The Cyber and Data Protection Act : Implications for Journalists, Human-Rights Defenders, NGOs and Others (Part 1)

Introduction

The Cyber and Data Protection Act [link] was enacted in 2021 with the object of protecting the security of data – which the Act defines to mean, broadly, information held in electronic form in computer systems and databases.  The Act sets up a framework to protect all electronic data and gives particular protection to data that contains personal information about identifiable individuals.  In addition, the Act amended the Criminal Law Code by creating new crimes aimed at preventing the misuse of computers and the data stored in them.

The Act’s objective, stated in section 2, is:

“… to increase cyber security in order to build confidence and trust in the secure use of information and communication technologies …”

It is a laudable objective:  vast amounts of data, including highly sensitive personal information, are held in computer systems and electronic databases in Zimbabwe, and the data must be protected against misuse.  Even though the objective is laudable, however, the Act goes too far in trying to achieve it.  It is drafted in broad and often vague terms, and so are the regulations made under it, as we explained in Bill Watch 40 of 2024 [link].

The scope of the Act is extremely wide.  According to section 4, its provisions apply to “the processing and storage of data wholly or partly by automated means”, and “processing” is defined in section 3 as meaning:

“any operation or set of operations which are performed upon data, whether or not by automatic means, such as … holding the data”.

This means that an organisation which keeps any data on its computer system is regarded as “processing” the data and so must comply with the provisions of the Act.  As we shall explain later in this bulletin, if the data contains personal information such as the names and addresses of customers or members, compliance with the Act is a particularly onerous task.

Furthermore, some of the Act’s provisions, and some of the new computer crimes the Act added to the Criminal Law Code, have potentially chilling effects on freedoms of expression and association, with implications for journalists, human rights defenders and non-governmental organisations [NGOs].  Journalists, who play a frontline role in defending rights by exposing abuses, amplifying community voices and holding power to account, are particularly vulnerable to these provisions.

In this Bill Watch we examine some of the specific provisions of the Act which impact civil society’s ability to handle sensitive information and which may limit the fundamental freedoms of expression and association.

POTRAZ as the Data Protection Authority

Section 5 of the Act designates the Postal and Telecommunications Regulatory Authority of Zimbabwe [POTRAZ] as the data protection authority, which gives it power (under section 6) to “promote and enforce fair processing of data” and, generally, makes it responsible for administering and enforcing the Act.  More specifically, POTRAZ is given power to:

• regulate the way in which personal information can be processed digitally
• lay down the conditions under which all electronic data are processed, and
• conduct inquiries and investigations and, for that purpose, to request the disclosure of any documents.  This power – which in context really means power to demand the disclosure of documents – is particularly worrying because it gives POTRAZ access to virtually all documents, whether electronic or paper, held by an organisation or individual.

POTRAZ can also compel everyone who holds or processes personal information held digitally to take out a licence.  This is laid down in the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 [link];  see Bill Watch 40 of 2024 [link].

Another power that gives rise to concern is contained in section 21(3) of the Act:  POTRAZ may inspect an organisation’s security measures if it considers that the organisation’s processing of personal data will “entail specific risks” to the privacy rights of the persons concerned.  This means that POTRAZ can inspect personal data such as membership lists kept by civil society organisations and NGOs.

Although section 6(2) of the Act states that POTRAZ is not subject to the direction or control of any person while exercising its functions as data protection authority, members of the POTRAZ board are all appointed by the President after consultation with the responsible Minister (see section 6 of the Postal and Telecommunications Act) and the board is obliged to comply with general policy directives given to it by the Minister (see section 25 of that Act).  Hence POTRAZ’s real independence may be open to question.

We are not suggesting that POTRAZ is carrying out its functions as data protection authority in an unreasonable or oppressive manner.  What concerns us are the wide and ill-defined powers the Act gives it as the data protection authority, and the vaguely-worded provisions of the Act which permit intrusive inspections and control of electronic data.  In other words, we are not concerned about the way in which the Act is currently being administered, but rather about the lack of statutory guardrails to prevent undue restrictions being imposed in the future on freedoms of association, expression and the media.

