AHMORE BURGER-SMIDT: Rise of the machines redefines right to privacy

The increased reliance on online services and people’s desire for connectivity cannot but introduce an evolving notion of privacy. In an environment where individuals are shifting activities into cyberspace we need to consider the extent to which this behaviour affects the fundamental rights the SA constitution guarantees. Does this in itself call for the institution of new rights, or could existing human rights be applicable within the online sphere?

The time has arrived to consider how critical privacy and data protection is to the wider effect of developing digital technologies on other interdependent human rights. The UN Human Rights Council and UN General Assembly have reiterated that the “same rights that people have offline must also be protected online”. The council has also repeatedly affirmed the importance of applying a comprehensive human rights-based approach when providing and expanding access to the internet. 

Individuals share thoughts and opinions online, often without restraint. That would suggest attitudes towards privacy and data protection have been recalibrated. This behaviour directly links to fundamental human rights such as freedom of expression and the right to privacy, including the right not to be surveilled.

Enter Rica

SA’s Regulation of Interception of Communications & Provision of Communication-Related Information Act (Rica) was passed in 2002 and came into effect in 2005. It regulates when government can surveil citizens through the interception of their communications. At the same time, its aim is to protect the privacy of communications — with exceptions limited to serious crimes or threats to national security.

Rica was amended during the latter half of 2023 in line with the Constitutional Court judgment on amaBhungane Centre for Investigative Journalism NPC v Minister of Justice & Correctional Services and Others. Considering privacy and concern about surveillance, the following changes were incorporated:

• Provision for the adequate notification of surveillance subjects as soon as notification can be given, without jeopardising the purpose of the surveillance and after surveillance has been terminated;

• Considering ex parte applications sought and obtained, provision has been made for safeguards for interception directions; and

• Procedures have been prescribed to ensure data obtained pursuant to surveillance or interception is managed and not used unlawfully, including a lack of procedures for the processing of the data obtained.

These are important amendments. However, among other requirements Rica also obliges telecommunication service providers to retain data for three years. The judge stated in the amaBhungane judgment that “all of a person’s personal telecommunications, up to three years past, lie in wait for the state to pry into if its officials convince a judicial officer to authorise access”.

The European Court of Human Rights has stated that the European Convention on Human Rights is a living instrument anchored in the reality of the member states in which it applies, a principle that is immediately relevant to the impact of technological changes on society. 

The court has determined that the notion of private life is a broad one, not susceptible to exhaustive definition; that personal data can be defined as any information relating to an identified or identifiable individual; and that public information can fall within the scope of private life where it is systematically collected and stored in files held by the authorities. 

As early as 1984 the European Court of Human Rights provided guidance on the principles governing interception and more general programmes of surveillance in relation to evolving monitoring capabilities. “In particular, the requirement of foreseeability cannot mean that an individual should be enabled to foresee when the authorities are likely to intercept his communications so that he can adapt his conduct accordingly.

“Nevertheless, the law must be sufficiently clear in its terms to give citizens an adequate indication as to the circumstances in which, and the conditions on which, public authorities are empowered to resort to this secret and potentially dangerous interference with the right to respect for private life and correspondence.”

AI and surveillance 

The integration of large-scale data mining and artificial intelligence (AI) facilitates mass surveillance. Steven Feldstein, a senior fellow in Carnegie’s democracy, conflict & governance programme, where he focuses on issues of democracy and technology, says that governments globally “are deploying advanced AI surveillance tools to monitor, track, and surveil citizens to accomplish a range of policy objectives, some lawful, others that violate human rights, and many of which fall into a murky middle ground”.

That means governments must respect, protect and fulfil human rights, and are obliged to ensure they employ “judicial, administrative, educative and other appropriate measures in order to fulfil their legal obligations”. Businesses, particularly in the technology sector, have specific responsibilities when they develop or use technologies with the potential to interfere with the enjoyment of human rights.

Burger-Smidt is head of regulatory at Werksmans Attorneys.