Back to main site

    Government & Corporate Surveillance

    Module 4: Data Privacy and Data Protection

    Communications surveillance encompasses the monitoring, intercepting, collecting, analysing, retention, or similar actions, of a person’s communications in the past, present, or future.(1) This relates to both the content of communications and communication metadata – which is information about a communication, such as the identities of the parties, the time or duration or location of the communication, and technical services used. It has been noted that even communication metadata can give detailed insights into an individual’s behaviour, social relationships, private preferences and identity. Taken as a whole, it may allow very precise conclusions to be drawn concerning the private life of the person.(2)

    In recent years, the use of sophisticated surveillance technology on mobile phones has gained increasing prominence amidst concerns about its extensive abuse to monitor political opponents and activists.

    The Pegasus scandal

    In 2021, news broke that at least 180 journalists as well as political leaders had been targeted for surveillance by Pegasus spyware, a system that can be remotely installed on a smartphone enabling complete control over the device.(3) The news attracted widespread condemnation, including, for example, the Supreme Court of India in 2021 ordered an independent inquiry into allegations that the government deployed the Pegasus spyware against various journalists, politicians, and dissidents because of the deeply chilling effects its use could have on freedom of expression.(4)

    Although the findings of the Court’s investigation have not been made public, evidence has since come to light of the continued use of the Pegasus software to surveil journalists.(5)

    In 2019, Meta launched litigation against the NSO Group, the maker of Pegasus software, claiming that it was responsible for a series of cyber-attacks which violated American law.(6)

    The litigation is as of 2024 still ongoing. In February 2024, NSO Group was ordered to hand over its code for Pegasus and other spyware products, as well as information concerning the full functionality of the relevant spyware.(7)

    African activists and journalists were among some of the targets identified in the Pegasus scandal, as were powerful politicians and state officials revealed to be users of the tools. In 2024, Reporters without Borders found spyware traces on the phones of two Togolese journalists while they were on trial for defamation against a government minister.(8)

    International law position

    General Comment No. 16 provides that “[s]urveillance, whether electronic or otherwise, interceptions of telephonic, telegraphic and other forms of communication, wire-tapping and recording of conversations should be prohibited.”(9) Surveillance — both bulk (or mass) collection of data(10) or targeted collection of data — interferes directly with the privacy and security necessary for freedom of opinion and expression, and must be considered against the three-part test to assess the permissibility of the restriction.

    In the digital age, ICTs have enhanced the capacity of governments, corporations, and individuals to conduct surveillance, interception and data collection, and have meant that the effectiveness of conducting such surveillance is no longer limited by scale or duration.

    In Africa, some countries have even passed legislation enabling digital surveillance of targeted groups; for example, the United Nations Special Rapporteur on Privacy has noted with concern the Anti-Cybercrime Law enacted in Egypt in 2018 which reportedly enables surveillance of the LGBTQI community.(11)

    In a resolution adopted by the UN General Assembly (UNGA) on the right to privacy in the digital age, the UNGA emphasised that unlawful or arbitrary surveillance and/or interception of communications, as well as the unlawful or arbitrary collection of personal data, are highly intrusive acts, violate the right to privacy, can interfere with the right to freedom of expression, and may contradict the tenets of a democratic society, including when undertaken on a mass scale.(12) It noted further that surveillance of digital communications must be consistent with international human rights obligations and must be conducted on the basis of a legal framework, which must be publicly accessible, clear, precise, comprehensive and non-discriminatory.

    In order to meet the condition of legality, many states have taken steps to reform their surveillance laws to allow for the powers required to conduct surveillance activities. According to the Necessary and Proportionate Principles, a civil society initiative to document the principles that apply to any limitation on freedom of expression, communications surveillance should be regarded as a highly intrusive act, and in order to meet the threshold of proportionality, the state should be required at a minimum to establish the following information to a competent judicial authority prior to conducting any communications surveillance:(13)

    • There is a high degree of probability that a serious crime or specific threat to a legitimate aim has been or will be carried out.
    • There is a high degree of probability that evidence relevant and material to such a serious crime or specific threat to a legitimate aim would be obtained by accessing the protected information sought.
    • Other less invasive techniques have been exhausted or would be futile, such that the technique used is the least invasive option.
    • Information accessed will be confined to that which is relevant and material to the serious crime or specific threat to a legitimate aim alleged.
    • Any excess information collected will not be retained but instead will be promptly destroyed or returned.
    • Information will be accessed only by the specified authority and used only for the purpose and duration for which authorisation was given.
    • The surveillance activities requested, and techniques proposed do not undermine the essence of the right to privacy or of fundamental freedoms.
     

