A real fraud problem, met with a real technical fix
South Africa's Department of Home Affairs has a genuine problem: porous borders, document fraud, and undocumented migration that has fed anti-immigrant protests and strained relations with Ghana and Nigeria. On August 12, 2026, President Cyril Ramaphosa and Home Affairs Minister Leon Schreiber launched the Electronic Travel Authorisation (ETA) at OR Tambo International Airport to address it, combining facial recognition, liveness detection, machine learning and an upgraded Electronic Movement Control System (eMCS 2.0) to screen every foreign arrival before they board a plane.
The case for the system is not hard to make, and it deserves to be made fairly. Since the ETA began processing applications in May 2026, ahead of Wednesday's formal launch, it has handled more than 203,000 applications and flagged over 5,500 as fraudulent — checked against roughly 40 parameters for passport authenticity, according to the Presidency and reporting by TechCabal. Catching forged travel documents before a plane leaves the ground, rather than at the arrivals hall, is a legitimate security and administrative interest, and one most peer states already pursue through similar pre-clearance systems.
What the launch didn't say
What is notable is what the Presidency's own official launch statement does not mention at all: the Protection of Personal Information Act (POPIA), the Information Regulator, a privacy impact assessment, or any independent oversight body specific to the ETA. The announcement talks about faster travel, stronger security and a "modern digital immigration ecosystem." It says nothing about who audits the biometric database, how long facial scans are retained, or who a rejected applicant can appeal to.
That gap matters because South African law does not treat biometric data as ordinary personal information. Under Section 26 of POPIA, biometric data is explicitly classified as "special personal information" — the same tier as health records, religious belief and political affiliation — and may only be processed with explicit consent or a narrow statutory justification, per the Information Regulator's own guidance. Home Affairs can plausibly claim the latter: immigration control is a function assigned to it by statute. But that legal shortcut is precisely why independent verification matters more here, not less — a department invoking its own statutory necessity to process 200,000+ people's faces is grading its own homework unless someone outside it checks the work.
The oversight architecture that exists — and the part that doesn't
POPIA does have a mechanism for exactly this kind of high-stakes processing: Section 57 requires responsible parties to obtain prior authorisation from the Information Regulator before certain sensitive operations, including linking unique identifiers across systems for new purposes and transferring special personal information across borders to countries without adequate protection, per the text of Section 57. Whether the ETA's data flows — biometric checks shared in real time with airlines and border posts, per earlier Home Affairs statements — trip that wire is exactly the kind of determination that should be public before a system enrolls a quarter-million people, not litigated after a breach. No published Regulator authorisation, audit, or privacy impact assessment for the ETA appears in the public record as of this launch.
This is not a call to halt the ETA. Digital pre-clearance is the direction every serious border authority is moving, and South Africa's tourism and investment case for frictionless legitimate travel is real. The objection is narrower: a government that classifies biometric data as sensitive by law should not be able to satisfy its own oversight obligations by reference alone — a line in a terms-of-service page citing POPIA "as amended" is not a substitute for a published privacy impact assessment, a stated retention limit, or a named appeals process for the thousands of people the system will inevitably flag incorrectly at scale.
What proportionate regulation would look like here
The fix is procedural, not existential. Home Affairs and the Border Management Authority should publish the privacy impact assessment that Section 57-adjacent processing of this scale warrants, state a hard retention limit for biometric templates, and confirm — publicly, not in a footnote — whether the Information Regulator has reviewed the cross-border data-sharing architecture. Civil society and legal groups already flagged the Border Management Authority's centralisation risks during the 2018 legislative process; the ETA is that same architecture at national-airport scale. A system this consequential should not have to wait for a POPIA complaint or a breach to get the scrutiny that was supposed to precede launch, not follow it.