“It’s important to recognize that you can’t have 100 percent security and also then have 100 percent privacy and zero inconvenience. We’re going to have to make some choices as a society.” Barack Obama, 44^th President of the United States

On 16 May 2024, the General Intelligence Laws Amendment Bill B4-2023 (“Bill”) was passed and sent to the President for his signature. Once signed by the President, the Bill will become “law”.

The Bill contains various proposed provisions and amendments, but of importance are the proposed provisions relating to bulk interception of data and surveillance. The provisions relating to the bulk interception of data and surveillance must be scrutinised and carefully considered as it calls into question, not only national security needs, but indeed individual privacy and civil liberty. The question is how these issues will be balanced against one another when the State wishes to undertake bulk interception of data and surveillance. Society is therefore called upon to form a clear understanding of what the impact of interception of data and surveillance are on their lives in South Africa, while at the same time acknowledging the importance of detecting and preventing terrorism, cyber threats and other serious crimes. This must be evaluated against the backdrop of ensuring privacy protections and the prevention of an  abuse of power by the State. This is especially important after the Constitutional Court has declared various sections of the Regulation of Interception of Communication and Provision of Communication-Related Information Act 70 of 2002 (“RICA“) unconstitutional.[1]

In relation to the bulk interception of data, the Bill provides that –

• an application for bulk interception can only be made by the National Communications Centre (“Centre“) and such an application must be made to and approved by a retired Judge;
• the Judge, when considering an application for bulk interception, must, in addition to South African law, consider applicable international agreements in terms of section 231 of the Constitution of the Republic of South Africa, 1996 and international law including the Universal Declaration of Human Rights;
• an application for bulk interception must set out the reasons for the granting of the application and the period for which the application ought to be granted; and
• procedures must be developed considering principles for the safeguarding of data, including the eight (8) conditions of the Protection of Personal Information Act 4 of 2013 (“POPIA“) for the management of intercepted data.

In relation to surveillance, the Bill provides that “if whilst conducting bulk interception, it becomes necessary to engage in surveillance of a citizen of the Republic of South Africa whether within or outside of the Republic, the Centre must comply with the procedure envisaged in RICA” to obtain the requisite approval.

Even though the Bill provides for a pre-notification procedure for surveillance to take place, it also leaves the door wide open for the notification process to be circumvented. The Bill provides for a pre-notification procedure in that the person who is the subject of the surveillance must be notified in writing and, within 15 days of doing so, the Centre must certify in writing to the designated Judge that the person has been so notified. However, the pre-notification procedure need not be followed when –

• the pre-notification may jeopardise the purpose of the surveillance. However, in such instance, the designated Judge may, upon application by the Centre, direct that the giving of notification be withheld for a period which must not exceed 90 days at a time or two years in aggregate; or
• the pre-notification has the potential to impact negatively on national security. However, in such instance, the designated Judge may, upon application by the Centre, direct that the giving of notification be withheld for such period as may be determined by the designated Judge.

Given the above, while notification to data subjects may not occur at the initial stages of the surveillance, it would seem that provisions are in place to ensure that data subjects will still receive notification, although at a later stage. This delayed notification ensures that individuals are ultimately informed of the surveillance and this could be interpreted as balancing the need for operational security with the right to privacy.

Interception and surveillance legislation are not novel concepts in South Africa.[2] In February 2021, the Constitutional Court delivered a resounding judgement declaring certain sections of RICA unconstitutional and urged Parliament to craft new, alternatively constitutionally sound RICA before the deadline of February 2024 which has now passed.[3]

Amongst others, the Constitutional Court identified the following key reasons for declaring RICA unconstitutional –

• lack of notification in that individuals who were subject to surveillance were not informed when they are/were under surveillance;
• poor data management in that RICA did not ensure the secure management of intercepted data; and
• one-sided hearings in that the designated Judge would only hear the party applying for interception, and not the party who would be the subject of the interception.

Considering the above, it would seem that the Bill was drafted taking guidance from the Constitutional Court judgement. In addition to the pre-notification provisions, it also provides for procedures for the management of intercepted data. This in itself represents a step in the right direction given the shortcomings of RICA.

The Bill reflects a complex interplay between ensuring national security and safeguarding the privacy of those who are subject to surveillance. However, while the Bill aims to equip law enforcement, particularly the Centre, with vital tools to combat emerging threats, it also raises significant potential privacy issues. Consequently, striking the right balance is crucial!

“The way things are supposed to work is that we’re supposed to know virtually everything about what they do: that’s why they’re called public servants. They’re supposed to know virtually nothing about what we do: that’s why we’re called private individuals.” Glenn Greenwald, journalist and author

[1] AmaBhungane Centre for Investigative Journalism NPC and Another v Minister of Justice and Correctional Services and Others; Minister of Police v AmaBhungane Centre for Investigative Journalism NPC and Others [2021] ZACC 3.

[2] To this end, RICA is almost 20 years old given that it was passed in 2005. Furthermore, before RICA, the Interception and Monitoring Prohibition Act 127 of 1992 regulated the interception and monitoring of communications.

[3] AmaBhungane Centre for Investigative Journalism NPC and Another v Minister of Justice and Correctional Services and Others; Minister of Police v AmaBhungane Centre for Investigative Journalism NPC and Others [2021] ZACC 3.