JILT 2004 (2) - Caroline Ncube
Contents
2. Zimbabwean and South African Constitutional Provisions Relating to Privacy
3. Common Law Protection of Privacy in Zimbabweand South Africa
4. The Constitutional Right to Privacy
4.1 South Africa and Its Socio-Political, Economic and Historical Background
4.2 Zimbabwe and Its Socio- Political, Economic and Historical Background
5. The Common Law Right to Privacy
6.1 Zimbabwe: Access to Information and Protection of Privacy Act
8. Current Data Flows from Europe and Their Economic Significance
A Comparative Analysis of Zimbabwean and South African Data Protection Systems
Caroline Ncube
Lecturer, Department of Commercial Law
University of Cape Town
CNCUBE@law.uct.ac.za
The author would like to thank the two reviewers for their insightful comments and suggestions and Brent Hanks for his editorial work. The author assumes responsibility for all errors within this work.
Data protection is a very important international trade issue and the lack of adequate data protection may be a barrier to trade. Data protection laws are also a vital part of the protection of an individual’s privacy.
This paper is a descriptive analysis of Zimbabwean and South African data protection systems. It compares these two common law systems in a holistic manner taking into account each nation’s peculiar cultural, social, economic and political environments. The most striking feature of both these systems is that they are underdeveloped; Zimbabwe only protects data held and used by the public sector whilst South Africa has no specific data protection legislation at all. There is currently a concerted effort to secure data protection in South Africa spearheaded by the South African Law Commission (SALC).
This paper is a contribution to this law reform process. Its objective is to give a synopsis of the two data protection systems, identify their weaknesses and make suggestions for reform drawn from stronger data protection systems. It proceeds by outlining the constitutional, common law and legislative frameworks regulating data protection in each country, and comparing these with each other and a common ideal. The paper also briefly discusses the current data protection law reform in South Africa and concludes with a forecast of probable developments in both countries.
Keywords: Data Protection, privacy, privacy legislation, Zimbabwean privacy law, South African privacy law, law reform, comparative law.
This is a refereed article published on: 30 November 2004.
Citation: Ncube, 'A Comparative Analysis of Zimbabwean and South African Data Protection Systems', 2004 (2) The Journal of Information, Law and Technology (JILT). <http://www2.warwick.ac.uk/fac/soc/law/elj/jilt/2004_2/ncube/>.
The need to establish and enforce effective data protection systems in both Zimbabwe and South Africa is a trade and development issue. The 1995 European Union Data Protection Directive
( http://www.bfd.bund.de/europa/EU_richtl_en.html>) imposes a standard of protection on any country in which the personal data of European citizens is processed. Such data can only be processed in countries that can guarantee adequate levels of protection (Articles 25 -6).
Developing nations, especially those in Africa, as evidenced by their recent establishment of NEPAD,[1] intend to be full participants in the global economy. Such participation will only be enabled by conducive trade conditions. Zimbabwe and South Africa, like all other developing nations therefore need to ensure that their data protection laws encourage rather that discourage international trade by providing adequate levels of data protection to enable the flow of data from European Union (EU) countries.
The adequacy of these systems will ultimately lie in their application and enforcement. This paper will accordingly also discuss enforcement structures and procedures.
The substantive part of this article is divided into five parts. The first part compares Zimbabwean and South African constitutional provisions relating to privacy. The second part discusses the common law protection of privacy in both jurisdictions. The third part analyses the legislative frameworks in each country. The fourth part examines oversight and enforcement of these laws. The fifth and final part concludes the paper with an overall assessment of each country and a forecast of probable future developments.
2. Zimbabwean and South African Constitutional Provisions Relating to Privacy
The right to privacy is widely considered a fundamental human right. It is provided for in Article 12 of the 1948 Universal Declaration of Human Rights and in other international instruments, such as Article 16 of the United Nations Convention on the Rights of the Child, Article 17 of the International Covenant on Civil and Political Rights (ICCPR) and Article 14 of the United Nations Convention on Migrant Workers. The American Convention on Human Rights (Art 11, 14) and the American Declaration of the Rights and Duties of Mankind (Art V, IX and X) contain provisions similar to those found in the Universal Declaration and International Covenant (SALC IP24 at 3.1.3 – 3.1.6).
A number of countries (like the United Kingdom) also protect the right to privacy under the rubric of general human rights legislation. Others such as South Africa (section 14 of the Constitution of South Africa Act 108 of 1996 (as amended)), the Kingdom of the Netherlands (Constitution of the Kingdom of the Netherlands, 1989), the Republic of the Philippines (art III, Constitution of the Republic of the Philippines, 1987), and the Russian Federation (art 23, Constitution of the Russian Federation, 1993) explicitly enshrine the right in their constitutions. The United States stands apart from these countries insofar as its Constitution does not contain an explicit right to privacy. Despite this the Supreme Court of the United States has concluded that such a right is implicit in the Constitution (Hammit 1998) and most Americans consider privacy a core value (Lloyd L R 1995).
Despite the widespread protection that it is offered in international instruments and constitutional provisions, ‘privacy’ is however a term that is inherently difficult to define and its definition varies widely (Electronic Privacy Information Center (EPIC) Report 2002 p2.). Recognizing this the South African Constitutional Court recently characterized the concept as both ‘amorphous and elusive’ (Bernstein and others v Bester and others NNO (Bernstein v Bester) 1996 (2) SA 751 at 787-788), but chose to offer forth a definition of privacy nonetheless as ‘an individual condition of life characterised by exclusion from the public and publicity. This condition embraces all those personal facts which the person concerned has determined himself to be excluded from the knowledge of outsiders and in respect of which he has the will that they be kept private’ (Bernstein v Bester at 789).
The Supreme Court of Zimbabwe has not yet had occasion to define privacy in the context of the protection of personal information. Nor does the country’s constitution provide explicit provisions for the protection of an individual’s right to privacy.
3. Common Law Protection of Privacy in Zimbabwe and South Africa
In order to evaluate the common law protection offered privacy in both countries it is important to adopt an interdisciplinary, comparative law approach that takes into account the specific cultural, socio- political and economic factors that impact the manner in which law is applied and enforced in Zimbabwe and South Africa (Reitz, JC; 1998, Webb 2003). This paper therefore employs the methodology most recently utilized by Philippa Webb and originally formulated by legal analyst JC Reitz (1998, p. 622, 634) and compares each country’s data protection systems to one another before comparing them to a common ideal.
