Case Summary and Outcome

The South African Constitutional Court declared various elements of the legislation authorizing interception of communications unconstitutional and invalid. After a journalist learned that his communications had been intercepted, he and an investigative journalism center approached the Court, arguing that the legislation had serious shortcomings and infringed the right to privacy. The High Court held that the law was unconstitutional, and, on appeal, the Constitutional Court confirmed the High Court’s ruling. The Court emphasized that a lack of safeguards within the law prevented oversight and accountability, and the secrecy that covered the interception regime prevented any challenge to orders of surveillance. The Court noted that this secrecy and impunity heightened the risk of abuse and increased violations of the right to privacy.

---

Facts

In 2008, a South African journalist, Sam Sole, believed that his communications were being monitored and intercepted, and, in 2009, approached the Inspector-General of Intelligence in an attempt to determine whether he was under surveillance. The Inspector-General informed him that he “had found the National Intelligence Agency (NIA) and the crime intelligence division of the police not to be guilty of any wrongdoing” which did not confirm whether Sole’s communications were being intercepted – only that the Inspector-General had found no wrongdoing on the part of the state agencies [para. 13].

In 2015, in court proceedings not involving Sole, an affidavit included transcripts of a conversation between Sole and a state prosecutor which demonstrated that Sole’s communications had, indeed, been intercepted in 2008. As a result, Sole contacted the State Security Agency to request details on the interception but, although he was given information on two extensions of interception authorizations, was not told anything about the reason for or lawfulness of the original authorization.

Sole and the amaBhungane Centre for Investigative Journalism then approached the High Court, seeking a declaration that the law which governed interceptions of communications – the Regulation of Interception of Communications and Provision of Communication-Related Information Act, 70 of 2002 (RICA) – was unconstitutional as it did not “provide adequate safeguards to protect the right to privacy” [para. 15].

RICA had been introduced to replace the Interception and Monitoring Prohibition Act,127 of 1992 due to technological developments, and applied to all “oral conversations, email and mobile phone communications (including data, text and visual images) that are transmitted through a postal service or telecommunication system” [para. 7]. Section 2 prohibits interception of communication – unless such interception falls under one of the Act’s processes. Requests for surveillance could only be brought to counter serious offences; threats to the country’s public health or safety; national security or national economic interests; or organized crime and terrorism. All requests were made by application to a “designated judge” – a judge appointed to this position by the Minister of Justice – through an ex parte (“for one party”) application, which meant that there could be no counter arguments made against the state agency’s request.

Section 14 of the Constitution states that “[e]veryone has the right to privacy, which includes the right not to have (a) their person or home searched; (b) their property searched; (c) their possessions seized; or (d) the privacy of their communications infringed”.

In the High Court amaBhungane argued that RICA did not provide for any system of notification – even post-surveillance – to inform the subject of surveillance that they had been subject to surveillance, which meant that a subject would not normally learn of the surveillance and could not challenge the lawfulness of such action. In addition, amaBhungane submitted that by having the designated judge unilaterally appointed by the Minister of Justice with no term limits, and the matter heard ex parte RICA fails to ensure the judge’s independence and “lacks any form of adversarial process or other mechanisms to ensure that the intended subject of surveillance is protected in the ex parte application process” [para. 17]. AmaBhungane highlighted the dangers of RICA not establishing strict parameters for the type and manner of data to be collected and stored, and that there were no specific safeguards for when a journalist or lawyer would be targeted for surveillance. AmaBhungane also submitted that the bulk interception which was being carried out by the “National Communication Centre” was not authorized by RICA and was therefore unlawful.

Three local and international non-governmental organizations – Media Monitoring Africa Trust, the Right2Know Campaign and Privacy International – were admitted as amici curiae.

On September 16, 2019, the North Gauteng High Court ruled that RICA was unconstitutional, finding that the failure to provide for any notification to the subject; the lack of safeguards to protect against the negative effect of ex parte applications and the risk of surveillance of journalists and lawyers; and the compromising of the independence of the designated judge meant that RICA unreasonably and unjustifiably limited the right to privacy. The High Court also held that the management of data under RICA was unconstitutional and that the bulk surveillance undertaken by the National Communication Centre was unlawful. The High Court suspended the declaration of invalidity for two years, to allow Parliament to remedy those defects, but read-in certain provisions to the existing Act as interim relief.

---

Decision Overview

Judge Madlanga (with Khampepe, Majiedt, Mhlantla, Theron, Tshiqi JJ and Mathopo and Victor AJJ) delivered the judgment for the majority. The central issues before the Court were whether RICA was an unjustifiable limitation to the right to privacy and whether there was a legal basis for bulk surveillance in South Africa.

