Concourt bans bulk Internet surveillance in South Africa

In a landmark judgment handed down on Thursday, the constitutional court banned the South African state from bulk surveillance of online communication, preventing security agencies from hoovering up Internet data.

This sort of surveillance, which is routinely done by agencies such as the National Security Agency in the US and GCHQ in the UK – both of which have routinely tapped into submarine Internet cables – is now illegal in South Africa thanks to the country’s highest court.

The minister of state security had appealed an earlier high court judgment on the legality of bulk communication surveillance. The lower court had already declared bulk surveillance unlawful. The judgment by the constitutional court means the state has run out of legal options and any bulk surveillance is now unlawful and invalid.

The concourt held that section 2 of the National Strategic Intelligence Act of 1994 is ambiguous, and should be interpreted in a manner that best promotes the right to privacy, and does not contradict the prohibition of communication interceptions without interception directions contained in Rica, the legislation that governs the lawful interception of communications.

Aspects of Rica — known formally as the Regulation of Interception of Communications and Provision of Communication-Related Information Act — are also unlawful, the concourt found.

The legislation fails to provide adequate safeguards to protect the right to privacy, as buttressed by the rights of access to courts, freedom of expression and the media, and legal privilege, it said.

Earlier ruling

The judgment upheld an earlier ruling by the high court, which found in favour of investigative journalism outfit amaBhungane and journalist Sam Sole, who had been subjected to state surveillance without his knowledge or without being informed of the surveillance during or after the fact.

The minister of police had argued for the continued prohibition of all post-surveillance notification but the constitutional court held that such a blanket prohibition facilitates the abuse of interception directions, which are applied for, granted and implemented in complete secrecy.

“Even if a direction ought not to have been granted, the subject will never know and is thus denied the opportunity to seek legal redress for the violation of her or his right to privacy,” the court said in an explanatory note to the media. “This renders the rights guaranteed by sections 34 and 38 of the constitution to approach a court to seek appropriate relief for the infringement of the right to privacy illusory and promotes impunity. Post-surveillance notification would serve a purpose comparable to less restrictive means.”

The court concluded that post-surveillance notification should be the default position. Rica is, as a result, unconstitutional in that it fails to provide for notifying a subject of surveillance as soon as this can be done without jeopardising the purpose of surveillance after it has been terminated.

In addition, Rica was found to be in breach of the constitution to the extent that it fails to ensure adequate safeguards for an independent judicial authorisation of interception and to the extent that it lacks sufficient safeguards to address the fact that interception directions are sought and obtained on an ex parte (without the party present) basis. The court left the choice of what measures are most suitable to parliament to fix in the legislation.

The legislation was also found to be unconstitutional to the extent that it fails adequately to prescribe procedures to ensure that data obtained pursuant to the interception of communication is managed lawfully and not used or interfered with unlawfully.

The court acknowledged that the confidentiality of journalists’ sources is protected by the rights to freedom of expression and the media. In relation to the confidentiality of lawyers’ communications, the court accepted that legal professional privilege is an essential part of the rights to a fair trial and fair hearing. These rights were found to weigh in favour of special consideration being given to the importance of the confidentiality of lawyer/client communications and journalists’ sources, in order to minimise the risk of infringement of this confidentiality. Rica’s failure to do so rendered it unconstitutional.

Despite these findings, Rica will remain in force for a period of three years to allow parliament time to develop remedial legislation. However, given that the infringement of the privacy right is “egregiously intrusive”, and the period of suspension is relatively long (three years), the court deemed it necessary to grant interim relief in respect of the notification issue, and the lawyers’ and journalists’ issue.  — © 2021 NewsCentral Media