On the whole there is scant academic literature on the data protection laws of South Africa and Zimbabwe, although a detailed issue paper on South Africa’s data protection laws was recently released by the SALC (Issue Paper 24 ‘Privacy and data protection (IP 24)). There is an impressive body of literature on the historical, economic and socio-political climates of both countries online and in print. This paper will refer extensively to the online literature in order to enable readers to easily view the materials, should they wish to do so. This literature includes reports and articles by civic organisations, government information, media reports and survey and poll findings. There is also a large body of scholarship regarding matters of privacy in South Africa dating back as far as 1979. Of particular import are the materials dating from the mid 1990s onwards. However, much of this literature was originally produced in Afrikaans, so translations of the originals are relied on throughout this paper. The reader will also find that many Roman-Dutch phrases are used in the discussions of common law concepts, but every effort is made to concisely explain these terms.
The Ideal
This section outlines the ideal against which both data protection systems will be compared. The following four models of data protection were considered (EPIC Report 2002 p3; SALC IP24 at 7.1.3):
a) Comprehensive Laws Model
This model is characterised by a general law that governs the collection, use and dissemination of personal information by the public and private sectors. An oversight body then ensures compliance. Industry develops rules for the protection of privacy that are enforced by the industry and overseen by the private agency. This model, adopted by the European Union to ensure compliance with its data protection regime, is the preferred model for most countries adopting data protecting laws (SALC IP24 at 7.1.4, 7.2.1-7.2.36, EPIC Report 2002 p4).
b) Sectoral Laws Model
This model does not have a general law like the comprehensive model but has sectoral laws governing, for example, financial privacy. In such cases, enforcement is achieved through a range of mechanisms. It has been adopted by the United States but has been criticised on a number of grounds. The first of these being the fact that it requires new legislation be introduced with each new technology and consequently protections frequently lag behind technological advances and actual practice. An example of this shortcoming is the lack of legal protection for individual privacy on the Internet in the United States. The second major criticism is the lack of an oversight agency, which compromises the effectiveness of the laws. In many countries, sectoral laws are used to complement comprehensive legislation by providing more detailed protection for certain categories of information, such as telecommunications, police files or consumer credit records (SALC IP 24 at 7.1.5, 7.2.37 -7.2.43; EPIC Report 2002 p4).
c) Self-Regulation Model
The essence of this model is the protection of data through various forms of self-regulation. Companies and industry bodies establish their own codes of practice and engage in self-policing. Within the United States, this model has not been very effective and there is little evidence that the aims of the codes are regularly fulfilled. Additionally, these codes are often inadequate and are not efficiently enforced (SALC IP24 at 7.1.6, 7.2.44- 7.2.70; EPIC Report 2002 p4).
d) Technology Model
Under this approach, due to the recent development of commercially available technology-based systems, data protection is in the hands of individual users. Individual users of the Internet and of some physical applications can employ a range of programs and systems that provide varying degrees of privacy and security of communications, for example encryption, anonymous remailers, proxy servers and digital cash (SALC IP24 at 7.1.7, 7.2.71 – 7.2.81, EPIC Report 2002 p4).
Principles of Data Protection
The following international documents contain both clear basic principles of data protection and also serve as influential models of national and international initiatives on data protection (Bygrave LA 2002 p30, SALC IP24 at 1.2.22):
a) The Council of Europe’s 1981 Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data (<http://www.coe.fr/eng/legaltxt/108e.htm>);
b) The 1981 Organisation for Economic Cooperation and Development’s (OECD) Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data (<http://www.oecd.org/documentprint>);
c) The 1995 EU Data Protection Directive; and
d) The United Nations’ (UN) Guidelines Concerning Computerised Personal Data Files
(< http://europa.eu.int/comm/internal_market/privacy/instruments/un_en.htm>).
The COE Convention (a) and the OECD Guidelines (b) have had a profound effect on the global enactment of data protection laws. Almost thirty countries have signed the COE convention and the OECD guidelines have been widely used in national legislation, even outside the OECD member countries (SALC IP24 at 1.2.14). The OECD Guidelines provide eight principles relating to the collection, purpose, use, quality, security and accountability of organisations in relation to personal information.
The EU Directive was enacted to harmonise member states’ laws in providing consistent levels of protection for citizens and ensuring the free flow of personal data within the European Union (SALC IP24 at 1.2.16-17). The UN Guidelines are intended to encourage those UN Member States without data protection legislation in place to take steps to enact such legislation and to encourage governmental and non-governmental international organisations to process personal data in a responsible, fair and privacy-friendly manner. The Guidelines are not legally binding and seem to have had much less influence on data regimes than the other instruments (Bygrave LA 2002 p33, SALC IP24 at 1.2.19).
Although the expression of data protection in the above declarations and laws varies, they all set the common minimum standard that personal information must be:
• collected fairly and lawfully;
• used only for the specified purpose for which it was originally collected;
• adequate, relevant and not excessive to purpose;
• accurate and up to date;
• accessible to the subject;
• kept secure; and
• destroyed after its purpose is completed. (SALC IP24 at 1.2.23).
These minimum standards together with the comprehensive laws model outlined above will comprise the ideal against which the data protection systems of South Africa and Zimbabwe will be compared.
4. The Constitutional Right to Privacy
4.1 South Africa and Its Socio-Political, Economic and Historical Background
The South African constitution provides that the country is a constitutional democracy and any law or conduct inconsistent with its constitution is invalid (section 2). Chapter 2 of the constitution or the Bill of Rights provides for certain fundamental rights applicable to all law, including the common law relating to the right to privacy, and binds not only the State (section 8(1)) but also, if applicable, natural and juristic persons (section 8(2)).
For nearly all the latter half of the twentieth century the National Party governed South Africa. It was only in 1994 the first democratic elections were held in the country under an Interim Constitution. The African National Congress (ANC) has since led the government and has been opposed by numerous political parties, including the New National Party (NNP), the Inkatha Freedom Party (IFP) and the Democratic Alliance (DA). Together these parties have sought to move beyond the racial discrimination and political violence that characterized the period prior to 1994 and have for the last decade been engaged in the pursuit of democratisation, socio-economic change and reconciliation. The constitution-making process, local government elections and the establishment of the Truth and Reconciliation Commission have been vital components of their efforts.
