The shared register problem: why a paper visitor book fails a privacy test

What the book gives away

A visitor signs a shared page. The page already holds the names, phone numbers, identity numbers, employers, hosts, vehicle registrations and reasons for visit of everyone who signed before. Each new signer reads all of it. The same pattern appears wherever a desk keeps a book.

The failures go beyond exposure. Handwriting makes entries incomplete or unreadable. Full books sit in drawers or security booths with no retention rule. A page is lost, photographed or removed and nobody knows. Sign-in is separate from host approval, so reception does not know whether the visit was expected. Rural sites without connectivity fall back to paper and are forced into a false choice between continuity and privacy.

The conclusion is plain: the register is treated as administration, but it is a live information security control. It decides who is in a building and who knows it.

Held against the draft Bill

Namibia has no enacted data protection law. The draft Bill on file shows what one would ask. Personal data must be adequate, relevant and not excessive (section 3(3)), accurate and kept up to date (section 3(4)), and kept in identifiable form no longer than necessary, then deleted or de-identified (section 3(5)). Controllers must apply technical and organisational measures to protect against unauthorised access, loss and disclosure (section 18).

Measured against those words, a shared book fails each in turn. It over-collects because the page asks everyone for everything. It cannot delete one visitor’s line without destroying the page. Its security is a drawer. Access rights are also out of reach. A person asking what a building holds about them has a right to confirmation, the purposes, the recipients and a copy, within one month, extendable once with reasons (section 8). A paper book cannot produce a subject-specific copy, and cannot show who has seen the page.

The draft also bans altering or destroying information to defeat an access request (section 39). A book kept in an unlocked drawer makes it hard to prove a page was not removed.

Records are evidence too

Privacy is one half of the problem. The other half is proof. Under section 25 of the Electronic Transactions Act, a court weighing computer evidence looks at how reliably it was generated, stored and communicated, the integrity of the system, and how the originator was identified. Section 24 sets conditions for electronic record retention, including identifiable origin, destination and times.

A paper register does not meet a modern evidentiary test, and an unstructured spreadsheet does not either. The organisation which most needs a reliable record, because an incident happened on site, is the one least able to produce it.

What a better answer looks like

Any replacement should meet six tests. Each visitor’s record is private from the next visitor. Collection is limited to what the purpose needs, and optional items stay optional. Retention is set and enforced. Access to records is limited by role and is logged. A visitor is told, in plain words, what is held and why. The record is producible in a form which shows it is unaltered.

This problem arose in Buffr Checkpoint’s research on visitor management. The research conclusion applies whatever tool an organisation picks, including a well-run paper process with locked, per-visitor slips.

Special cases: clinics, schools and faith-based sites

The draft Bill classes health data, religious belief, trade union membership and criminal records as special categories, prohibited unless safeguards apply (sections 1 and 7). A visitor register at a clinic reveals health information by its mere existence: the name of a visitor beside a ward, a department or a reason for the visit. A register at a faith-based organisation reveals belief. A register at a school involves children, defined in the draft as anyone under 18, whose processing needs parental consent or another listed basis (section 6).

For such sites, the purpose field deserves particular care. A free-text box invites visitors to write what they should not: a diagnosis, a dispute, a name. A short set of categories, such as meeting, delivery, contractor or appointment, collects what security needs without inviting more. The draft’s impact assessment duty for large-scale processing of special categories (section 21) points the same way: if a site cannot say why it needs a field, it should not collect it.

Rebuilding the front desk, step by step

An organisation need not buy software to improve. Start with the book. Replace it with single-use slips, so each visitor writes on their own sheet, which goes into a locked box and never lies open for the next person. Cut the fields to those a purpose needs: name, host, time in and out, and an identity reference only where the site is regulated to check one. Put a short notice at the desk stating who is collecting the data, why, for how long, and whom to ask about it.

Then fix retention. Choose a period, write it on the box, and destroy slips on a schedule, recording the date and who did it. Limit who opens the box. Decide how a visitor’s request will be answered: who receives it, how the slip is found, and how a reply is given within a month. Each step costs little, and together they remove the worst exposures while a longer-term system is chosen.

When an organisation moves to software, the same tests apply and more besides. Ask where records are stored and in which country, because transfers abroad need a documented assessment (section 24 of the draft). Ask who at the supplier sees the records, how access is logged, and how records are deleted at the end of the retention period. Ask for the supplier’s breach procedure, because under the draft a processor must tell its customer without undue delay (section 22(3)).

What goes wrong in practice

Three failures recur. The first is the silent copy: someone photographs the page for convenience and the image lives on a phone. The second is the forgotten archive: old books accumulate in a store room with no review date. The third is the unclear owner: security thinks reception owns the book, reception thinks the facilities manager does, and no one answers a request. Each is a governance gap, and a named owner with a written retention rule closes all three.

What this means for organisations in Namibia

An organisation should audit its own front desk this month. Who is allowed to read the book? Where are old books? Who decides when they are destroyed? Would the organisation answer a request from a visitor within a month?

Where an organisation holds visitor records for security reasons, it should write down the purpose and the retention period, and tell visitors at the point of collection. The draft Bill would require this transparency (section 16), and doing it now costs little.