There is no law that authorises bulk surveillance in South Africa.

On Thursday, 4 February 2021, the Constitutional Court handed down a decision which has already received worldwide acclaim. It found in favour of amaBhungane, the investigative journalism organisation, in a landmark case involving the collision between the right to privacy and the right of the state to engage in surveillance.

The court ruled that the Regulation of Interception of Communications and Provision of Communication-Related Information Act (Rica) is unconstitutional in five important respects because it did not provide sufficient safeguards to protect the privacy of citizens. It also confirmed that bulk surveillance is unlawful in South Africa.

The story begins in 2008 when journalist Sam Sole (one of the co-founders of amaBhungane) had some confidential conversations with senior public prosecutor Advocate Billy Downer about the criminal charges then pending against former president Jacob Zuma. Downer was in charge of the prosecution. Sole was doing what investigative journalists do all the time – having discussions with various sources about stories they are working on, many of which are confidential.

Back then, Sole and his colleagues were concerned that they were being bugged by the state, so they wrote to the office of the Inspector-General of Intelligence: if the state had obtained an interception order authorising their surveillance under Rica, this application would have been made before the “designated judge”, being a retired judge appointed under Rica to decide on interception applications. Records would exist.

But the inspector general couldn’t shed any light on the matter, saying it found no wrongdoing on the part of the intelligence agencies, who had acted “within the regulatory framework”. And the crime intelligence division of the police, said the inspector-general, “at no stage abused its powers”.

Fast-forward to 2015. Written transcripts of Sole’s discussions with Downer emerged as attachments to an affidavit filed by Zuma’s then-attorney in the notorious “spy tapes” litigation – a series of cases where Zuma argued that his prosecution was tainted. How had the state motivated for this interception order against a journalist doing his job? How long had Sole’s conversations been recorded and over what period? And where were the recordings now? 

Sole sought answers from the State Security Agency. He submitted a request for details of the interception under the Promotion of Access to Information Act (Paia). Most of the documents which Sole asked for – including the original application for the interception order – were refused by the agency; they were “held for the purpose of intelligence relating to detection, prevention, suppression or curtailment of subversive or hostile activities”. As if to cover its bases, the agency added that “other records which [the agency] may have had would have been discarded or destroyed”.

Still, the Paia process yielded some documentation. Sole was given two interception directions issued by Judge Swart (then the designated judge) in 2008 which extended the original 2007 interception direction for another six months. This meant that Sole’s conversations had been intercepted for many months.

Against this backdrop, Sole and amaBhungane asked the high court to find aspects of Rica unconstitutional. After all, Rica had permitted this egregious invasion of Sole’s privacy and no doubt that of countless others. The high court obliged, and now the finding of unconstitutionality has been upheld by the Constitutional Court.

Justice Mbuyiseli Madlanga, writing for the majority of the court, placed the right to privacy at the heart of the case. In their private conversations, human beings “share their innermost hearts’ desires or personal confidences”, believing that they are doing so only to the person they are communicating with. “Imagine how an individual in that situation would feel if she or he were to know that throughout those intimate communications, someone was listening in or reading them”. Rica plainly infringed this privacy right, and invasively so, because it permits interception of communications regardless of the content, communications that are irrelevant to the purpose of the interception, and it infringes the privacy of the person not under surveillance, who is communicating with the person who is.

Yet the court accepted that, in common with a number of constitutional democracies, the power to intercept serves an important purpose in our democracy: to investigate and combat serious crime, guarantee national security and maintain public order.

The final issue related to bulk surveillance – state monitoring of transnational signals to screen them for certain key words or key phrases. This is the kind of mass surveillance highlighted by the whistle blower Edward Snowden, who leaked information about a National Security Agency bulk surveillance programme sanctioning the collection of millions of US citizens’ telephone records. Until the Constitutional Court ruling, our National Communications Centre had been engaging in the bulk surveillance of our information.

And so, as in all classic constitutional battles, the question becomes one of proportionality, as Madlanga asks: “Is [Rica] doing enough to reduce the risk of unnecessary intrusions?” The court answered that question with a resounding no, upholding all five of amaBhungane’s Rica challenges.

First, Rica does not contain any mechanism to notify the subject of the surveillance that they were under observation, once it is all over. This duty to notify after the surveillance would go a long way to eradicate “the sense of impunity which certainly exists” when applications for interception are made; it would “help disincentivise abuse of the process”. 

Second, the office of designated judges is not independent enough: they are appointed by the minister of justice with the ability to renew their term of office.

Third, applications for interception orders take place without the involvement of any party other than the state. The judge is not in a position to meaningfully question the information. So, said the court, Parliament must come up with safeguards to address these inadequacies (one such safeguard which amaBhungane proposed was the presence of a public advocate). 

Fourth, the court ruled that Rica gives no clarity in relation to what information must be stored, where it must be stored, the security of the storage, the purposes for accessing the information and who may access it, and how and when information must be destroyed. In words that will be celebrated by data protection lawyers familiar with these kinds of arguments, Madlanga concluded that “there is a real risk that the private information of individuals may land up in the wrong hands or even if in the ‘right’ hands, may be used for purposes other than those envisaged”.

And finally, the court accepted that journalists and lawyers fall into a special category – not because they can never be the subject of legitimate surveillance but because additional safeguards are necessary. This is because communications between clients and lawyers are protected by legal privilege, and for journalists, “keeping the identity of journalists’ sources confidential is protected by the rights to freedom of expression and the media”.

Parliament now has three years to get its act together and fix these problems with Rica.

But in the interim, targets of surveillance must, in general, be notified within 90 days of the expiry of the interception order (or its extension). If this rule had been in place at the time, Sole would have found out in late 2008 or early 2009 about his surveillance. And where the target of interception is a journalist or lawyer, these facts must be made known to the designated judge, who must only grant the order if it is necessary, and only then with conditions to protect the confidentiality of the communications that are constitutionally protected. This would have meant that the order against Sole would not have been granted in the first place – it was clearly an abuse of the system.

So, five-love to amaBhungane in its contest with the state. But there was to be yet another stunning victory, this time not related to Rica.

The final issue related to bulk surveillance – state monitoring of transnational signals to screen them for certain key words or key phrases. This is the kind of mass surveillance highlighted by the whistle blower Edward Snowden, who leaked information about a National Security Agency bulk surveillance programme sanctioning the collection of millions of US citizens’ telephone records. And – until the Constitutional Court ruling – our National Communications Centre had been engaging in the bulk surveillance of our information.

Bulk surveillance is not authorised by Rica: indeed – and this was the insurmountable problem for the state – there is no law that authorises bulk surveillance in South Africa. The court thus easily ruled that the practice is “unlawful and invalid, as there is no law that authorises it”. Of course, this does not mean that the government can never engage in bulk surveillance – but if they wish to do so, they must pass a law, and that law will now be tested against the high privacy thresholds for constitutionality that this case sets. 

Edward Snowden responded to the high court judgment in this case in a tweet, simply saying “Wow”. We should all have the same reaction to the decision of the Constitutional Court, and then finally, our surveillance laws would have to take our privacy rights seriously. DM

Dario Milo is a partner at Webber Wentzel, adjunct professor at Wits University and member of the Neuberger High-Level Panel of Legal Experts of Media Freedom. He acted for amaBhungane in the Rica case.