The interim constitution referred to above was itself the result of a volatile and protracted struggle between the NP-led apartheid government and its opponents. It came into force on 27 April 1994 and led to a number of revolutionary changes in South Africa. First, it ended racial discrimination by according all fundamental (human) rights to all citizens. Second, it converted South Africa from parliamentary sovereignty to constitutional sovereignty. Third, it replaced the central government system with a federal one. Additionally, the interim constitution provided for the drafting of a final constitution by the Constitutional Assembly in accordance with a number of democratic constitutional principles. Once drafted, the final constitution was to be certified by a Constitutional Court. Although the initial application for certification (1996) failed, a second application was formally approved in 1997, with the Bill of Rights in the Final Constitution substantially similar to the one included in the Interim Constitution (De Waal et al 2000 p1-7).
4.1.1 Content
The right to privacy is entrenched in Section 14 of the Bill of Rights, which reads:
Everyone has the right to privacy, which includes the right not to have –
(a) their person or home searched;
(b) their property searched;
(c) their possessions seized; or
(d) the privacy of their communications infringed.
This section has two parts, the first of which guarantees a general right to privacy and the second protects against specific infringements of privacy, namely searches and seizures and infringements of the privacy of communications (De Waal et al 2000 p267, SALC IP24 at 3.2.6). Even though not explicitly mentioned within the language of the section these protections extend to the breach of informational privacy. (Mistry v Interim Medical and Dental Council of South Africa and others1998 (7) BCLR 880 (CC) at para 14 ). Therefore, the list mentioned in section 14 is by no means exhaustive. It extends to any other unlawful method of obtaining information or making unauthorised disclosures. (SALC IP24 at 3.2.8).
For convenience the constitutional right to privacy can be thought of as protecting privacy against the following (SALC IP24 at 3.2.11, De Waal et al 2000 p270):
(a) intrusions and interferences with private life;
(b) disclosures of private facts; and
(c) infringement of autonomy.
Informational privacy, the subject of data protection laws, is covered by both (a) and (b) above.
The right to privacy is not absolute though, it can be limited in accordance with the limitation clause (Section 36) of the Bill (Neethling et al 2002 p19, SALC IP24 at 3.2.21) that requires a careful weighing up of the right to privacy and other opposing interests or rights. Data privacy legislation will therefore have to find a balance between the data subject’s fundamental right to privacy as set out in section 14 of the Constitution on the one hand, and on the other hand, the legitimate need of other persons to obtain information about the data subject (SALC IP24 at 3.2.22). These needs may be based on the person or institution’s fundamental right to choose their trade, occupation or profession freely (section 22); their fundamental right to access to information (section 32); or their fundamental right to freedom of expression (section16) as well as other legitimate interests or rights.
4.2 Zimbabwe and Its Socio- Political, Economic and Historical Background
Zimbabwe, like South Africa, is a constitutional democracy. Section 3 of the Zimbabwean Constitution mandates that the constitution is the supreme law and any law that is inconsistent with it is void to the extent of the inconsistency (< http://www.nca.org.zw/html/coz/coz_fs.htm >). For much of the twentieth century Zimbabwe was known as Southern Rhodesia and was an official colony of Great Britain. This began to change in 1965, when the Prime Minister of Southern Rhodesia, Ian Smith, in an effort to thwart the British government’s call for black majority rule unilaterally declared independence from Great Britain. Smith’s declaration angered the British who considered the declaration illegal and unconstitutional and promptly cut all ties with the colony and coerced the United Nations into imposing sanctions on Smith’s government.
At this time the black liberation movement led by the African nationalist Zapu and Zanu parties decided to take up arms against those in government opposed to majority rule in Southern Rhodesia. By the late 1960s they had become increasingly involved in violent clashes with official Rhodesian security forces and South African forces supporting the Smith regime’s counter-insurgency efforts (BBC News Zimbabwe’s History: Key Dates <http://news.bbc.co.uk/1/hi/special_report/1998/12/98/zimbabwe/226542.stm>).
The government of Southern Rhodesia eventually declared itself a republic in 1970 and constitutional settlement talks between the warring parties began in earnest a few years later. However, they were unsuccessful until 1979, when a settlement was finally reached, leading to the creation of a new constitution (the Lancaster House Constitution), transitional arrangements, a ceasefire, an election, and the eventual renaming of Southern Rhodesia to Zimbabwe in 1980 (Southern Rhodesia Constitutional Conference Held at Lancaster House, London September - December 1979 Report <http://home.wanadoo.nl/rhodesia/lanc1.html >). Robert G. Mugabe has led the government of Zimbabwe since that time, first as Prime Minister (1980 -1987) then as Executive President (1987 to the present).
For most of the 1980s Zimbabwe was plagued by political violence and the deaths of thousands of people. Only after the formation of a government of national unity in 1988 brought a cessation to the hostilities and opened the path to elections in 1990, 1995, 2002 and 2003. (Legal Resources Foundation (LRF), Catholic Commission for Justice and Peace (CCJP) Breaking the Silence, Building True Peace: A report on the disturbances in Matabeleland and the Midlands 1980 – 1989: Summary Report < http://www.zwnews.com/Breaking.doc>). In each instance, Mugabe’s ZANU party was triumphant. However, the last round of elections was widely condemned as unfair by both Zimbabweans and the international community (Helen Suzman Foundation ‘Political Opinion in Zimbabwe 2000’< http://www.hsf.org.za/Zimsurvey/zimdoor.html> ;World press review online ‘Zimbabwe: Press Spars over Election Results’<http://www.worldpress.org/africa/0314zim.htm>).
Prior to 1999 much of the political violence in Zimbabwe stemmed from political feuds over the Lancaster House Constitution. So beginning that year a concerted effort began to be made to replace it with a new Constitution. A government-appointed Constitutional Commission eventually prepared a new draft Constitution that was submitted to the state president in December 1999 (<http://www.gta.gov.zw/Constitutional/Draft.Constitution.htm>). A constitutional referendum followed on February 12-13, 2000. The National Constitutional Assembly (NCA) and other prominent civic organisations in Zimbabwe campaigned intensively and successfully against the new draft Constitution and in the end a majority of the people of Zimbabwe voted against it (Kambudzi 2000). The NCA then proceeded to draft its own constitution (<http://www.nca.org.zw/html/fdraft/fdraft_index.htm >), one that it argues is more suitable than the rejected draft. Suffice to say the government of Zimbabwe has not pursued any further constitutional reform since its draft was rejected but civic organisations continue to agitate for reform. The most noteworthy aspect of the NCA’s draft constitution, for the purposes of this paper, is that it includes in its bill of rights an express right to privacy (section 20).