AmaBhungane reiterated the arguments they had made in the High Court – that RICA was unconstitutional as it did not provide for notification to the subject of surveillance; that the designated judge’s independence was compromised; that the nature of the ex parte application process fails to protect the target of surveillance; that specific protections needed to be in place when the targeted subject was a lawyer or journalist; that there were insufficient guidelines in RICA as to how the data should be stored; and that bulk surveillance in South Africa was unlawful in the absence of legislation regulating it.

The State respondents accepted that RICA limited the right to privacy but maintained that the limitation was justified by the purpose and importance of surveillance to “investigate and combat serious crime, guarantee national security, maintain public order and thereby ensure the safety of the Republic and its people” [para. 29]. The Minister of Police added that RICA allows the police to uphold its own obligations under section 205(3) of the Constitution, “to prevent, combat and investigate crime, to maintain public order, to protect and secure the inhabitants of the Republic and their property, and to uphold and enforce the law”. The State respondents also maintained that there were no concerns over the independence of the designated judge who is appointed from the ranks of the judiciary and so presumed to be independent – as the judiciary is independent – and so no further safeguards were necessary. The Minister of State Security argued that bulk surveillance was authorized by the National Strategic Intelligence Act, 39 of 1994 (NSIA) and that RICA provided sufficient safeguards against abuse. NSIA empowers state agencies to “gather, correlate, evaluate and analyse … domestic intelligence; crime intelligence; departmental intelligence; foreign intelligence; foreign military intelligence; and domestic military intelligence” [para. 131].

The Court acknowledged the history of surveillance and national security in South Africa and how, under apartheid, a “skewed notion of national security was weaponised and calculated to subvert the dignity of the majority of South Africans” [para. 1]. It added that although the focus of apartheid-era surveillance was physical, new technology had enabled state agencies to “invade the ‘intimate personal sphere’ of people’s lives” [para. 1] and, with reference to Gaertner v. Minister of Finance 2014 (1) SA 442 (CC), stressed that the right to privacy “embraces the right to be free from intrusions and interference by the state and others in one’s personal life” [para. 2].

In examining RICA’s impact on the right to privacy, the Court described RICA’s interception surveillance as “clandestine” and stressed that individuals communicate on the basis that the content of those communications is private, and that believing they are communicating without intrusion allows individuals to communicate in comfort [para. 23]. With reference to its judgment in Hyandai Investigating Directorate: Serious Economic Offences v. Hyandai Motor Distributors (Pty) Ltd In re: Hyandai Motor Distributors (Pty) Ltd v. Smit N.O. 2001 (1) SA 545 (CC), the Court emphasized that the right to privacy increases as intrusions become closer to individuals’ intimate personal spheres and characterized the RICA case as, “[i]f there ever was a highly and disturbingly invasive violation of privacy, this is it” [para. 24].

The Court acknowledged that the State respondents did not deny that RICA violates the right to privacy and so undertook a limitations analysis in terms of section 36 of the Constitution. Section 36 of the Constitution is a general limitations clause and allows for the limitation of constitutionally-protected rights only in certain circumstances. Section 36(1) states that “[t]he rights in the Bill of Rights may be limited only in terms of a law of general application to the extent that the limitation is reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom, taking into account all relevant factors” including the nature of the right; the importance, purpose, nature and extent of the limitation; the relationship between the limitation and its purpose; and whether there are less restrictive means to achieve the limitation’s purpose.

The Court examined the nature of the right to privacy, and by quoting from the apartheid-era case of Mistry v. Interim National Medical and Dental Council of South Africa 1998 (4) SA 1127 (CC), commented that the right is one of those that guarantees a break from the apartheid police state and so has a particularly important place in constitutional South Africa. The Court also stressed the close links between the rights to privacy and to dignity.

In examining the importance of the limitation, the Court accepted the need to prevent crime and that “interceptions of communications have come to be central to the fulfilment of these obligations” and noted that Botswana, Kenya, Canada and the US all have statutorily-permitted interception of communications [para. 30].

The Court examined the nature and extent of the limitation thoroughly. It noted that the “indiscriminate tentacles of interceptions reach communications of whatever nature, including the most private and intimate” and concluded that – as the communication intercepted can have nothing to do with the reason for the interception and can include “collateral victims” – “the limitation of the right is egregiously intrusive” [para. 31]. With reference to Minister of Safety and Security v. Van der Merwe 2011 (5) SA 61 (CC), the Court asked whether RICA had sufficient safeguards built in to ensure that any intrusions to the right to privacy are done within constitutional limits. It noted that although Chapter 9 of RICA criminalizes interceptions that go beyond its bounds and that the applications before the designated judge had to include a description of the intended surveillance, there were gaps in the protection the Act offered. It referred to the UN Human Rights Committee’s report on RICA in 2015 which had expressed concern about the “relatively low threshold for conducting surveillance … and the relatively weak safeguards, oversight and remedies against unlawful interference with the right to privacy” [para. 36].

