The use of data, including the volume of cross-border data flows, is increasing exponentially every year, particularly in relation to personal data. However, there is a lack of adequate regulations over the collection and processing of personal information in Africa. 33 African countries currently have data protection or cybercrime laws in place,[footnote]United Nations Conference on Trade and Development, \u2018Data Protection and Privacy LegislationWorldwide\u2019 (2021) (accessible at https:\/\/unctad.org\/page\/data-protection-and-privacy-legislation-worldwide).[\/footnote] but their comprehensiveness and effectiveness vary significantly. The progression of legislation and regulation in this area has been rapid in Africa in recent years. At present, 36 African countries have passed data protection laws, with three further being in the process of considering drafts. Most recently, Tanzania<\/strong><\/a>,<\/strong> Uganda<\/strong><\/a> and Eswatini<\/strong><\/a> passed new data protection laws in 2022 and Nigeria<\/strong><\/a> and Somalia<\/strong><\/a> in 2023. Kenya<\/strong><\/a> also passed new regulations to their data protection law in 2021, in an effort to strengthen their existing law.<\/p>\n\n\n\n These developments follow the rapid development of data protection legislation around the world since the entry into force of the European Union\u2019s General Data Protection Regulations (GDPR<\/a>) in 2018. The GDPR has set a new standard for the protection of personal data online and has served as a template for numerous other countries\u2019 legislation. The California Consumer Privacy Act (CCPA) likewise has set sweeping regulations regarding consumers\u2019 rights to know what personal information is being collected from them, to request deletion of their data, and to opt out of data collection.[footnote]Forbes, \u2018California Begins Enforcing Broad Data Privacy Law \u2013 Here\u2019s What You Should Know\u2019 (2020) (accessible at https:\/\/www.forbes.com\/sites\/siladityaray\/2020\/07\/01\/california-begins-enforcing-broad-data-privacy-law—heres-what-you-should-know\/?sh=1279e683de5c).[\/footnote] Because of its application to the technology sector of Silicon Valley, the CCPA has also been lauded for advancing the state of data protection globally.[footnote]The Guardian, \u2018California’s groundbreaking privacy law takes effect in January. What does it do?\u2019 (2019) (accessible at https:\/\/www.theguardian.com\/us-news\/2019\/dec\/30\/california-consumer-privacy-act-what-does-it-do).[\/footnote]<\/p>\n\n\n\n The rise of sophisticated surveillance technologies and the use of biometric technologies without proper safeguards are just some of the many threats to the right to privacy across Africa. There have, however, been some encouraging judgments in recent years pointing to the willingness of judiciaries around Africa to protect the right to privacy.<\/p>\n\n\n\n In Kenya<\/strong>, the High Court in Nairobi ruled in 2020 in Nubian Rights Forum and Others v The Hon. Attorney General and Others<\/em><\/a>[footnote]High Court of Kenya in Nairobi, Consolidated petitions no. 56, 58 & 59 of 2019, (2020) (accessible at http:\/\/kenyalaw.org\/caselaw\/cases\/view\/189189\/).[\/footnote] that the government could not implement a new comprehensive digital identity system without an adequate data protection law being in place. On surveillance, the Constitutional Court of South Africa<\/strong> found in the case of amaBhungane and Another v Minister of Justice and Correctional Services and Others<\/em><\/a>[footnote]Constitutional Court of South Africa, Case No. CCT 278\/19, (2021) (accessible at https:\/\/www.mediadefence.org\/resource-hub\/resources\/amabhungane-v-minister-of-justice-2021\/).[\/footnote] in 2021 that mass surveillance and the interception of communications by the National Communications Centre were unlawful, and declared certain sections of the Regulation of Interceptions of Communications and Provision of Communication Related Information Act (RICA<\/a>) unconstitutional.<\/p>\n\n\n\nMore Resources on Privacy, Security and Data Protection<\/a>\n\n\n Cybercrime legislation usually seeks to deal with a wide range of illegal or harmful content that is posted online. This may include terrorist propaganda, racist content, hate speech, sexually explicit content such as child sexual abuse material (CSAM), blasphemous content, content critical of states and their institutions, and content unauthorised by intellectual property rights holders.