4.2.1 Content
Although there is no explicit constitutional ‘right to privacy’ in Zimbabwe, there is however various elements of the right to privacy that can are found in different sections of the constitution. The first of these is found in section 17, which provides for protection against arbitrary search or entry. The second is found in section 16, which provides for protection against deprivation of property. The third of these elements is found in section 20(1), which provides for protection of freedom of expression and reads:
Except with his own consent or by way of parental discipline, no person shall be hindered in the enjoyment of his freedom of expression, that is to say, freedom to hold opinions and to receive and impart ideas and information without interference, and freedom from interference with his correspondence (emphasis added).
The right to privacy can accordingly be inferred from these sections. Additionally, Section 24 of the constitution provides that when a person alleges that the Declaration of Rights is being, or is likely to be infringed, that person may apply to the Supreme Court for redress. The Zimbabwean situation is then somewhat similar to that in the US where privacy, although not explicitly protected by the Constitution, can nonetheless be considered a core and constitutionally protected value. However, unlike the United States to date there is no case law on data protection in Zimbabwe.
In both South Africa and Zimbabwe the constitution clearly lays a foundation for data protection laws by protecting a person’s right to privacy. Moreover, the rights enunciated in each Bill of Rights are fully justiciable and enforceable. Additionally, other fundamental rights have been enforced in the courts and one can justifiably argue that the right to informational privacy is likely also to be enforced in the near future. However, despite the fact that each Bill of Rights lays an adequate foundation for the protection of informational privacy both need to be supplemented by specific legislation. Having said that, of the two, South African constitutional provisions are clearly better suited to the task. The main reason for this being that from the time of independence Zimbabweans have been predominantly concerned with those rights pertaining to pressing political and economic issues such as the rising cost of living. Subsequently, issues such as data protection have been largely overlooked. The South African constitution was also drafted in the late 1990s as the Internet began maturing. Moreover, its drafting benefited from lengthy and informed citizen debate and was able to incorporate and draw extensively from the experiences and knowledge of other jurisdictions.
5. The Common Law Right to Privacy
Zimbabwean and South African common law is the same. Roman- Dutch Law has heavily influenced both countries. Section 89 of the Zimbabwean constitution provides that:
Subject to the provisions of any law for the time being in force in Zimbabwe relating to the application of African customary law, the law to be administered by the Supreme Court, the High Court and by any courts in Zimbabwe subordinate to the High Court shall be the law in force in the Colony of the Cape of Good Hope on 10th June, 1891, as modified by subsequent legislation having in Zimbabwe the force of law.
Clearly, the common law of Zimbabwe derives from the common law of South Africa. And under the common law every person has personality rights such as the rights to physical integrity, freedom, reputation, dignity, and privacy (SALC IP24 at 3.1.16, Neethling 1998 at 64, 103, 137, 157, 233, 265).
The leading case for the recognition of an independent right to privacy in South African law is O'Keeffe v Argus Printing and Publishing Co Ltd and others (1954 (3) SA 244 (C)) wherein dignitas was interpreted to include the whole legally protected personality, except bodily integrity and reputation (SALC IP24 at 3.1.17). Privacy is included in this genre, although the court did not expressly state this (SALC 3.1.18). Later Zimbabwean cases have reached similar conclusions (Mr. and Mrs. “X” v Rhodesia Printing and Publishing Co Ltd 1974 (4) SA 508 (R) at 511- 512, Rhodesian Printing and Publishing Co Ltd v Duggan 1975 (1) SA 590 (RA) at 592). The South African Constitutional Court (Gosschalk v Rossouw at 490-49, Bernstein v Bester at 789) has itself endorsed such a contention and the express constitutional recognition of the right to privacy in Section14 of the South African Constitution, independent of the right to dignity in Section 10, confirms the independent existence of the right to privacy. It bears repeating that only the legitimate interests of others and the public interest may limit the common law right to privacy (SALC IP 24 at 3.2.21, Neethling 1998 p288 ff).
South African common law has been developed by the enactment of the Constitution (section 39(2)). Therefore, any action resulting in the infringement of privacy in South Africa is now considered a hybrid action based on a mixture of common law and constitutional imperatives (McQuoid-Mason 2000 p261, SALC IP24 at 3.3.3). Under common law a single inquiry is required to assess whether or not there has been an unlawful infringement of privacy, whereas under the Constitution it is a twofold inquiry (SALC IP24 at 3.3.5). Under common law, to succeed, a plaintiff needs to prove the following:
(i) An invasion of the his privacy in the form of disclosure or revelation of his personal information (SALC IP24 at 3.3.7- 3.3.10);
(ii) Wrongfulness, which is determined using the criterion of reasonableness or the norm of boni mores (SALC IP 24 at 3.3.11 3.3.27); and
(iii) Intention (animus iniuriandi) (SALC IP24 at 3.3.5. 3.3.28 -3.3.32)
In the case of a constitutional invasion of privacy the applicant must prove that:
(a) Invasive law or conduct has infringed his right to privacy in the Constitution (Woolman 1996); and
(b) Such infringement is not justifiable in terms of section 36 of the Constitution.
Defenses to the common law action are categorised into two main groups, namely those excluding wrongfulness and those excluding intention. Examples of defenses excluding wrongfulness include consent, necessity, private defense, impossibility, public interest and performance in a statutory or official capacity. Examples of defenses excluding intent include jest, mistake, insanity or intoxication (SALC IP24 at 3.3.42 – 3.3.60). The generally accepted main remedies for common law invasions of privacy are (SALC 3.3.60, Neethling 1998 p304-305):
(i) The actio Iniuriarum (recovery of sentimental damages or satisfaction (solatium) for injured feelings. The amount of compensation is in the discretion of the court and is assessed on what is fair and reasonable (Jansen van Vuuren and others NNO v Kruger 1993 (4) SA 842 at 857-858);
(ii) The actio legis Aquiliae (damages where the plaintiff has suffered actual monetary loss as a result of the violation of privacy);
(iii) The interdict where a person is confronted with a threatening or continuing infringement of his or her right (Rhodesian Printing and Publishing Co Ltd v Duggan and others 1975 (1) SA 590 (Rhodesian Appellate Court)); and
(iv) Retraction and apology (Mineworkers Investment Co (Pty) Ltd v Modibane 2002 (6) SA 512 (W)).