    The importance of independent oversight and subject notification

    In addition to the principles discussed above, the groundbreaking case of amaBhungane Centre for Investigative Journalism v Minister of Justice and Correctional Services emphasised two additional principles that are critical to ensuring legitimate and rights-respecting targeted surveillance. First, the Constitutional Court of South Africa emphasised the need for a clear and independent process for appointing the designated judge to oversee requests for surveillance by law enforcement. Second, it highlighted that the law should accommodate the notification of subjects of surveillance that they have been surveilled after the fact and when such notification will no longer threaten the investigation.  

    It is notable that the Court reflected on the need for enhanced protections for lawyers and journalists as a result of the importance of confidentiality in these professions, and that legislation should therefore provide additional safeguards in such cases.  

    Surveillance constitutes an obvious interference with the right to privacy. Further, it also constitutes an interference with the right to hold opinions without interference and the right to freedom of expression. With particular reference to the right to hold opinions without interference, surveillance systems, both targeted and mass, may undermine the right to form an opinion, as the fear of unwilling disclosure of online activity, such as search and browsing, likely deters individuals from accessing information, particularly where such surveillance leads to repressive outcomes.(14)

    As emphasised in the amaBhungane case, the interference with the right to freedom of expression is particularly apparent in the context of journalists who may be placed under surveillance as a result of their journalistic activities. The disclosure or surveillance of journalistic sources can have negative consequences for the right to freedom of expression due to a breach of an individual’s confidentiality in their communications.(15)

    This is the same for cases concerning the disclosure of anonymous user data. Once confidentiality is undermined, it cannot be restored. It is therefore of utmost importance that measures that undermine confidentiality are not taken arbitrarily.

    The importance of source protection has been well-established. For example, in Bosasa Operation (Pty) Ltd v Basson and Another, the South Africa High Court held that journalists are not required to reveal their sources, subject to certain exceptions.(16) The court stated in this regard that:

    “If indeed freedom of the press is fundamental and sine qua non for democracy, it is essential that in carrying out this public duty for the public good, the identity of their sources should not be revealed, particularly, when the information so revealed, would not have been publicly known. This essential and critical role of the media, which is more pronounced in our nascent democracy, founded on openness, where corruption has become cancerous, needs to be fostered rather than denuded.”

    Surveillance activities carried out against journalists have the risk of fundamentally undermining the source protection to which journalists are otherwise entitled.

    Jurisprudence on journalism and the right to privacy

    The linkages between journalistic freedoms and the right to privacy are a common theme in emerging litigation and jurisprudence against unlawful or abusive surveillance. For example:

    • In two cases both dealing with the planned roll-out by the Communications Authority of Kenya of a system to provide it with access to mobile service subscribers’ data, the High Court of Kenya held that the system was “a threat to subscribers’ privacy,” that there were fewer restriction measures to implement the Authority’s goals of identifying illicit devices, and that the system was unlawful, unreasonable, and disproportionate.(17)
    • In ordering the independent inquiry into allegations that the government deployed the Pegasus spyware against various journalists, politicians and dissidents, the Supreme Court of India found that the free press’s democratic function was at stake, and that “such chilling effect on the freedom of speech is an assault on the vital public watchdog role of the press, which may undermine the ability of the press to provide accurate and reliable information.”(18)
    • The European Court of Human Rights (ECtHR) found some aspects of the United Kingdom’s mass surveillance regime to be in violation of the right to privacy and the right to freedom of expression under the European Convention on Human Rights, holding that although bulk interception regimes are not in themselves incompatible with those rights, the lack of independent oversight and the fact that the regime’s use was not limited to combatting “serious crime” and did not sufficiently protect journalists’ confidential communication resulted in it constituting a violation.(19)