[footnote]Article 19, \u2018Freedom of Expression and ICTs\u2019 (2018) (accessible at https:\/\/www.article19.org\/wp-content\/uploads\/2018\/02\/FoE-and-ICTs.pdf).[\/footnote]<\/p>\n\n\n\n This is often the area in which such legislation most conflicts with the right to freedom of expression and the right to information. The UN Special Rapporteur on Freedom of Expression stated in 2011 that the only types of expression that states may prohibit under international law are:<\/p>\n\n\n\n Even legislation that does criminalise these forms of expression needs to be precise, have adequate and effective safeguards against abuse or misuse and include oversight and review by an independent and impartial tribunal or regulatory body.<\/p>\n\n\n\n In 2018, the Special Rapporteur stated that \u201c[b]roadly worded restrictive laws on \u201cextremism\u201d, blasphemy, defamation, \u201coffensive\u201d speech, \u201cfalse news\u201d and \u201cpropaganda\u201d often serve as pretexts for demanding that companies suppress legitimate discourse.\u201d[footnote]United Nations Special Rapporteur on the Right to Freedom of Opinion and Expression, (2018) at para 13 (accessible at : https:\/freedex.org\/wp-content\/blogs.dir\/2015\/files\/2018\/05\/G1809672.pdf).[\/footnote]<\/p>\n\n\n\n In Zimbabwe<\/strong>, for example, the Cyber Security and Data Protection Act<\/a> passed in 2021,[footnote]Zvamaida Murwira, \u2018Zimbabwe: Milestone Cyber Security Bill Sails Through Parly,\u2019 AllAfrica (2021) (accessible at https:\/\/allafrica.com\/stories\/202109030611.html).[\/footnote] was published in the Zimbabwean Government Gazette shortly after extensive public protests had taken place over rising fuel and commodity prices in the country. It is intended to consolidate cyber-related offences and provide for data protection and seeks to \u201ccreate a technology-driven business environment and encourage technological development and the lawful use of technology.\u201d[footnote]ALT Advisory Africa, \u2018Zimbabwe gazettes Cyber Security and Data Protection Bill\u2019 (2020) (accessible at https:\/\/allafrica.com\/stories\/202109030611.html).[\/footnote] However, the Act has been widely criticised as being a tool for the Zimbabwean government to stifle freedom of expression and access to information, promote interference of private communications and data and use search and seizure powers to access the information of activists in order to quell protests.[footnote]Paradigm Initiative, \u2018On Zimbabwe\u2019s Approval of a Cybercrime and Cybersecurity Bill\u2019 (2019) (accessible at https:\/\/paradigmhq.org\/zimbabwe-cybercrime-bill\/).[\/footnote] Before it was passed, MISA-Zimbabwe criticised the Bill for:<\/p>\n\n\n\n \u201cCriminali[sing] the sending of messages that incite violence or damage to property. In the past, this charge has been used to prosecute organizers of peaceful protests and other forms of public disobedience. The same goes for sections 164A and 164B that criminalize the sending of threatening messages and cyber-bullying and harassment respectively.\u201d[footnote]MISA-Zimbabwe, \u2018Commentary on Cybersecurity and Data Protection Bill HB 18 of 2019\u2019 (2019) (accessible at ttps:\/\/zimbabwe.misa.org\/wp-content\/uploads\/sites\/13\/2020\/06\/Commentary-on-Zimbabwe-Cybersecurity-and-Data-Protection-Bill-2019.pdf).[\/footnote]<\/p>\n<\/blockquote>\n\n\n\n Prominent journalists and activists have seen been arrested under these provisions, leading to criticism that the Act criminalises digital activism.[footnote]MISA-Zimbabwe, \u2018Analysis of the Data Protection Act,\u2019 Kubatana (2021) (accessible at https:\/\/kubatana.net\/2021\/12\/06\/analysis-of-the-data-protection-act\/).[\/footnote]<\/p>\n\n\n\n For more on the criminalisation of online speech, see Module 3<\/a> of Media Defence\u2019s Advanced Modules on Digital Rights and Freedom of Expression Online.<\/p>\n\n\n Online harassment is becoming increasingly prevalent with the spread of social media, which can provide especially fertile ground for online harassment. Cyberstalking is undue harassment and intimidation online through text messages, phone calls or social media, and it severely restricts the enjoyment that persons have of their rights online, particularly vulnerable and marginalised groups, including women and members of sexual minorities. Research has shown that online harassment is often focused on personal or physical characteristics, with political views, gender, physical appearance, and race being among the most common.