Section 38 of the Constitution provides that in the case of an infringement of or threat to the right to privacy as a fundamental right, the prejudiced or threatened person is entitled to approach a competent court for appropriate relief, including a declaration of rights.
Assessment
Effective common law data protection, based on general principles, can be achieved only through a two-pronged approach (Neethling 1998 p328, SALC IP24 at 3.4.1). The first rung of this approach, common law, as influenced by the Constitution, should be fully utilised. However, ‘the inherent conservatism of the courts’, and the fact that the protection of privacy is still very underdeveloped in South African law will mean that the courts will not adequately protect privacy. Consequently, the matter will have to be regulated by legislation (also Neethling 2002 p589).
The second rung of this approach is that the individual himself should have and exercise a measure of active control over his personal data, otherwise the common law protection of data will be ineffective.(Neethling 1998 p334-337). This active control over personal information can be based on the common law and the Constitutional Court’s recognition of the fact that the right to privacy encompasses the competence of a person to control his private facts or the scope of his interest in his privacy (SALC IP24 at 3.4.3, Neethling 1998 p39; National Media Ltd and others v Jooste 1996 (3) SA 262 A 271-2.at 271-272; Investigating Directorate: Serious Economic Offences v Hyundai Motor Distributors (Pty) Ltd ao; In re Hyundai Motor Distributors (Pty) Ltd and others v Smit NO and others 2001 (1) SA 545 (CC) at 557).
However active control principles, or principles of data protection, differ completely from common law privacy protection as discussed above and accordingly are unique in the field of personality protection. Legislation is accordingly the best vehicle through which principles of data protection can be provided (SALC IP24 at 3.4.3).
6.1 Zimbabwe: Access to Information and Protection of Privacy Act
The parliament of Zimbabwe recently enacted the ‘Access to Information and Protection of Privacy Act’ (AIPPA) (Chapter 10:27). This act came into operation on 15 March 2002 precisely at a time when public participation in the political process and incisive media reporting on government activities had reached previously unprecedented levels. The act was viewed in civil society circles largely as a weapon to be used against journalists and most legal analyses of the act have accordingly concentrated on the provisions of the act relating to the regulation of journalists and the mass media (Media Institute of Southern Africa (MISA) Action Alert 15/10/2003< http://www.misa.org/node/view/58>; Amnesty International Canada ‘Zimbabwe Rights under siege’< http://www.amnesty.ca/zimbabwe/actKarombo.htm >). Unsurprisingly, its provisions relating to informational privacy have attracted far less attention. In a memorandum accompanying the bill the Parliament of Zimbabwe provided the following justification for the passing of the act: information plays a “critical role…in a constitutional democracy and… can be used usefully or harmfully”.
The AIPPA applies to all matters relating to access to information, protection of privacy and the mass media. It both complements existing laws relating to these matters and prevails over those that are found to be inconsistent with its provisions (Sec3 (1) and Sec 3(2)). Furthermore, it applies to all records in the custody or under the control of public bodies in Zimbabwe. There are however exclusions listed in the First Schedule, which range from personal notes, communications or draft decisions of a person who is acting in a judicial or quasi-judicial capacity to records containing teaching materials or research information of employees of a post-secondary educational body (Section 4(1)).
The AIPPA provides for the following:
1. Access to records and information held by public bodies (Sections 5 – 13);
2. Protected information (Sections 14- 25);
3. Information pertaining to third parties (Sections 26 -28);
4. Collection, protection and retention of personal information by public bodies (Sections 29-35);
5. Use and disclosure of personal information by public bodies (Sections 36 – 37);
6. Regulation of the mass media and journalists (Sections 38- 90); and
7. Appeals to administrative court and other general matters (Sections 91 – 93).
This paper is specifically concerned with (4) and (5) above and aspects of the sections they concern are discussed in more detail below.
Collection
Section 29 provides that a public body may only collect personal information if the following conditions are satisfied:
(a) The collection of that information is expressly authorized in terms of an enactment;
(b) The information is to be collected for the purposes of national security, public order and law enforcement;
(c) The information is to be collected for the purposes of public health;
(d) The information relates directly to and is necessary for an operating programme, function or activity of the public body; and/or
(e) The information will be used to formulate public policy.
Except in two specific circumstances personal information must always be collected directly from the person to whom it relates. An exception can be made in the case that collection from another source is authorized by the individual concerned, the Media Commission (Commission) or another enactment (section 30 (1) (a)). Exceptions can also be made in the case that the collection of personal information is related in some way to the following activities: the enforcing of laws, the proceedings before courts or judicial/quasi-judicial tribunals, the granting of honours or award (including an honorary degree, scholarship, prize or bursary), the collection of debts or fines, and the making of payments (Section 30 (1) (b)).
The public body collecting personal information must inform a person from whom it intends to collect personal information of the purpose for which the personal information is being collected and the legal authority for collecting it (Section 30(2)), except where the information relates to law enforcement and/or the Commission exempts it from making such notification. Such exemptions may be granted if the notification would result in the collection of inaccurate information, or defeat the purpose of, or prejudice the use for which, the information is to be collected (Section 30(3)). Furthermore, under the act, any individual required to supply to a public body personal information or information relating to a third party who knowingly supplies information to that body which he or she knows to be false and/or does not have reasonable grounds for believing to be true shall be guilty of an offence and liable to a fine or to imprisonment for a period not exceeding six months or to both such fine and such imprisonment (Section 35).
Accuracy
Section 31 of AIPPA provides that a public body using an individual’s personal information must take every reasonable step to ensure that the information collected is both accurate and complete. A person may request the head of a public body to correct any information relating to him/herself that he/she reasonably believes contains an error or omission (Section 32 (1)). Upon receipt of such a request the head of the public body concerned must correct or annotate the personal information on the record pertaining to the person making the request (Section 32(2)). After such a correction, the head of the public body must then notify the correction to any other public body or any third party to whom that information has been disclosed during the last twelve months (Section 32(3)).
Security
Section 33 provides that the head of a public body should protect personal information that is under his custody or control by taking reasonable steps to ensure that there is adequate security and there is no unauthorised access, collection, use, disclosure or disposal of such personal information.