POTRAZ Guidelines

As we have said, the Act and its regulations are drafted in broad and often vague terms, and in an attempt to clarify what they mean POTRAZ has been issuing guidelines explaining such matters as licensing of data controllers, what amounts to consent for the purposes of the Act, and the rules for transferring personal information out of the country.  The guidelines can be accessed on the Veritas website;  see for example those relating to the licensing of data controllers [link].  It is commendable for POTRAZ to try to clarify the legislation, but:

• explanatory “guidelines” are not a proper remedy for the vagueness inherent in the Act.  The Act and its regulations should be amended to clarify them
• guidelines do not have the force of law, even where they are made in terms of the two provisions (sections 20(5) and 30(1)) which specifically authorise POTRAZ to make them
• the guidelines are not always accurate.  For example, the guidelines on licensing state that public entities and Ministries, departments and agencies must take out licences as data controllers.  This is wrong:  statutes generally do not bind the State unless they contain a specific provision to that effect.  There is no such provision in the Act.  Hence Ministries and State agencies such as the Police and the Defence Forces do not have to take out licences with POTRAZ.

Excessively Wide and Onerous Regulatory Burdens

As we indicated earlier, regulations made under the Act require everyone who holds or processes personal information digitally to take out a data controller’s licence.  We emphasise that word “everyone”.  Most commercial, professional and social organisations hold and process personal information of some sort, even if it is only the names and addresses of customers, clients or members, and nowadays they keep the information in digital form.  The phrase “personal information” is defined very widely in the Act, covering even names and addresses of individuals, so all these organisations must take out licences with POTRAZ.

Not only do these organisations have to take out licences, they must also allow their digital records to be inspected by POTRAZ.  This will cause serious difficulties for some organisations – firms of lawyers or medical clinics, for example, whose records contain sensitive and highly confidential information about their clients.

Apart from issues of confidentiality, the requirement to be licensed is particularly burdensome for organisations such as clubs and NGOs which keep their membership lists electronically on computers, because not only do they have to be licensed but they also have to appoint a staff member as their “data protection officer” and notify potraz of the appointment.  They can’t appoint just anyone:  a data protection officer must have skill or experience in data science, information security systems, law or audit, as well as knowledge of the country’s data protection laws and practices.  In addition, the officer must undergo a certification course approved by POTRAZ.

The expense of complying with the Act is not negligible.  A data controller’s licence costs a minimum of US $50, and the fee for enrolling in a data protection officer’s certification course is US $1 250.

Compliance with all this is a tall order, even for large organisations;  for small clubs and NGOs it is virtually impossible.

Handling of Sensitive Data

The Act is particularly concerned about protecting “sensitive data”, which is defined in section 3 to include personal particulars of individuals such as their names, political affiliations, sex life, sexual orientation, criminal history, health, and “any information which may be considered as presenting a major risk to the rights of the data subject” (i.e. the individual concerned).  Generally, the Act prohibits the processing of sensitive data unless the data subject has given written consent to their data being processed (section 11(1)).  There are some exceptions set out in section 11(5) of the Act, but they are very limited.

Journalists, human-rights defenders and NGOs frequently process and publish sensitive data in circumstances where it would be inappropriate to get the data subjects’ consent.  For instance:

• Journalists often report the trials of rapists and other sex offenders – which, if done on computers, entails processing sensitive data concerning the offenders’ sex lives and criminal history.  They should not have to get consent from the accused persons before reporting the trials.
• Journalists and news media sometimes report on the health of public figures, for example where they have been hospitalised or have been injured in a traffic accident.  If this is done on computers, it means processing sensitive data about the health of the data subjects.
• Human-rights defenders publish reports of abuses such as abductions, assaults and unlawful arrests which, if the reports are compiled or published on computers, may mean processing sensitive data about the offenders’ names and political associations.
• Journalists, human-rights defenders and NGOs sometimes publish reports of corruption on the part of public figures, and this usually involves publishing sensitive data about the people involved – at the very least, their names.

In all these cases it would be ludicrous for the journalists, human-rights defenders and NGOs to have to get the consent of the data subjects before publishing their reports – but this is what the Act apparently requires.  If the Act were applied rigorously it would suppress most forms of investigative journalism in Zimbabwe.  Fortunately it has not been so applied, though the heavy-handed arrests of journalists we mention in the next part of this bulletin suggest this may be changing.

[We will continue our discussion of the Act in a subsequent Bill Watch]

Veritas makes every effort to ensure reliable information, but cannot take legal responsibility for information supplied.