Clear Violation of Privacy Laws

I am writing to complain about the intrusive and excessive selfie verification requests when using Capitec’s mobile app. According to your stated policy, selfie authentication is only required for high-risk transactions. However, I am repeatedly prompted for a selfie even for basic actions such as browsing promotional vouchers—an activity that does not constitute a high-risk transaction.

This practice is not only inconvenient but also raises serious concerns about:

Privacy Violation – Unnecessary collection of biometric data contravenes data protection laws, including: 1. Protection of Personal Information Act (POPIA) – Act 4 of 2013 Section 13 (Limitation on Collection) – Personal data must be collected for a specific, lawful purpose (e.g., ***** prevention for high-risk transactions). Requesting selfies for browsing vouchers on the Capitec App definitely exceeds necessity!

Section 14 (Data Minimization) – Banks should not collect more data than needed. If selfies are unnecessary for low-risk actions, this violates POPIA.

Section 18 (Notification of Collection) – Capitec clearly informs us that selfies would be ONLY be required for high-risk transactions.

2. Financial Sector Conduct Authority (FSCA) Regulations Banks must treat customers fairly (Treating Customers Fairly, or TCF principles). Unjustified biometric demands are abusive or coercive.

3. South African Constitution – Section 14 (Right to Privacy)

Capitec's Misrepresentation of Policy – If selfies are only meant for high-risk actions, their use for mundane activities breaches the bank’s own terms.

User Harassment – The frequency of these prompts disrupts the customer experience and feels like undue surveillance.

I request the following actions:

An immediate review of this practice to align with your stated policy.

A clear explanation of why selfies are demanded for non-transactional activities.

Confirmation that my biometric data collected unnecessarily will be deleted.

If this issue is not resolved promptly, I will escalate it to the POPIA Information Regulator and the the Banking Ombudsman.