The Facial Recognition Dragnet Runs on Private Infrastructure

South Africa’s largest surveillance network sits inside estates, malls and office parks. The POPIA conversation has barely touched it.

Sign up for my Substack daily AI newsletter here.

Article link: https://johanosteyn.substack.com/p/the-facial-recognition-dragnet-runs?r=73gqa&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/

You passed through at least three of them this week. The camera above the boom gate at your office park. The scanner at your estate gate. The camera at the mall entrance that tracks you from the parking lot to the shopfront. South Africa has quietly built one of the largest surveillance networks in the world, and the police do not run it. Private security firms do, mostly without the oversight the SAPS debate has demanded of the state. The Information Regulator has only just begun to speak, and the lawyers for the first wrongfully identified residents are already preparing their papers. The POPIA conversation has barely noticed.

CONTEXT AND BACKGROUND

South Africa has more than five hundred and eighty thousand registered private security officers and eleven thousand security businesses, operating alongside an industry-estimated 1.2 million CCTV cameras nationally. Roughly sixty per cent of large residential estates and forty per cent of office parks already use biometric or licence-plate recognition. Vumacam alone has deployed more than six thousand cameras nationally through subscription contracts with private firms, and Bidvest Protea Coin’s “Scarface” platform runs a biometric database of so-called persons of interest without published accuracy rates or data-handling policies.

On 30 April 2026, the Information Regulator published a draft Code of Conduct for the Processing of Personal Information at Gated Access Areas, applying to residential estates, business parks, office complexes, schools and hospitals. The code would require biometric collection to be justified by a Personal Information Impact Assessment, limit data retention, prohibit indiscriminate ID copying and treat guards and reception staff as data processors under POPIA.

INSIGHT AND ANALYSIS

Earlier this year, the Regulator went further. Facial recognition, it said in response to a SAPS body-camera tender, is “legally prohibited by default” under POPIA, even for the police. The statement was made about the state. It applies, in exactly the same words, to any responsible party processing biometric information, which includes every private security firm, estate manager and shopping centre operator running the technology today.

I have previously written about facial recognition and our biometric future, arguing that the technology was being deployed in South Africa faster than any legal framework could catch up. The intervening years have proved that right. The private sector built the dragnet while the public debate stayed focused on the police. The exposure now sits with trustees, directors, body corporate members and property managers who did not know they had assumed it.

The redress problem is sharper still. A citizen wrongly identified by an estate’s facial recognition system cannot use the Promotion of Administrative Justice Act, because the security firm is not an organ of state. Civil remedies, including delict and breach of POPIA, exist but are slow and expensive. For the resident turned away at the boom or detained by a guard on an algorithmic mismatch, the law offers protection in theory and silence in practice.

IMPLICATIONS

For an estate trustee or mall operator, three questions follow. Which of your service providers runs facial recognition on your residents and visitors, and under what documented legal basis? Who holds the biometric database, where does it sit, and what happens to it when the contract ends? What appeal path has a wrongly identified citizen been given before they must engage a lawyer?

For the Information Regulator and the National AI Policy process, the lesson is sharper. The draft Code of Conduct for Gated Access is a necessary first step, but it is only one jurisdiction’s rule applied to one sector. The private surveillance network already runs across municipal, provincial and sectoral boundaries, and the legal architecture is not yet built to see it whole.

CLOSING TAKEAWAY

The SAPS surveillance debate has had one half of the hearing. The private half has not. The quiet truth is that South Africa’s largest facial recognition deployment belongs to a sector most citizens cannot name, operates on infrastructure they did not approve, and holds the biometric information of millions of residents under terms nobody signed. Governance is not optional here. It is overdue. The Regulator has started. The lawyers have started. The question for estate boards, mall operators and property managers is whether they will have a defensible answer when the first citizen in court asks who owes them a reason.

Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net