How sensitive information is compromised as street vendors use confidential documents as wrappers

What used to feel like harmless street-smart recycling is now making people uneasy—because behind almost every piece of scrap paper is someone’s private life, unknowingly exposed to the world.

Head of Public Relations and Communication at the Tanzania Personal Data Protection Commission (PDPC), Innocent Mungy, said the Commission insists that personal information must be properly destroyed.

Also read: OPINION: Data breaches: Collective failure is the real scandal

However, dishonest employees are selling such documents, which sometimes end up being used to wrap food—even medicines at some pharmacies.

“We have already issued guidelines to individuals and institutions that collect personal data using hard copies. They are required to establish a proper system for destroying such documents, either by burning or using shredders, once they are no longer needed. We’ve advised them to do so once the documents have served their intended purpose.”

He added that institutions must also develop internal policies outlining how personal data is handled and destroyed after use.

“For example, when a person is asked to submit a copy of their birth certificate, CV, or academic documents, they have a right to know how that information will be used and how it will be destroyed afterwards. Institutions must inform data subjects of the purpose of collecting such data and whether there is an option to return it after use,” Mr Mungy explained.

However, Mr Mungy says that in order for penalties to be imposed, the affected person must first lodge a formal complaint with the Commission.

“There is a complaints mechanism on our website, including contact numbers that people can use to report such incidents. The Commission will only take action if it is proven beyond reasonable doubt that a data breach occurred and that the person reported is responsible.”

He asserted, “The complainant also bears the burden of proof—showing how they were harmed by the data breach. In such cases, the Commission appoints a panel to investigate, determine appropriate fines, and recommend further action. If the offending institution or individual is not registered as a data collector or processor that becomes an additional offence.”

While the problem is widespread, major hotspots for this informal packaging business include Kariakoo and Kisutu, where demand for cheap wrapping materials remains high.

Yet behind the scenes, the supply chain that fuels this trade is more complex—and more concerning—than it seems.

Investigations by The Citizen reveal that the trade is not limited to just retrieving dumped documents from streets or bins.

A growing number of individuals involved in the business are acquiring these papers through more deliberate channels.

Some of them purchase the documents directly from janitors, cleaners, and registry staff in institutions such as schools, hospitals, and government offices.

These insiders, often tasked with maintaining cleanliness or file management, allegedly sell discarded—or even active—documents for as little as Sh1,000 per kilo.

“I have a guy who works in a school in Ilala. He lets me know whenever they’re disposing of old documents. I give him something small, like Sh2,000 or Sh3,000, and he gives me a whole sack. I also get papers from cleaners at some government offices. They don’t care what’s on the paper—only that they get paid,” said one vendor in Buguruni, who requested anonymity.

Others prefer to buy from dealers who collect papers in bulk from printing centres or registry departments in public institutions.

“Some middlemen have deals with school staff or registry clerks. They buy the documents directly and bring them to Kariakoo or Kisutu to resell to vendors like me. The clean papers are more expensive. We pay up to Sh1,800 per kilo, while the dirty ones go for Sh1,000,” said a packaging trader at Tandale-Magharibi, Samia Konje.

This business model has enabled a thriving network of informal traders who wrap food products with little awareness—or regard—for the sensitivity of the materials they use, yet despite the implications, most vendors involved in the trade insist they had no idea the documents contained private information or that using them was illegal.

“We don’t read what’s written on the papers. We just need something to wrap snacks. It’s what’s available and affordable. If clean papers are available, we’ll use those—but this is what we can get for now,” said Fatuma Selemani, who sells cassava in Kisutu market.

A vendor in Ilala, Hussein Rashid added, “We buy whatever we can find. It’s not like we’re stealing anything.”

For consumers, the shock often comes after the transaction. Many recount instances of discovering private details on the packaging of their food.

“I bought roasted groundnuts from a street vendor in Mchikichini, and when I opened the paper, it had a school certificate with someone’s full name, index number, and results. I was horrified. What if that was mine?” said a university student in Dar es Salaam, Brenda Joseph.

Another resident, Hussein Omary from Kinondoni, described seeing a birth certificate used to package maandazi.

“It had everything—name, date of birth, parents’ names. This is a serious national shame,” he said.

However, an advocate, Mr Josephat Lusajo said under Tanzania’s Personal Data Protection Act No. 11 of 2022, which officially came into force on May 1, 2023, the use of personal documents carries serious legal consequences.

According to the Act, disclosing personal data without the subject’s consent is a punishable offence. Individuals found guilty of such breaches face fines ranging from Sh100,000 to 20 million, or imprisonment for up to 10 years, or both. Institutions—such as schools, offices, or printing centres—that allow such leaks can be fined up to Sh5 billion.

Additionally, unlawful destruction, concealment, or tampering with personal data is also an offence.

If no specific penalty is outlined, general offences under the Act attract fines between Sh100,000 and 5 million, or up to 5 years in prison.

Enforcement of the law lies with the Personal Data Protection Commission (PDPC). The Commission can issue warnings, enforcement notices, or penalty decisions if an individual or institution fails to address a reported violation.

Affected individuals also have the right to lodge formal complaints, which the Commission must investigate and resolve—usually within 90 days.

“This is a clear violation of data privacy. Once documents with personal data—like academic records, CVs, or ID numbers—are used publicly without consent, it becomes a punishable offence,” he said.

He added: “But more importantly. The law places the first responsibility on the data controllers—institutions like schools, hospitals, and offices. They are required to securely store or destroy personal data. Dumping it carelessly is a breach of their legal duty.”

The law also mandates secure disposal methods such as shredding or incineration.

“Throwing files in an open bin, where anyone can pick them up and resell them, is negligence—and it’s illegal,” Lusajo emphasised.