Use and Retention
If a public body uses an individual’s personal information to make a decision that directly affects the individual, the public body must retain that information for at least one year after using it so that the individual has a reasonable opportunity to have access to it (section 34). And a public body may only use personal information for the purpose for which that information was obtained or compiled or for a use consistent with that purpose or if the person to whom the information relates has consented (section 36).
Disclosure for Archival or Historical Purposes
The National Archives, or the archives of a public body, may disclose personal information to a third party for the purpose of historical research or any other lawful purpose if such disclosure would not result in an unreasonable invasion of personal privacy in terms of the Act or the information being released pertains to a person who has been deceased for thirty or more years (section 37).
Like Zimbabwe South Africa does not have specific data protection legislation in force, although certain provisions of the Promotion of Access to Information Act and the Electronic Communications and Transactions Act do have provisions relating to data protection. These provisions are however regarded as interim measures and will only stay in force until more specific data privacy laws are formulated and implemented (SALC IP24 at 1.2.25). South African commentators agree that the urgent creation of such measures through legislation is a pressing priority (SALC IP24 at 1.2.24) and a law reform process is now in full motion.
6.2.1 Interim Provisions
Electronic Communications and Transactions Act (ECTA) (25 of 2002)
The ECTA only applies to personal information that has been obtained through electronic transactions (section 50(1)). This act provides principles for collecting information but these principles are not binding and may be voluntarily subscribed to by the data controller (defined in section one as the person collecting the information) by the noting of such subscription in any agreement with a data subject (defined by section 1 as the person to whom the information relates). Once a data controller elects to subscribe to the principles listed in the act, (s) he must subscribe to them all (Section 50(3)). Listed in Section 51 of the Act the principles include:
Fair and Lawful Collection
A data controller must have the express written permission of the data subject for the collection, collation, processing or disclosure of any personal information on that data subject, unless he or she is permitted or required to do so by law (section 51 (1)).
A data controller may not electronically request, collect, collate, process or store personal information on a data subject that is not necessary for the lawful purpose for which the personal information is required (section 51 (2)). The data controller must also disclose in writing to the data subject the specific purpose for which any personal information is being requested, collected, collated, processed or stored (section 51 (3)).
Use and Retention
The data controller may not use the personal information for any other purpose than the disclosed purpose without the express written permission of the data subject, unless he or she is permitted or required to do so by law (section 51 (4)). The data controller must, for as long as the personal information is used and for a period of at least one year thereafter, keep a record of the personal information and the specific purpose for which the personal information was collected (section 51 (5)). The data controller must also delete or destroy all personal information that has become obsolete (section 51 (8)). A data controller may though use personal information to compile profiles for statistical purposes and may freely trade such profiles and statistical data as long as the profiles or statistical data cannot be linked to any specific data subject by a third party (section 51 (9)).
Disclosure
A data controller may not disclose any of the personal information held by a third party unless required or permitted by law or specifically authorised to do so in writing by the data subject (section 51 (6)). Furthermore, for as long as the personal information is used and for a period of at least one year thereafter, the data controller must keep a record of any third party to whom the personal information was disclosed and of the date on which and the purpose for which it was disclosed (section 51 (7))
Promotion of Access to Information Act (PAIA) (2 of 2000)
The bulk of this act is concerned with access to information held by both public and private bodies. The most notable provision regarding data protection is section 88 which provides:
If no provision for the correction of personal information in a record of a public or private body exists, that public or private body must take reasonable steps to establish adequate and appropriate internal measures providing for such correction until legislation providing for such correction takes effect.
6.2.2 Law reform
The SALC has recently embarked on a law reform process initiated by its report to the Ad Hoc Joint Committee on the Open Democracy Bill (dated 24 January 2000), subsequently re-named the Promotion of Access to Information Act. The report concluded that the Open Democracy Bill did not deal adequately with a number of crucial aspects of the right to privacy, such as the correction of and control over personal information. The report also noted that foreign jurisdictions often had separate privacy and data protection laws. The SALC therefore requested the Minister for Justice and Constitutional Development (the Minister) to introduce privacy and data protection legislation into Parliament, after thorough research of the matter, as soon as reasonably possible. The Minister, in turn, approached the SALC to consider the possible inclusion of such an investigation in its programme. The investigation was eventually included in the programme of the SALC on the 17th of November 2000 and a Project Committee was appointed by the Minister to assist the SALC in its task (SALC IP24 at 1.1.1 - 1.1.5). The SALC then conducted its research and released an issue paper and questionnaire to the public in December 2003. The next stage will be the issuance of a discussion paper and draft bill (SALC < http://wwwserver.law.wits.ac.za/salc/salc.html >).
The preliminary proposals of the SALC can be summarised as follows:
a)Privacy and data protection should be regulated by legislation;
b) General principles of data protection should be developed and incorporated in that legislation;
c) A statutory regulatory agency should be established;
d) A flexible approach should be followed in which industries will develop their own codes of practice (in accordance with the principles set out in the legislation) which will be overseen by the regulatory agency.
The legislative frameworks of both Zimbabwe and South Africa are on the whole inadequate. The Zimbabwean legislation is deficient due to its failure to regulate personal information held by private persons and bodies. However, the AIPPA does contain all the data protection principles that constitute the ideal.
The South African legislation is inadequate on two main grounds. Firstly, the ECTA only regulates information collected electronically, makes the subscription to data protection principles voluntary, leaves the enforcement of the principles to the law of contract, omits the very significant right to request correction and the duty of data controllers to ensure the accuracy of information (Smith A 2003). The inadequacies of this enforcement mechanism are discussed below. Secondly, the PAIA merely recognises the right of a data subject to have only accurate records about themselves used and retained by both private and public bodies, but does not provide for a procedure through which a data subject may request correction or amendment of records, instead it shifts the onus onto public and private bodies to establish such procedures.
The AIPPA establishes a Commission (section 38) which among other roles is charged with commenting on the implications of proposed legislation, the programmes of public bodies regarding access to information and protection of privacy, and implications of automated systems for the collection and storage and analysis or transfer of information. It is also tasked with informing the public about the Act itself (Section 39). To date, the Commission has dealt with no matters relating to informational privacy.