The Court undertook a thorough analysis of the arguments raised by amaBhungane on where RICA was constitutionally deficient. The Court provided three examples demonstrating the weakness of the existing system: the interception of the communication of two journalists, Mzilikazi wa Africa and Stephen Hofstatter, who were investigating police corruption and whose surveillance was authorized after the police told the designated judge, incorrectly, that the owners of the phone numbers to be intercepted were ATM bombers; and the fabrication of emails ostensibly obtained through the interception of a businessman’s communications which were then used by the National Intelligence Agency in their attempt to “reveal” certain conspiracies. The Court explained that these examples demonstrate that “blatant mendacity may be the basis of an approach to the designated Judge” and that the judge is then not capacitated to verify the information placed before them [para. 41].

The Court examined the failure of RICA to provide for the notification of a target of surveillance at any stage before, during or after the surveillance. The Court accepted that pre-notification may well defeat the purposes of surveillance but asked whether post-surveillance notification could address the dangers of the impunity caused by RICA while not defeating the purpose of the legislation. Sections 42(1) and 51 of RICA criminalize disclosure and notification of interception directions, and the Court stressed that if there is no knowledge of surveillance then its lawfulness can never be challenged. It added that this lack of accountability “must surely incentivise or facilitate the abuse which we know does take place” [para. 43].

The Court conducted an analysis of foreign laws which require post-surveillance notification, and commented that although there is “no consensus on when and how post-surveillance notification is an absolutely necessary safeguard of the right to privacy, considerable comparative practice supports the conclusion that some form of notice is crucial to minimising abuse” [para. 46]. There is a system of notification within 90 days of surveillance in the US and Canada, and Denmark and Germany require notification if that would not undermine the surveillance’s purpose. The Court referred to the European Court of Human Rights (ECtHR) cases of Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria No. 62540/00, (2007) and Weber and Saravia v. Germany No. 54934/00 (2006) in noting that the ECtHR “links notification to whether it no longer jeopardises the purpose of the surveillance” [para. 47].

The Court noted that, in the present case, the State respondents gave no “cogent reason” why there should not be post-surveillance notification and commented that this was because there could not be “any legitimate reason why the state would want to keep the fact of past surveillance a secret in perpetuity” [para. 48].

Accordingly, the Court held that having no space for redress at the post-surveillance stage, when there would be no prejudice to the purpose of the surveillance, meant that RICA was overbroad, and that a post-surveillance notification would constitute a less restrictive limitation of the right to privacy. The Court commented that this notification would serve two purposes: to allow the subject of surveillance an opportunity to challenge the surveillance; and to disincentivize abuse of the process by State agencies. The Court stated that the default position had to be post-surveillance notification, and that this could only be departed from on the authorization of the designated judge. The Court commented that a possible safeguard that could be adopted by Parliament was an automatic review of interception directions, given that most South Africans simply would not have the financial ability to launch legal proceedings, but stressed that the absence of automatic review did not make RICA unconstitutional.

The Court then examined the question of the independence of the designated judge and emphasized that the existence of safeguards on the judge’s appointment, term and function were “pivotal in assessing whether RICA meets the section 36 threshold” [para. 56]. The Court recognized the State’s arguments that judges are generally expected to act independently, but noted that “this does not mean that Judges are infallible” and that additional measures to protect independence are therefore necessary [para. 89]. The Court criticized the “open-ended discretion” the Minister of Justice has in appointing the designated judge and held that the “designation by a member of the Executive in ill-defined circumstances or circumstances that completely lack description does not conduce to a reasonable perception of independence” [para. 92]. The Court also held that as the appointments were done in secret there was no possibility for external oversight and accountability and that RICA was “unconstitutional to the extent that it fails to ensure adequate safeguards for an independent judicial authorisation of interception” [para. 94].

The Court also held that RICA was unconstitutional to the extent that “it lacks sufficient safeguards to address the fact that directions are sought and obtained ex parte” [para. 100]. The Court recognized that amaBhungane accepted that the purpose of the surveillance would be negated if the subject themselves was notified before the application: the concern was that the designated judge makes the decision based only on submissions from the state agency requesting the surveillance. AmaBhungane maintained that the final, ex parte nature of the applications before the designated judge violated the audi alteram partem [hear both sides] rule and that some adversarial processes needed to be introduced, perhaps by the introduction of a “public advocate” [para. 97]. Like the High Court, the Court did not prescribe the manner in which this constitutional deficient should be remedied and deferred to Parliament.

