The Cyber Security And Data Protection Bill 2019
Skip to e Cyber Security And Data Protection Bill 2019
Commentary On Cyber Protection Bill
Purpose of the Bill
The Bill has a quite well written preamble and has all the hallmarks of well crafted legislation that seeks to serve and protect people’s rights while complying with the Constitution like all legislation is sup[posed] to. The bill firstly intends to consolidate cyber related offenses which should allow for, easy to understand and interpret legal provisions. Recently we have seen what seems to be very biased interpretations of cyber offenses related provisions with what happened to some pro-democracy activists and political opponents who tweeted some things that the government claimed were not true. The Bill on the face of it seems to want to address these issues by having one piece of legislation that deals with cyber offenses. But of course these laws/provisions have to be Constitutional, fair and not prejudicial to any and all rights due to the people. As we shall see, as progressive as the Bill is there are a few provisions that are a little dodge to say the least and lay open to abuse especially by a government seeking to silence opposing voices which of course is not cool.
Another purpose of this bill as articulated in the preamble is for data protection. We are most certainly in the digital age and save for an apocalyptic event like an alien invasion, zombie apocalypse and or nuclear war (did I leave anything out?); we are not going back to the stone age or atleast an age before the internet. This means we are going to “forever” (as long as civilization exists) be operating online and this largely entails the use of personal details and information on line. The Bill’s intention is to identify which data is personal, which should be protected and how to protect it. The Bill draws some of it’s principles and provisions from the European General Data Protection Regulation which now because of it being so well crafted serves as a template which many countries and jurisdictions and have been adopting. It has kind of set global the standard. In this regards the Bill is quite extensive and in tune with the need for the protection of person data and information online. As such it further aligns itself to international standards and laws which allows the country to participate online globally economically and socially.
Well, one thing is for sure, social media and the internet in general changed the “game” for humans out here. The internet especially the social media and business aspect of it has become an immensely important aspect of our everyday lives. We communicate publicly on platforms like Twitter, Facebook, Websites; we upload personal information and details on line for better or more access and we engage in trade and politics on these here platforms. For the most part it has been advantageous in ways we could have never imagined perhaps just 30 years ago. However the web’s insatiable hunger for data and personal information, its abuse by some in perpetrating violence of all kinds and its potential for political influence (in good and bad faith) has prompted the need for legal, legislative controls to keep things in check and protect users of the internet. In Zimbabwe there are various Acts and laws that serve to protect and regulate the use and abuse of the internet. These have been however scattered provisions that are subject to inconsistent interpretations and “misunderstandings” (if you know, you know). The Zimbabwean legislature though, at the instance of the cabinet has drafted and published the Cyber Protection Bill which is designed to consolidate online data protection laws and to regulate the use thereof. Lets explore this baby and see if it passes the Constitutionality test and if it serves as progressive legislation that serves its said purpose and protects against abuses by the government and other actors……. By the way, if you have someone’s nudes out in cyberspace, now is the time to pull them down, this Bill ain’t playing!
Furthermore the Bill seeks to establish a central authority for cyber security, data protection and to provide for the functions of said authority. The authority is further afforded with investigative functions and collection of evidence related to cyber crimes, unauthorized data collection and breaches, and to assist with the admissibility of electronic evidence for such offenses. Having a specialized authority for this highly technical field is necessary for it’s purpose and enforcement. The establishment of said institution/authority is a step in the right direction that will ensure proper regulation and coherence in dispensing the purpose of the Bill.
Its independence though from government especially, will be key in determining it’s effectiveness. If the Government meddles with the cyber authority especially in issues relating to processing evidence in criminal matters and retrieving personal information of opponents and activists (among other potential infringements) then there will be real problems. Governments have been known to approach social media companies and other online actors for the purposes of “unlawfully” retrieving data and information which actually disregards the privacy of individuals.