[footnote]Pew Research Center, \u2018Online harassment 2017\u2019 (2017) (accessible at https:\/\/www.pewresearch.org\/internet\/2017\/07\/11\/online-harassment-2017\/).[\/footnote] Furthermore, women encounter sexualised forms of online harassment at much higher rates than men.<\/p>\n\n\n\n Journalists are also particularly at risk due to their public-facing roles and efforts to stifle independent media: research by UNESCO has found that almost three-quarters of women journalists have experienced online violence.[footnote]UNESCO, \u2018Top 26 Preliminary Findings\u2019 (accessible at https:\/\/en.unesco.org\/sites\/default\/files\/the-chilling_top26.pdf).[\/footnote]<\/p>\n\n\n\n A particular form of online harassment that has emerged as a concerning new trend is that of private and sexually explicit images, mostly of women, being shared publicly online without their permission or consent, often by former partners in retaliation for a break-up or other falling out, or for the purposes of extortion, blackmail or humiliation. However, few countries\u2019 cybercrime legislation specifically caters for offences related to non-consensual dissemination of intimate images (NCII), often leaving victims with little recourse against perpetrators.[footnote]For example, although legislation in both Malawi and Uganda includes anti-pornography and anti-obscenity provisions, neither cater specifically to NCII situations, often leaving victims with little recourse. For more see Chisala-Tempelhoff and Kirya, \u2018Gender, law and revenge porn in Sub-Saharan Africa: a review of Malawi and Uganda\u2019 (2016) (accessible at: https:\/\/www.nature.com\/articles\/palcomms201669<\/a>).[\/footnote]<\/p>\n\n\n\n South Africa is an exception, having passed the Film and Publications Board Amendment Act<\/a>[footnote]South Africa Film and Publications Board Amendment Act, 2019 (accessible at: https:\/\/static.pmg.org.za\/Films_and_Publications_Act.pdf<\/a>).[\/footnote] in 2019 which, for the first time, explicitly criminalised the practice of non-consensual dissemination of intimate images, stating that:<\/p>\n\n\n\n “[A]ny person who knowingly distributes private sexual photographs and films in any medium including through the internet, without prior consent of the individual or individuals and where the individual or individuals in the photographs or films is identified or identifiable in the said photographs and films, shall be guilty of an offence and liable upon conviction.”[footnote]Ibid<\/em> at section 24(E).[\/footnote]<\/p>\n\n\n\n <\/p>\n<\/blockquote>\n\n\n\n The non-consensual dissemination of intimate images is often referred to as \u2018revenge porn.\u2019 However, activists and researchers have universally rejected the term as being misleading.[footnote]GenderIT, \u2018”Revenge Porn”: 5 important reasons why we should not call it by that name\u2019 (2019) (accessible at: https:\/\/www.genderit.org\/articles\/5-important-reasons-why-we-should-not-call-it-revenge-porn<\/a>).[\/footnote] Firstly, the word \u2018revenge\u2019 implies that the victim has committed a harm worth seeking revenge for, and \u2018porn\u2019 conflates the practice with the consensual production of content for mass consumption, which NCII decidedly is not. Secondly, the term \u201crepackages an age-old harm as a new-fangled digital problem,\u201d belying the long history that exists of images of women being distributed non-consensually across a range of mediums.[footnote]Id<\/em>.[\/footnote] Lastly, the term oversimplifies the offence by ignoring a range of aggressors and motivations and invoking a moralist reaction against the victim.[footnote]Association for Progressive Communications, \u2018Online gender-based violence: A submission from the Association for Progressive Communications to the United Nations Special Rapporteur on violence against women, its causes and consequences\u2019 (2017) at p.21 (accessible at: https:\/\/www.apc.org\/sites\/default\/files\/APCSubmission_UNSR_VAW_GBV_0_0.pdf<\/a>)).[\/footnote]<\/p>\n<\/div><\/div>\n\n\n\n Many stalking crimes begin online before moving offline,[footnote]South Africa Law Reform Commission, \u2018Report on Stalking,\u2019 (2006) (accessible at: https:\/\/www.justice.gov.za\/salrc\/reports\/r_pr130_stalking.pdf<\/a>).