Popia twist in Nelson Mandela University's student elections

The student elections at the Nelson Mandela University in Gqeberha, Eastern Cape, have been hit by allegations that they were hosted on a server that is outside South Africa — potentially in conflict with the new legislation that protects personal data.

TimesLIVE has established that the hosting of the election on US-based electronic voting platform, electionbuddy.com, was done in contravention of sections of the Protection of Personal Information Act. 

This is as the NMU insisted that it had followed the requirements of the act and that no formal dispute had been lodged within the deadline.

“The appointment of the service provider was preceded by a demonstration of the online election system to show its functionality and relevance to the university.

“Online systems exist in the cloud to make them accessible virtually anywhere. Data centres are globally regionalised to improve security, localisation and speed of access. This explains how systems are structured,” NMU spokesperson Zandile Mbabela said.

Preliminary results published last week, which were announced by the university last Friday, saw the DA Student Organisation (Daso) win the elections with 6,523 out of 16,795 votes, making Khwezi Mathambeka president for the 2023 academic year. Daso was up against the EFF student command, which got 3,821 votes, Sasco with 5,442 and Pan African Student Movement of Azania with 770 votes.

NMU has four campuses with 32,801 students.

TimesLIVE was shown evidence that supports claims that KDBS Election Management Services, the company appointed by the university to run the elections, did not inform students it too was sharing student’s data with a third party, nor did it ensure that the United States of America had similar personal data protection laws.

Section 72 of Popia stipulates that before transferring personal information outside SA a responsible party, in this case KDBS, needs to ensure that the recipient of the information, in the case the owners of the host server, is bound to data protection and processing laws that are similar or in line with those of SA. Over and above the data processing laws, information regulator spokesperson Nomzamo Zondi said, third-party service providers need to get the explicit consent of each student, as the owner of the data, before hosting their personal data in another country.

“In these cases should anything go wrong, such as a hack or somebody complains, the regulator would hold the institution responsible, and not the service provider, because it was their responsibility to ensure that the information was processed lawfully and protected,” she said, commenting generally.

Zondi added that Popia agreements between holders of personal information and third parties need to be detailed in how the information will be stored or processed, as well as how it will be protected.

KDBS managing director Thobile Thomas referred queries to the NMU, saying he was not at liberty to speak publicly outside the elections committee. The university has previously said KDBS was appointed and contracted in accordance with Popia.

“In this regard, the service provider is made accountable for such use of information. Additionally, Popia terms were loaded on the voting system, which students are required to accept or decline before continuing. This was also a mechanism of ensuring compliance with the act,” said Mbabela.

“South African laws apply and are respected in the manner in which the university uses data, which is stored in the regional data centres and accessible via the cloud,” she added.

Former Independent Electoral Commission chair Terry Tselane is a staunch supporter of virtual elections and said it was a good development that student formations and academic institutions, as participants and stakeholders, were contributing to debate and thought around virtual elections.

Tselane, who is now the executive chairman of the Institute of Election Management Services (IEMSA), said questions of technology and data storage were also raised by parliament when it was considering conducting its votes virtually. 

He said though it was possible to have a completely authentic process, where the entire value chain was locally developed and run, “because the private sector has shown it to be so”, it required budgets that might not be accessible to public institutions, including institutions of higher learning.

“If a student formation wants to audit the system, first they may not have the resources to audit the system because you've got to get a technical company, an IT company with experience.”

“I’m glad that the issue of electronic voting has developed to the extent now where the technicalities are being raised ... It forces the developers to begin to take into consideration the issues that are being raised.”

Sasco president Bamanye Matiwane, who had earlier indicated that the student formation would seek to legally challenge the results, insisted students were not informed nor asked to give consent for their data to be housed outside SA. He accused the university and KDBS of not being transparent.

“What was being given to student formations, through their party agents, were PDF documents that were shared on the WhatsApp groups. When we raised this, after the incident where the service provider issued numbers and recalled them, the university said PDFs could not be edited, and everyone knows that this simply cannot be true,” he said.

Matiwane said there was little detail offered to party agents around how secure the servers were, which he claimed were part of a demo by the US-based election buddy, and that this was critical since in the past two years voting numbers had grown from 6,200 in 2019 to 10,147 in 2020 when online voting was first introduced, to 11,665 in 2021 and 16,795 in 2022.

TimesLIVE