With our entire lives moving online from our education, businesses and our society, considering how “difficult” it is to regulate the internet (a prickly subject), having such a specialized institution is indeed essential in creating a safe and conducive environment for users. Further the central authority can help properly craft and articulate criminal offenses and other regulations on line which may be difficult to interpret for other responsible authorities with no knowledge or understanding of the cyber world. Lord knows we needs us some of that professionalism with matters relating to the world wide web (Cyber security and all).
Key Provisions
Section 5 – 6 (Establishment of Cyber Security Centre)
The establishment of the Cyber Security centre is right on the “money” as mentioned above. A well run Centre will ensure that the provisions of the ‘Act’ can be properly enforced with expert help that understands the legal and technical dynamics of data protection and cyber security. The functions of the Centre are among others to advise Government and implement Government policy on cyber crime and cyber security, identify areas for intervention to prevent cyber crime; establish and operate a protection-assured whistle-blower system that will enable members of the public to confidentially report to the Committee cases of alleged cyber crime; oversee the enforcement of the Act to ensure that it is enforced reasonably and with due regard to fundamental human rights and freedoms; and others as provided for in Section 6 of the Bill. Leaving such matters to a technical institution is the best approach as it will establish uniformity, consistency and accurate interpretation of the legal provisions and their enforcement.
In addition a Data Protection Authority as provided for in section 7 – 8 will serve the purpose of regulation, research, and advice to the Minister on matters relating to data protection. The Authority will also serve as a report and complaints platform which will centralize said function which is necessary for proper and efficient enforcement among other advantages.
Section 31 Whistle-blowing
The Authority is granted in this Bill the power to regulate a whistleblowing system for the reporting of bad practices in as far as data protection and cyber security is concerned. “Whistleblowing” according to the Bill refers to legal provisions permitting individuals to report the behaviour of a member of their organization which, they consider contrary to a law or regulation or fundamental rules established by their organization. The online world can be really difficult to understand and can be used to harvest personal data for more nefarious agendas. With a proper whistleblowing system in place this can aid in reporting unlawful acts and wayward individuals. With the lessons learnt from the Facebook shenanigans a whistleblowing platform is necessary in regulating the industry
Offenses Relating To Electronic Communications And Material
The Bill is quite thorough when it comes to cyber related offenses and on the face of it, it looks like its all set and good to go. However more discerning scrutiny of all the criminal provisions will reveal a landmine or two within a sea of "gold nuggets." Anyone reading the criminal provisions must consider the relevant Constitutional provisions in the Bill of Rights notably the right to freedom of speech and expression.
Section 164
So here the Bill provides that anyone via a computer medium who incites violence against other people or property shall be guilty of an offence. This is well in line with justifiable provisions that seek to objectively address said problem. Inciting violence even or especially online is dangerous to any civilized society and must be stopped by all means. Violence as we have seen through out the brief history of the internet can be triggered online and have adverse effects including death and destruction of property. In this instance the provision is spot on and necessary. Of course violence in this case should be narrowly interpreted to only clear instances where violence is directly called upon. Wide interpretation of cases where violence is incited may result in the freedom of expression being stunted especially by a government acting in bad faith.
Section 164C
Unlike the above stated provision this provision is a little tricky and subject to all sorts of bias and interpretations. The provision is in relation to “false” information meant to cause harm, psychological or economic that is posted online. Now the interpretation of what constitutes false information has already been used in what seems to be biased use of the law to silence political opponents. We have seen chaps like Hopewell Chin’ono get arrested for posting what was said to be false information online. Clearly the government was up to no good and it actually seems as if that is the case that inspired this provision. What consequence could this have on journalists, civil rights activists and groups, whistleblowers and so forth? A quick glance at this question would point to a vast potential for abuses. Imagine a journalist who is investigating corruption in government and publishes some of his/her findings on social media or newspaper etc. All of a sudden the government officials in question hide the evidence, cry foul, and press charges in terms of section 164C. The corrupt officials would have considerable power not only to evade prosecution but to silence the journalist and have them sent to prison. This obviously will have other such people choosing to be silent and not tackling such matters as corruption or abuse of power etc. This therefore is in contrast to certain provisions in the Constitutions namely section 61 (Freedom of Expression).