[\/footnote] and cyberstalking can be complicated for many reasons:<\/p>\n\n\n\n “[Cyberstalking is] online harassment, threats, intimidating messages and subscribing the victim to unwanted online services. From the outset this interaction may be considered an irritation or an annoyance or may give rise to a belief that harm may be caused. The cyber-stalker may however initiate contact in a non-confrontational manner and proceed to woo or groom the victim into a cyber-friendship in order to gain the victim\u2019s confidence and to determine personal details such as the person\u2019s address. Without the victim\u2019s knowledge the same \u201ccyber-friend\u201d could be stalking the victim in person, perhaps even giving the victim advice on how he or she should respond to the stalker. Although cyberstalking which has escalated into stalking the victim in person i.e. \u201creal-time stalking\u201d may result in the commission of a sexual offence, it is not the only outcome.”[footnote]Id<\/em> at p 182.[\/footnote]<\/p>\n<\/blockquote>\n\n\n\n Because of this complexity, as well as the rapid evolution of technology that makes it difficult for regulation to keep up, the South African Law Reform Commission recommended that specific reference to cyberstalking not be included explicitly in law:<\/p>\n\n\n\n “In reality, however surreal \u201ccyberstalking\u201d or the use of technical or computerised equipment to stalk a person is it fundamentally amounts to an extension of physical stalking. One is merely dealing with a different medium.”[footnote]Id<\/em> at p 183.[\/footnote]<\/p>\n<\/blockquote>\n\n\n\n Ongoing harassment and attacks on members of the media have also become a particularly worrying trend.<\/p>\n\n\n\n Where journalists allege imminent threats to their safety, courts are empowered to grant interdictory relief in appropriate circumstances and subject to the relevant legal requirements.<\/p>\n\n\n\n For instance, in the matter of South African National Editors Forum and Others v Black Land First and Others<\/a><\/em>,[footnote]High Court of South Africa in Johannesburg, Case No 23897\/17, (2017) (accessible at: http:\/\/www.saflii.org\/za\/cases\/ZAGPJHC\/2017\/179.html<\/a>).[\/footnote] the High Court of South Africa granted an interdict in favour of the media broadly, in terms of which the respondents were interdicted from \u201cengaging in any of the following acts directed towards the applicants: intimidation; harassment; assaults; threats; coming to their homes; or acting in any manner that would constitute an infringement of their personal liberty\u201d, and from \u201cmaking any threatening or intimidating gestures on social media\u2026 that references any violence, harm and threat.\u201d[footnote]Ibid<\/em> at para. 29.[\/footnote]<\/p>\n<\/div><\/div>\n\n\n\nFactsheet: Gender & Online Harassment<\/a>\n\n\n It is also worth noting the crime of cyberbullying, which is the sending of intimidating or threatening messages, often via social media, and which is pervasive among children and young adult.[footnote]News24, above at no. 35. For more on online harassment see pp. 38-44 of Module 4 of Media Defence\u2019s Advanced Modules on Digital Rights and Freedom of Expression Online accessible at: https:\/\/www.mediadefence.org\/ereader\/publications\/advanced-modules-on-digital-rights-and-freedom-of-expression-online\/module-4-privacy-and-security-online\/<\/a>).[\/footnote] According to the United Nations Children\u2019s Fund (UNICEF<\/a>):<\/p>\n\n\n\n “[Cyberbullying] can take place on social media, messaging platforms, gaming platforms and mobile phones. It is repeated behaviour, aimed at scaring, angering or shaming those who are targeted. Examples include:<\/p>\n\n\n\n – spreading lies about or posting embarrassing photos of someone on social media;<\/p>\n\n\n\n – sending hurtful messages or threats via messaging platforms;<\/p>\n\n\n\n – impersonating someone and sending mean messages to others on their behalf.<\/p>\n\n\n\n Face-to-face bullying and cyberbullying can often happen alongside each other. But cyberbullying leaves a digital footprint \u2014 a record that can prove useful and provide evidence to help stop the abuse.”[footnote]UNICEF, \u2018Cyberbullying: What is it and how to stop it\u2019 (accessible at: https:\/\/www.unicef.org\/end-violence\/how-to-stop-cyberbullying<\/a>).