91 • • • government departments. While a legal framework on the collection and processing of personal data existed, adequate protection of the data required the operationalization of that legal framework. Risks could arise in relation to biometric identity systems. There was a risk of exclusion which could mean that certain individuals would not access goods and services that they were entitled to. Exclusion could arise in two ways. One was individuals who were unable to get an identification card or number despite being entitled to the identity card. The second type was individuals who were enrolled on to the biometric system but suffered from exclusion due to biometric failure in their authentication. Centralized storage of biometric data involved risks of attacks or unauthorized access and also risks of misuse which could be irreversible. That misuse could result in discrimination, profiling, surveillance of data subjects and identity theft. With centralized storage, in most cases, the data subject had no information or control over the use of his or her biometric data. Risks could also arise where the storage of biometric data was distributed between a central and federated or decentralized database. In such cases, there were increased risks of unauthorized access, use and tracking of personal data and the possibilities for re-use for unintended purposes. All biometric systems, whether centralised or decentralised, and whether using closed or open source technology, required a strong security policy and detailed procedures on its protection and security which complied with international standards. While the respondents explained the measures put in place to ensure the safety of data collected by NIIMS, they did not dispute the fact that there was no specific regulatory framework that governed the operations and security of NIIMS. They did not provide a cogent reason for the obvious gap in regulation. To that extent the legal framework on the operations of NIIMS was inadequate and posed a risk to the security of the data to be collected. On the right to privacy, the court held that the right to privacy was not a non-derogable right under article 25(c) of the Constitution. A limitation of the right to privacy was therefore permissible if it met the test set out under article 24(1) of the Constitution. Article 24(1) of the Constitution provided that a right or fundamental freedom in the Bill of Rights would not be limited except by law, and only to the extent that the limitation was reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom, taking into account the nature of the right or fundamental freedom. Due to the specificity of the information that DNA could disclose and the harm that the disclosure could cause not just to the data subject but other family members both in terms of identification and genetic information, DNA information required and justified particular and specific legal protection. GPS coordinates involved privacy risks wherein they could be used to track and identify a person’s location. Therefore, the collection of DNA and GPS coordinates in the impugned amendments without specific legislation detailing appropriate safeguards and procedures in the collection and the manner and extent that the right to privacy would be limited was not CITIZENSHIP AND NATIONALITY RIGHTS CASE DIGEST