Section 164C, the way it is worded would not only affect the aforementioned class of people, it will also put ordinary internet users at risk of such prosecution and this could possibly spell the end of democratic freedoms and processes in Zimbabwe. Corruption and abuse of power will go unchecked as there will be no protection for journalists, activists and individuals that seek to expose it. Issues such as corruption and abuse of power in government are incredibly difficult to prove or even detect. Such a restrictive provision will make it impossible to deal with such. This is a bad provision and must be struck out before this Bill is made Law.
164B Cyber-bullying and harassment
Any person who unlawfully and intentionally by means of a computer or information system generates and sends any data message to another person, or posts on any material whatsoever on any electronic medium accessible by any person, with the intent to coerce, intimidate, harass, threaten, bully or cause substantial emotional distress, or to degrade, humiliate or demean the person of another or to encourage a person to
harm himself or herself, shall be guilty of an offence and liable to a fine not exceeding level 10 or to imprisonment for a period not exceeding ten years or to both; a fine and imprisonment. This is for my fellow social media users. Be careful y’all. This provision is broadly written and extensive. With timelines, twitter spaces, live video broadcasts and the (infamous DM) people of nefarious motives lurk among us.
The problem with this is perhaps politicians hiding behind this legislation in order to hide from demands for accountability or responsibility. A captured Cyber Authority and legal system could see this provision being abused and used to shut down legitimate calls for accountability online. Politicians and other people of note should not be included in this Bills umbrella and in particular this here section 164B save for perhaps when their lives are threatened.
164 E Transmission of intimate images without consent
Ow boy, where do I start? The spike in the posting of nude images for the purposes of humiliating other people is quite scary. The proliferation of such is becoming unbecoming globally and Zimbabwe is no exception. The current law addressing the issue of posting nudes and so called “revenge porn” is primarily the Censorship and Entertainments Control Act, however large quarters of the society have found this law and others to be inadequate in dealing with the problem. The wider use of smart phones and other devices mean a lot more people have access to the web and the chances of someone in possession of intimate images posting same for whatever reason is on the rise. The Bill sets out a clear provision that sets out clearly defined parameters and consequence. This will make enforcing the law against posting of nudes without consent an offence that is enforceable absent complications. Those that already have nudes posted without the consent of those in the images might want to start pulling them down because they might just get a 5 year jail term according to the Bill. The trouble might come from pre-Act posts that have been posted and then re-posted by others and are still online while the originator has pulled down the primary nude post. It would be interesting to see how the courts will handle such instances. Further what happens to those that “retweet, like, re-post and other such things”.
The Business end Of Things
In today’s business environment everything has moved to the internet. This Bill bring Zimbabwe in line with best practices regarding cyber security and data protection thereby creating a conducive business environment for businesses operating in Zimbabwe. This will allow for lawful operation of businesses online where data is protected and use of cyber space is well regulated. With the world going digital this will be beneficial to Zimbabwean business that will be able not operate locally and internationally too.
Yay or Nay?
The Bill is largely progressive and does create a good framework for providing security and safety of sensitive information online. The creation of a central data authority and the regulations that have been set out in the Bill are well in line with international standards, for the most part. This Bill will drag Zimbabwe well into the global online community and allow for especially local companies to operate online while complying with global security standards. On the other hand it seems the drafters of this Bill slid in a provision or two that are unconstitutional more so section 164C which has the potential to spell the end of the freedom of speech and expression in Zimbabwe. That provision alone dampens if not obliterates the spirit and purpose of this Bill as it constrains a key and important Constitutional right that is essential for democracy and progressive societies.
Comments
Post a Comment