MTN Group Limited 18%

OVERALL SCORE – 18%

MTN’s overall Index score falls in a cluster of four companies in the 10-20 percent range. At the same time, South Africa’s Internet is designated as “free” by Freedom House’s Freedom on the Net Index. Several factors may explain this contradiction: MTN’s group-level corporate entity has historically relied on the company’s operations outside of South Africa for revenue. The company operates in a number of challenging markets including Iran, Rwanda, Afghanistan, and other countries across the Middle East and North Africa, making it difficult for the company to publicly commit to respect human rights. MTN’s operating companies in some markets have included government-controlled entities as shareholders. MTN also faces a few regulatory challenges at home in South Africa. Nonetheless, the company’s poor performance in this Index provides a starting point for dialogue between company representatives and stakeholders to determine what concrete steps the company should take in the short- to medium-term so it can more credibly demonstrate respect for users’ rights.

Commitment - 22%

MTN’s public commitment to user rights was notably higher than any other telecommunications company in the Index except for the three Industry Dialogue members (Vodafone, AT&T, and Orange). However this distinction stems from the general lack of disclosure from other companies. MTN received full marks for policy and leadership (Indicator C1), which examines whether the company makes “explicit, prominent, and clearly articulated policy commitment to human rights including freedom of expression and privacy.” MTN also received some credit on governance and management oversight (C2) due to its board-level oversight of how company practices affect freedom of expression and privacy. However, the company provides no further disclosure about what policies and practices it has put in place to implement its commitments.

Freedom of Expression – 20%

MTN scored seventh out of eight telecommunications companies in the Index on Freedom of Expression.

Transparency about requests for content restriction: MTN’s low score is primarily due to the fact it discloses no information about the volume and nature of third-party requests that affect users’ ability to access or transmit information (Indicators F7 and F8), or any information about its process for responding to such requests (F6). No law in South Africa prevents MTN from disclosing general information about its processes for responding to various types third-party requests that ask MTN to restrict content or service to users. Under South Africa’s Electronic Communications and Transactions Act, MTN can lose its protection from liability if it fails to respond to requests for content removal. Thus, the law dis-incentivizes companies from defending original content owners or pushing back on unlawful takedown requests. Whether it would be legal for MTN to report on government content restriction requests is unclear.

While companies in South Africa are banned from reporting on government requests for user data (as further discussed below), it is unclear as to whether MTN could be affected by the National Keypoints Act, which gives the government the ability to censor information to and about infrastructures considered crucial to national security. This could potentially prevent the company from disclosing information about requests related to content or account restriction.

Network management: MTN discloses no information about whether it prioritizes or degrades the transmission or delivery of different types of content (F10). There is no “net neutrality” law in South Africa, nor does the law require MTN to disclose information about prioritizing or degrading delivery of content. MTN is under no legal obligation to monitor traffic on its network, but the law also does not prevent it from monitoring content on its network. In any case, MTN has no legal or regulatory reason why it cannot to be more transparent about such practices.

Privacy - 14%

MTN tied with Etisalat for the lowest score of all telecommunications companies in the Index on Privacy. Only one company in the entire Index scored lower, the Internet company Mail.ru.

Handling of user information: The company does a poor job of informing users about how it manages their information, for example what it collects (P3), with whom and under what circumstances it shares user information (P4), and how long it retains user information (P7). Changes in South African law may help MTN improve its performance in the future. The country’s president recently signed a new Protection of Personal Information Act that requires companies to provide users with access to their own stored information, to disclose what the information is used for and explain how it is used. However the Act will not fully come into force until a Personal Information Regulator has been established, and the timeline for implementation is unknown. In the meantime, even before the law is brought into force, there is no obstacle for MTN to meet or even exceed requirements under the new law.

Transparency about requests for user data: MTN provides almost no transparency about third-party requests for user information. On indicator P9, which seeks disclosure about the process for responding to third-party requests, the group level of the company commits to carry out due diligence on requests before deciding how to respond, but neither it nor the operating company provides any specifics about its process for receiving and responding to government requests or any other requests. The law prohibits the company from notifying users about requests (P10) as well as from disclosing information that pertains to the number or nature of requests (P11). In addition, the law forbids the company from disclosing information about the fact that requests took place, which creates a potential problem for even disclosing information about the process for handling requests. However there is no law preventing greater transparency about private requests.

Security: MTN faces no meaningful obstacles to improving its disclosures about security practices (P12), nor is there any reason why the company cannot make stronger efforts to educate users about security threats (P14).