The AIPPA also provides for review by the Commission of a decision or act pertaining to an application for access to a record or for correction of personal information held by a public body (other than itself). A third party notified of a decision to give access may also request the Commission to review any decision made by the head of the public body (sections 53 - 57). Applications for review of decisions or acts of the Commission are to be made to the Administrative Court (section 90A).
As mentioned above, any disputes arising under the ECTA are to be dealt with under the law of contract. This is unfortunate and inadequate. Firstly, because the data subject may have not read the (online) contract and will subsequently be unable to enforce the principles protecting him or her. Secondly, the remedies available may be inadequate. These remedies include an interdict where the breach is continuing or threatening specific performance and damages. The inadequacy of these remedies lies, for example, in the quantification of damages (Smith A 2003 p10).
The PAIA provides for internal appeals against decisions of private and pubic bodies (sections 74 – 77) and, after internal remedies have been exhausted, for applications to court regarding decisions of information officers or relevant authorities of public bodies or heads of private bodies (sections 78 – 82). It also empowers the Human Rights Commission to carry out certain duties in relation to the Act (section 83 – 85). In particular the Human Rights Commission may, among other things, monitor the implementation of the Act and if reasonably possible, on request, assist any person wishing to exercise the rights contemplated in the Act (section 83 (3)). The Human Rights Commission therefore has a limited oversight function.
The oversight mechanisms of both countries are underdeveloped and the courts will have to enforce the data protection laws until such a time that proper oversight bodies are established.
8. Current Data Flows from Europe and Their Economic Significance
The Council and the European Parliament, through the EU Directive, have given the European Commission the power to:
1. Determine whether a third country ensures an adequate level of protection by reason of its domestic law or of the international commitments it has entered into (Article 25(6)); and
2. Decide that certain standard contractual clauses offer sufficient safeguards as required by Article 26 (2), in that, they provide adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights (Article 26 (4)).
A declaration that a country offers adequate levels of protection means that personal data can flow from EU member states and three EEA member countries (Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary (EUROPA EU –Internal market- Data Protection - Adequacy <http://europa.eu.int/comm/internal_market/privacy/adequacy_en.htm>). The Commission has so far recognized Switzerland, Hungary, the US Department of Commerce's Safe harbor Privacy Principles, Canada and Argentina as providing adequate protection (Rapid Press Release Reference: IP/03/932 of 02/07/2003). Similarly, if the Commission finds that the incorporation of certain standard clauses into a contract will offer sufficient safeguards, personal data can flow from a Data Controller established in any of the EU member states and the three EEA member countries to a Data Controller established in a country not ensuring an adequate level of data protection. The Commission is in the process of approving standard contractual clauses for transfers of personal data to data processors (EUROPA EU –Internal market- Data Protection – Model Contracts <http://europa.eu.int/comm/internal_market/privacy/modelcontracts_en.htm >). Data will accordingly only flow to a country outside Europe if the country has been declared as having adequate levels of protection or where the Commission has found that adequate safeguards for information can be secured through contracts.
The procedure for the adoption of a (comitology) Commission decision based on Article 25 (6) and 26(4) of the Directive involves:
1. A proposal from the Commission;
2. An opinion of the group of the national data protection commissioners (Article 29 working party);
3. An opinion of the Article 31 Management committee delivered by a qualified majority of Member States;
4. A thirty-day right of scrutiny for the European Parliament, to check if the Commission has used its executing powers correctly, which may, if it considers it appropriate, issue a recommendation; and
5. The adoption of the decision by the College of Commissioners.
Even if the country of destination does not offer an adequate level of protection or a finding been made as to the adequacy of contractual clauses, data may be transferred in the following specific circumstances provided for by Article 26 (1):
1. The data subject has given his consent unambiguously to the proposed transfer; or
2. The transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject's request; or
3. The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or
4. The transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or
5. The transfer is necessary in order to protect the vital interests of the data subject; or
6. The transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.
Also, under Article 26 (2) national authorities may authorise on a case by case basis specific transfers to a country not classified as offering an adequate protection where the exporter in the EU cites adequate safeguards with respect to the protection of privacy by fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights. This could be done for example by contractual arrangements between the exporter and the importer of data, subject to the prior approval of national authorities. (MEMO/01/228 Brussels, 18th June 2001)
Zimbabwe and South Africa have not been declared as having adequate levels of protection for personal data nor has a determination been made regarding the adequacy of contractual clauses. Data may be flowing to these countries in terms of article 26(1). However, specific information on the levels of such data flows is difficult to gather as EU member states do not always report such transfers.
Indeed the Commission has expressed concern about this in its first report on the implementation of the Data Protection Directive (<http://europa.eu.int/comm/internal_market/privacy/lawreport/data-directive_en.htm>). The report specifically states that certain indicators, such as the very limited number of notifications received from Member States pursuant to Article 26 (3) of the Directive, clearly suggest that ‘many unauthorised and possibly illegal transfers are being made to destinations or recipients not guaranteeing adequate protection’. The Commission further noted that ‘although there are other legal transfer routes apart from Article 26 (2), this number is derisory by comparison with what might reasonably be expected’ (p19).
In view of the Commission’s strongly worded displeasure about illegal transfers and inadequate reporting, it is unlikely that substantial personal data will be transferred to Zimbabwe and South Africa. The Commission has also established a work programme to rectify this and has sent a note to member states laying out common criteria for carrying out these notifications in a pragmatic way that puts into place mechanisms that guarantee the exchange of best practices between Member States.
The note also deals with notification arrangements concerning standard contractual clauses adopted by the Commission, other model contracts or authorisations and binding corporate rules.
‘Europe is the largest source of investment for South Africa and accounts for almost half of South Africa's total foreign trade. Seven of South Africa's top 10 trading partners are European countries. Relations with Europe, with the EU as the pivot, are crucial economically’ (South Africa Yearbook 2003/4 <http://www.info.gov.za/yearbook/2004/economy.htm >). Any decrease in the flow of personal data from Europe is likely to impact significantly on South Africa’s economy. The same is true of Zimbabwe as her economy is closely linked, and indeed largely dependent, on South Africa. It is thus imperative that both countries move swiftly to enact adequate data protection laws.
In their current form the data protection systems of both Zimbabwe and South Africa are wholly inadequate. Not only do both jurisdictions fail to conform to the comprehensive laws model of data protection, their current laws also fall far short of internationally accepted data protection principles. However, given the current process of legal reform underway in South Africa it at least appears as though some of these inadequacies will be rectified there in the near future.