[\/footnote]<\/p>\n<\/blockquote>\n\n\n\n The scale of the problem is significant and growing. A study by UNICEF and the UN Special Representative of the Secretary-General (SRSG) on Violence against Children<\/a> found that one in three young people in 30 countries reported being a victim of online bullying.[footnote]UNICEF, \u2018UNICEF poll: More than a third of young people in 30 countries report being a victim of online bullying\u2019 (2019) (accessible at: https:\/\/www.unicef.org\/press-releases\/unicef-poll-more-third-young-people-30-countries-report-being-victim-online-bullying<\/a>).[\/footnote]<\/p>\n\n\n\n In South Africa, the family of a teenager who was sent graphic threats through Instagram from an anonymous account was pitted against one of the largest technology companies in the world, Facebook, the former owner of Instagram.[footnote]Daily Maverick, \u2018Anonymously threatened with gang rape and murder, SA teenager takes Facebook Inc to court to disclose perpetrator\u2019 (2020) (accessible at: https:\/\/www.dailymaverick.co.za\/article\/2020-07-24-anonymously-threatened-with-gang-rape-and-murder-sa-teenager-takes-facebook-inc-to-court-to-disclose-perpetrator\/<\/a>).[\/footnote] The girl, believing the threats were from someone attending her school, feared for her physical safety and therefore attempted to force Facebook to release the identity of the person behind the anonymous account sending the threats. Multiple attempts to do so were futile, forcing the family to turn to the courts for relief. The case is an example of the challenges in holding multi-national companies to account in the digital age and raises questions about how far their responsibility to protect children who use their platforms should go.<\/p>\n<\/div><\/div>\n\n\n Given that the Malabo Convention has yet to be tested in practice, a reading of the Budapest Convention on Cybercrime<\/a>, the first international treaty that seeks to address internet and computer crimes, is instructive.[footnote]Council of Europe, \u2018The State of Cybercrime Legislation in Africa \u2013 an Overview\u2019 at p. 2 (2015) (accessible at: https:\/\/rm.coe.int\/16806b8a79<\/a>).[\/footnote] It is increasingly being used in Africa, and has served as a guideline or source for more than 80% of states around the world to develop domestic cybercrimes laws.[footnote]Council of Europe, \u2018The global state of cybercrime legislation 2013 \u2013 2020: A cursory overview,\u2019 at page 5 (2020) (accessible at: https:\/\/rm.coe.int\/3148-1-3-4-cyberleg-global-state-feb2020-v1-public\/16809cf9a9<\/a>).[\/footnote] It is also open for any state willing to implement its provisions to join, and can be ratified by African countries.[footnote]Council of Europe, \u2018Chart of signatures and ratifications of Treaty 185\u2019 (2020) (accessible at: https:\/\/www.coe.int\/en\/web\/conventions\/full-list\/-\/conventions\/treaty\/185\/signatures<\/a>).[\/footnote]<\/p>\n\n\n\n The Budapest Convention defines the following types of cybercrimes:<\/p>\n\n\n\n Although these definitions date to 2001, much of what constitute cybercrimes today is still covered by these categories and provisions.<\/p>\n","protected":false},"excerpt":{"rendered":" The use of data, including the volume of cross-border data flows, is increasing exponentially every year, particularly in relation to personal data. However, there is a lack of adequate regulations over the collection and processing of personal information in Africa. 33 African countries currently have data protection or cybercrime laws in place,[footnote]United Nations Conference on […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":432,"menu_order":294,"template":"page-templates\/chapter.php","publication-category":[],"class_list":["post-440","publication","type-publication","status-publish","hentry"],"acf":[],"yoast_head":"\nCriminalisation of online speech<\/h3>\n\n\n\n
\n
\n
Cyberstalking and online harassment<\/h3>\n\n\n\n
A worrying new trend: non-consensual dissemination of intimate images<\/strong><\/h3>\n\n\n\n
\n
Practical steps to take if you are a victim of non-consensual dissemination of intimate images:<\/h5>\n\n\n\n
\n
\n
\n
The importance of a name:<\/strong><\/h5>\n\n\n\n
\n
\n
Online harassment of the media<\/strong><\/h5>\n\n\n\n
Cyberbullying<\/h3>\n\n\n\n
\n
David v Goliath: tackling cyberbullying on tech platforms<\/strong><\/h5>\n\n\n\n
Other violations<\/h3>\n\n\n\n
\n
\n