as the camera and microphone. And not only these apps; some request access to the photo gallery and calendar as well, and the user is forced to accept all the conditions.
He continued: “There is no escape from accepting all the terms and conditions in order to download the apps, especially since I rely on many of them to make my work easier as well. I thought some time ago about buying an iPhone when I learned that it has great privacy features, but I was not sure whether this privacy applies in Egypt or not.”
Solutions in the Absence of the Law
“The companies that make these apps make them available for free so that as many people as possible will use them,” says Mahmoud El-Banna, a network security engineer at Cairo Housing and Development Company, continuing: “When we agree to give an app permission to access our phones, it takes our information and uploads it to its company’s server files, so the data becomes the company’s property and available for purchase from the company itself, which sells it to any company that wants to produce advertisements based on consumer data, as happened in a partnership between Truecaller and Facebook based on exchanging data for advertising. The idea of targeting a customer by having the call end and an advertisement from the targeting company appear (as in the Truecaller and Facebook example) is common and shared across games and most free apps. But the disaster we are discussing in the case of caller ID apps is that nothing prevents me from being named and tagged on these apps, which happens without referring to me, and on a global, not even local, level. By agreeing to the app’s terms and conditions, I agree to give it my data absolutely, and in return it does not tell me what it will do with it or where it stores it. There is no legal obligation on these apps forcing them to disclose that.”
He adds: “If these apps had legal representation in Egypt (as in some European countries where data protection laws are in force), we could then propose practical solutions to ensure the customer is protected from offensive tags, for example by informing the user who uploaded the tag, with the right to approve or reject it or even amend it before it is attached to their number. If they are not a user of the app, they would be informed by text message. That way, everyone’s rights are guaranteed.”
Commenting on how to deal with the matter if the caller really is a harasser or nuisance and then rejects the tag describing him as such, he answers: “For a harasser, there will be over 100 users at least who have reported his number to the app. A technician can easily set this rule: if the number exceeds a certain number of block reports and complaints, it cannot then edit its tags.”
Risks and Threats
Young pharmacist Gamal (a pseudonym) describes how GetContact caused him some problems: “I almost lost my job because of this app. When I started working at one of the biggest international pharmaceutical companies in Egypt, this app did not exist (as far as I know). I achieved great success in my field until I was promoted to a good position, then the app began to spread. I was at odds with a colleague at work, and when he searched for my tags on this app, he found tags relating to me being an addict. In truth, I have been in recovery from addiction for years. This colleague went to my manager, told him I was an addict and showed him the tags directly linked to my name. Fortunately, my manager sat down with me for a friendly talk and told me about it. I was frank with him, offered to take a surprise drug test to settle the matter, and promised to sort out the tags to protect my reputation and the company’s. And so it was. I did what I promised, but I was under pressure from the feeling of being threatened with losing everything I had achieved. I talked to everyone who had my number and knew about my addiction, so that they would change my name on their phones if they had me saved under a name related to drugs. I told them the story, and they responded and showed very kind feelings; in the end, no one deliberately tried to hurt me except the colleague with bad intentions. I do not advise anyone to download these apps; their harm is greater than their benefit, and they are used for malicious purposes.”
The Absence of the Regulations
Legal researcher and lawyer Hassan El-Azhary explains the legal ways to deal with this flagrant breach of privacy. He says: “First, to be accurate in investigating the matter, we have to ask the question correctly: does Truecaller or GetContact have an office or legal representation in Egypt? In other words, if I actually had a legal text criminalising acts of data privacy violation and an enforceable ruling were issued in my favour, how would I enforce it if the entity it concerns has no official legal representation in Egypt? This leads the state to the easiest solution, which is blocking websites and apps, whereas the remedy relates to legislative policies and judicial cooperation protocols between the state and the owners of major technology companies. For example, the mounting complaints about real estate marketing calls in recent months had a big echo, and Vodafone was given a deadline to make clear to its customers that the incoming call is promotional, leaving them free to choose whether to answer. This is because Vodafone has an official legal entity in Egypt.”
He adds: “Returning to the Personal Data Protection Law No. 151 of 2020, we find that most of its provisions remain suspended pending the issuance of the executive regulations by the Ministry of Communications and Information Technology. So it is a formal law. As a result, no data protection centre has been established, whose role is essentially to receive complaints from users and to correspond with similar entities and bodies in other countries to protect data. Therefore, talk of any action regarding these apps and others that violate users’ privacy has become useless in these circumstances. The world is waging a data war at the technical level, given the importance of data in determining user behaviour and predicting it.”
Despite the keenness to apply specific provisions of the Anti-Cyber and Information Technology Crimes Law No. 175 of 2018, such as Article 25 on violating the sanctity of private life and information content, the opposite is true regarding the Personal Data Protection Law. How long will the disregard for the violation of citizens’ personal data and the undermining of their security prevail, in an age in which cybersecurity has become part of its main conflict?