[1] See NEPAD website < http://www.touchtech.biz/nepad/files/en.html.>.
Books
Bygrave LA (2002). Data protection: Approaching Its Rationale, Logic and Limits (Kluwer Law International: The Hague).
De Waal J, Currie I & Erasmus G (2000) The Bill of Rights Handbook 3ed (Juta: Kenwyn).
Neethling J (1998) Persoonlikheidsreg (Butterworths: Durban).
Neethling J, Potgieter JM & Visser PJ (1996) Neethling’s Law of Personality (Butterworths: Durban).
Neethling J, Potgieter JM & Visser PJ (2002) Law of Delict (Butterworths: Durban).
Articles
Bygrave (2001). ‘The Place of Privacy in Data Protection Law’, University of New South Wales Law Journal (6). Available online at: <http://www.austlii.edu.au/au/journals/UNSWLJ/2001/6.html>.
Crisis in Zimbabwe Coalition (2004). ‘Comments on the selective application of AIPPA’. Available online at: <http://www.kubatana.net/html/archive/cact/040121ciz.asp?sector=LEGISL&range_start=1>.
Gross (1967). ‘The Concept of Privacy,’ 1967 NYULR 34.
Hammitt (1998). ‘A Constitutional Right of Informational Privacy’. Available online at:
< http://www.govtech.net/magazine/gt/1998/june/access/access.phtml >.
Kamduzi (2000). ‘Review of the Constitutional Process,’ Agenda, Vol.3, No.3, November 2000.
McQuoid-Mason (2001). ‘Invasion of Privacy: Common Law v Constitutional Delict - Does it Make a Difference?,’ Acta Juridica, 227-261.
Neethling (2002). ‘Aanspreeklikheid vir ’Nuwe’ Risiko’s: Moontlikhede en
Beperkinge van die Suid-Afrikaanse Deliktereg,’ 2002 65 THRHR.
Petras(2002). ‘The legal implications of accreditation or non-accreditation of journalists under the Access to Information and Protection of Privacy Act’. Available online at: < http://www.kubatana.net/docs/media/021019accredmisazip.rtf >.
Reitz (1998). ‘How to Do Comparative Law,’ American Journal of Comparative Law, Volume 46, (617).
Rich (1995). ‘Right to Privacy in the Workplace in the Information Age’. Available online at:
< http://www.publaw.com/privacy.html >.
Webb (2003). ' A Comparative Analysis of Data Protection Laws in Australia and Germany, ' 2003 (2) The Journal of Information, Law and Technology (JILT). Available online at: <http://elj.warwick.ac.uk/jilt/03-2/webb.html>.
Conference Proceedings
Smith A (2003). ‘Privacy and the sale of customer lists in South African
Insolvency Law: some issues reconnoitred,’ University of South Africa, Centre for Business Law, e-Commerce and Current Commercial Law Workshop, 28 August 2003.
Reports
BBC News (No Date). ‘Zimbabwe’s History: Key Dates’. Available online at:
< http://news.bbc.co.uk/1/hi/special_report/1998/12/98/zimbabwe/226542.stm>.
Electronic Privacy Information Center (EPIC) and Privacy International. Privacy and Human Rights Report (2002). ‘An International Survey of Privacy Laws and Developments,’ United States of America. Available online at: <http://www.privacyinternational.org/>.
Helen Suzman Foundation (2000). ‘Political Opinion in Zimbabwe 2000’. Available online at:
< http://www.hsf.org.za/Zimsurvey/zimdoor.html >.
Legal Resources Foundation (LRF), Catholic Commission for Justice and Peace (CCJP) (1997). ‘Breaking the Silence, Building True Peace: A report on the disturbances in
Matabeleland and the Midlands 1980 – 1989: Summary Report’. Available online at: <http://www.zwnews.com/Breaking.doc>.
Report of the Southern Rhodesia Constitutional Conference (1979). Available online at:
< http://home.wanadoo.nl/rhodesia/lanc1.html >.
R.W. Johnson (2000). ‘Zimbabwe's Hard Road to Democracy: Report of an exit poll during the election of June 24-25, 2000’. Available online at: < http://www.hsf.org.za/Zimexit/exitconts.html >.
World Press Review Online (2002). ‘Zimbabwe: Press Spars over Election Results’. Available online at: <http://www.worldpress.org/africa/0314zim.htm>.
Links
Organizations
Constitutional Court, South Africa < http://www.concourt.gov.za>.
South African Government <http://www.gov.za>.
The National Constitutional Assembly <http://www.nca.org.zw>.
South African Law Reform Commission < http://wwwserver.law.wits.ac.za/salc/salc.html >
Zimbabwean Government <http://www.gta.gov.zw>.
Materials
Constitution of South Africa Act 108 of 1996 (as amended). Available online at:
< http://www.gov.za/structure/constitution.htm>.
Constitution of Zimbabwe. Available online at: < http://www.nca.org.zw/html/coz/coz_fs.htm>.
Council of Europe’s Convention for the Protection of Individuals with
Regard to the Automatic Processing of Personal Data (COE Convention) (1981). Available online at: <http://www.coe.fr/eng/legaltxt/108e.htm>.
NCA Draft Constitution. Available online at: <http://www.nca.org.zw/html/fdraft/fdraft_index.htm >.
The European Union Directive on the Protection of Individuals with Regard to the Processing of Personal Data and On the Free Movement of Such Data (1995). Available online at: <http://www.cdt.org/privacy/eudirective/EU_Directive_.html>).
The Organisation for Economic Cooperation and Development’s Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data (1981). Available online at: <http://www.oecd.org/documentprint>.
The UN Guidelines Concerning Computerised Personal Data Files, adopted by the UN General Assembly on 14 December 1990, Doc E/CN.4/1990/72 20.2.1990. Available online at:
< http://europa.eu.int/comm/internal_market/privacy/instruments/un_en.htm>.
Zimbabwe Constitutional Commission Draft Constitution (December 1999). Available online at: <http://www.gta.gov.zw/Constitutional/Draft.Constitution.htm>.
Legislation
Access to Information and Protection of Privacy Act (AIPPA) (Chapter 10:27).
Electronic Communications and Transactions Act (ECTA) (25 0f 2002).
Promotion of Access to Information Act (PAIA) (2 of 2000).