    Back to Resource Hub

    Footnotes

    1. Article19 et al, ‘Necessary and proportionate: International principles on the application of human rights to communications surveillance’ (2014) (accessible at https://necessaryandproportionate.org/files/2016/03/04/en_principles_2014.pdf) at p 4. Back
    2. For more on this topic see Media Defence ‘Training Manual on Digital Rights and Freedom of expression Online: Litigating digital rights and online freedom of expression in East, West and Southern Africa’ (accessible at https://www.mediadefence.org/wp-content/uploads/2020/06/MLDI-Training-Manual-on-Digital-Rights-and-Freedom-of-Expression-Online.pdf). Back
    3. Forbidden Stories, ‘Journalists Under Surveillance’ (2021) (accessible at https://forbiddenstories.org/pegasus-journalists-under-surveillance/). Back
    4. Sharma v Union of India and Others, Writ Petition (CRL.) No. 314 (2021) (accessible at https://main.sci.gov.in/supremecourt/2021/16884/16884_2021_1_1501_30827_Judgement_27-Oct-2021.pdf). Back
    5. Amnesty International, ‘India: Damning new forensic investigation reveals repeated use of Pegasus spyware to target high-profile journalists’ (2023) (accessible at https://www.amnesty.org/en/latest/news/2023/12/india-damning-new-forensic-investigation-reveals-repeated-use-of-pegasus-spyware-to-target-high-profile-journalists/). Back
    6. Nick Hopkins and Stephanie Kirchgaessner, ‘WhatsApp sues Israeli firm, accursing it of hacking activists’ phones’ The Guardian (2019) (accessible at https://www.theguardian.com/technology/2019/oct/29/whatsapp-sues-israeli-firm-accusing-it-of-hacking-activists-phones). Back
    7. Stephanie Kirchgaessner, ‘Court orders maker of Pegasus spyware to hand over code to Whatsapp’ The Guardian (2024) (accessible at https://www.theguardian.com/technology/2024/feb/29/pegasus-surveillance-code-whatsapp-meta-lawsuit-nso-group). Back
    8. RSF, ‘In first for Togo, RSF identifies spyware on phones of two Togolese journalists’ (2024) (accessible at https://rsf.org/en/first-togo-rsf-identifies-spyware-phones-two-togolese-journalists). Back
    9. See above n 9 at para 8. Back
    10. Revelations be whistle-blowers, such as Edward Snowden, have revealed that the National Security Agency in the USA and the General Communications Headquarters in the United Kingdom had developed technologies allowing access to much global internet traffic, calling records in the United States, individuals’ electronic address books and huge volumes of other digital communications content. These technologies are deployed through a transnational network comprising strategic intelligence relationships between governments and other role-players. This is referred to as bulk or mass surveillance. See above n 47 at para 4. Back
    11. UNSR on Privacy, ‘Report prepared pursuant to Human Rights Council resolutions 28/16 and 37/2’ (20190 (accessible at https://documents.un.org/doc/undoc/gen/g19/307/40/pdf/g1930740.pdf?token=Llio29GStCcXeab4uk&fe=true) at p 14. Back
    12. UNGA, ‘Resolution on the right to privacy in the digital age’ A/C.3/71/L.39/Rev.1, (2016) (accessible at http://www.un.org/ga/search/view_doc.asp?symbol=A/C.3/71/L.39/Rev.1). Back
    13. See above n 65 at Principle 5. Back
    14. See above n 47 at para 21. Back
    15. For more, see Big Brother Watch v United Kingdom in the ECtHR (2018) (accessible at https://globalfreedomofexpression.columbia.edu/cases/big-brother-watch-v-united-kingdom/)) and amaBhungane Centre for Investigative Journalism v Minister of Justice in South Africa (2019) (accessible at http://www.saflii.org/za/cases/ZAGPPHC/2019/384.html). Back
    16. [2012] ZAGPJHC 71, (2012) (accessible at http://www.saflii.org/za/cases/ZAGPJHC/2012/71.html). Back
    17. Kenya Human Rights Commission v. Communications Authority of Kenya (2018) (accessible at https://globalfreedomofexpression.columbia.edu/cases/kenya-human-rights-commission-v-communications-authority-kenya/) and Okoiti v. Communications Authority of Kenya (2018) (accessible at https://globalfreedomofexpression.columbia.edu/cases/okoiti-v-communications-authority-kenya/). Back
    18. Writ Petition (Crl.) No. 314 of 2021, (2021) (accessible at https://main.sci.gov.in/supremecourt/2021/16884/16884_2021_1_1501_30827_Judgement_27-Oct-2021.pdf). Back
    19. Big Brother Watch v. The United Kingdom (Big Brother I) App nos. 58170/13, 62322/14 and 24960/15 (2018) (accessible at https://globalfreedomofexpression.columbia.edu/cases/big-brother-watch-v-united-kingdom/). Back