South Africa's Department of Home Affairs has closed bidding on a project that will let immigration officers do on a street corner what used to require a police station and a records clerk: photograph a face, scan ten fingerprints, and get a lawful-status verdict in seconds. Tender DHA10-2026, which closed on 24 July 2026, seeks a Biometric Case Management System (BCMS) paired with 600 rugged Android handhelds for the department's Inspectorate directorate — the unit that identifies undocumented foreign nationals in the field (ITWeb; Biometric Update). The devices must run Android 10 or higher, capture ten-print biometrics and ICAO-standard facial images, and hold an eight-hour charge for full shifts in the field (ID Tech). The contract runs 36 months with an optional two-year extension, and officials expect rollout by late 2026.
The Case For It
The honest case for this system is stronger than critics often allow. Home Affairs is not inventing an enforcement mandate — it is trying to execute an existing one faster and more fairly. The department reports a 46% rise in inland deportations over the two financial years ending 31 March 2026, reaching 109,344, on top of the more than 500,000 people the Border Management Authority has turned back at the frontier (DefenceWeb). That volume currently moves through a manual, document-based verification process that is slow, easy to forge, and — per the department's own disciplinary record of 37 immigration officials dismissed for corruption since 2023 — vulnerable to bribery at exactly the point where a human decides whether a document looks genuine (DefenceWeb). A biometric match against a central database removes discretion from that single moment. It is also, in principle, better for genuine asylum seekers and visa holders, who benefit from a system that clears them in seconds inside the 48-hour processing window the BCMS is built around, rather than sitting in a queue while a paper file is traced (ITWeb).
Where the Legal Foundation Actually Sits
The interesting policy question isn't whether Home Affairs may do this at all — it's on what authority. South Africa's Protection of Personal Information Act 4 of 2013 classifies biometric data as "special personal information" and prohibits its processing outright as a default rule (POPI Act, s.26, justice.gov.za). But Section 33 carves out exactly this scenario: the prohibition does not apply where processing is carried out "by bodies charged by law with applying criminal law" or by responsible parties who obtained the information in accordance with law (POPIA s.33). Home Affairs' Inspectorate, enforcing the Immigration Act, plausibly qualifies. That gives the BCMS a real statutory hook — this is not a rogue deployment operating outside the law.
The gap is that the hook has never been tested. No South African court has interpreted Section 33 in the context of mobile, street-level biometric enforcement, and — as data-protection practitioners have noted — the Information Regulator has issued no guidance or rulings specifically addressing biometric processing, leaving businesses and now a government department to reason by analogy to EU precedent rather than domestic authority (SEESA). The tender documents reviewed by trade press make no reference to POPIA compliance, a data protection impact assessment, or a retention and deletion schedule for biometric templates captured from people who turn out to be lawfully present (Biometric Update). A law that permits collection is not the same as a framework that governs what happens to the data afterward, and on that second question South Africa currently has silence, not rules.
The Real Risk Is Discretion, Not the Device
Immigration lawyers have flagged the more concrete concern: the system digitizes an existing enforcement pattern rather than replacing it, and that pattern already carries a documented risk of disproportionately targeting Black African foreign nationals amid periodic xenophobic flare-ups in Johannesburg and Cape Town (ID Tech). A fingerprint scanner does not decide whom to stop — an officer does — and a faster, more automated back end simply means that whatever bias shapes the stop now resolves in seconds instead of hours. That is an argument for guardrails, not for abandoning digitization: false-positive rates for South African citizens or documented residents mistakenly flagged need independent, published auditing, and stop-selection criteria need to be something more accountable than officer discretion alone.
What Should Happen Next
Home Affairs has a legitimate interest in replacing a corruption-prone paper process with a faster, harder-to-bribe one, and the 46% deportation increase shows the current system is already straining under enforcement demand the government has committed to meeting. The fix is not to block the BCMS but to pair it with what POPIA's Section 33 exemption assumes but does not itself require: a published retention limit for biometric templates, an Information Regulator opinion specifically addressing mobile law-enforcement biometric capture, and independent misidentification audits once the 600 devices are in the field. Proportionate modernization and enforceable privacy limits are not in tension here — the tender simply arrived before the second half of that pairing did.