The Court examined whether RICA contained sufficient safeguards to protect the information that had been intercepted. Section 35 of RICA requires that the Director of the Office for Interception Centres prescribe what information must be kept, but the Court noted that none of the provisions in RICA provided any clarity on what, how and where the data must be stored; how the data would be kept secure; the purposes for accessing the stored data; and the destruction of that stored data. The Court again referred to the ECtHR case of Weber which had set out the “minimum standards for the proper management of surveillance data” and noted that without these standards in RICA there was a risk of abuse [para. 107]. In applying this issue to the limitations analysis, the Court held that RICA had failed to provide for less intrusive measures which made the extent of the limitation of the right “more egregious”, and stressed that there was no relationship between the purpose of surveillance and the lack of safeguards on the protection of the data obtained [para. 108]. Here again the Court reiterated the effect the possibility of litigation would have on deterring abuse and therefore protecting privacy, and commented that information on the actual application, direction and result of surveillance would be vital for any person seeking a review of the interception direction. Accordingly, the Court held that RICA was “unconstitutional to the extent that it fails adequately to prescribe procedures to ensure that data obtained pursuant to the interception of communications is managed lawfully and not used or interfered with unlawfully” [para. 108].

The Court declined to assess the argument raised by Privacy International that the Court should order that state and private bodies be directed by RICA on how to manage data, as this was not correctly before the Court and so was not ripe to be determined.

In examining the question of whether RICA should include specific protections for journalist and lawyer subjects of surveillance, the Court recognized that these groups did not have an absolute right not to have their communications intercepted, but emphasized that the right to freedom of expression protects journalists’ sources and that an interception of lawyer-client communication without recognition of that legal privilege would violate the rule of law. The Court noted that Canada and the UK include legislative safeguards when interception is sought of journalists’ and lawyers’ communications and stated that “the confidentiality of lawyer-client communications and journalists’ sources is particularly significant in our constitutional dispensation” [para. 119]. The Court referred to Khumalo v. Holomisa 2002 (5) SA 401 (CC) and Bosasa Operation (Pty) Ltd v. Basson 2013 (2) SA 570 (GSJ) in respect of protecting journalists’ sources and to Thint (Pty) Ltd. v. National Director of Public Prosecutions, Zuma v. National Director of Public Prosecutions 2009 (1) SA 1 (CC), in reiterating the importance of legal privilege. The Court noted that making allowances for these egregious infringements of the right to privacy would amount to less intrusive measures to both achieve the purpose of surveillance while preventing unreasonable infringements of the right. The Court acknowledged that other professions’ specific rights to confidentiality had not been raised before the Court and declined to make any rulings in respect of the communications of civil society actors. It did refer to the Centre for Child Law v. Media 24 Limited 2020 (4) SA 319 (CC) case which had noted that the “analysis of the right to privacy is even more pressing when dealing with children” but also held that it was not in a position to make a determination on RICA’s regulation of children’s communications [para. 122]. Accordingly, the Court held that RICA is “unconstitutional to the extent that, when the intended subject of surveillance is a practising lawyer or a journalist, it fails to provide for additional safeguards calculated to minimise the risk of infringement of the confidentiality of practising lawyer and client communications and journalists’ sources” [para 119].

The Court then examined the question around the constitutionality of bulk communications surveillance – defined by the Court as “the interception of all internet traffic that enters or leaves South Africa, including the most personal information such as emails, video calls, location and browsing history” [para. 124]. The Court held that section 2 of NSIA was ambiguous, and did not set out the “collection, gathering, evaluation and analysis” of intelligence or how this information be “captured, copied, stored or distributed” [para. 134]. It added that RICA expressly prohibits the interception of communications without direction under RICA. Accordingly, the Court held that bulk surveillance is “unlawful and invalid, as there is no law that authorises it” [para. 135].

Although the Court declared RICA unconstitutional it suspended the invalidity for three years to allow Parliament time to adopt a new law. The Court accepted the concerns of separation of powers in the Court ordering interim relief but held that, given the significant infringements of the right to privacy and the length of time given to Parliament to remedy the defects, “justice and equity dictate that the effect of the intrusive violation of the privacy right be blunted by granting appropriate interim relief” [para. 144]. The Court read in sections to require disclosure that a potential target of surveillance is a journalist or lawyer when an interception application is sought, and that within 90 of the expiry of an interception direction the subject of the surveillance must be notified of that surveillance.

Judge Jafta delivered a minority judgment, disagreeing with the majority only on whether RICA actually did empower the Minister of Justice to appoint the designated judge.

---