Ict and The Law
Ict and The Law
The deployment of facial recognition technology (FRT) in Zimbabwe, particularly through the
software developed by DigiSoft (Pvt) Ltd, has ignited a critical discourse around its legal and
ethical implications. As this technology is increasingly utilized by both government agencies and
private companies, concerns regarding its potential misuse have come to the forefront. Reports
indicate that FRT may perpetuate racial biases, facilitate unauthorized surveillance, and pose
significant risks of data breaches, raising alarms about its impact on citizens' fundamental rights 1.
A human rights group has filed a complaint alleging violations of privacy and non-
particularly Section 57, which guarantees the right to privacy, and Section 56, which ensures
equality before the law2. Furthermore, the Data Protection Act (Chapter 11:22) aims to regulate
personal data processing but lacks specific provisions addressing the unique challenges posed by
biometric data collection3. The involvement of foreign entities, such as CloudWalk Technology
Co., in the implementation of these systems raises additional concerns about cross-border data
transfers and the adequacy of existing legal frameworks to protect citizens’ information and
1
https://zimbabwe.misa.org/2018/05/29/digest-facial-recognition-technology-privacy-rights/
2
The Constitution of Zimbabwe of 2013
3
Data Protection Act
privacy without fail4. This situation necessitates a thorough evaluation of the legal landscape
governing facial recognition technology in Zimbabwe and the establishment of robust regulatory
measures to ensure its responsible use while safeguarding human rights and promoting ethical
To begin with , under the legal issues the deployment of facial recognition technology (FRT) in
Zimbabwe, particularly through initiatives by companies like DigiSoft (Pvt) Ltd, poses
significant threats to the right to privacy as enshrined in the Zimbabwean Constitution. Section
57 of the Constitution explicitly guarantees every individual's right to privacy, stating that "every
person has the right to privacy, which includes the right not to have their person, home, or
communications searched or interfered with."78 However, the implementation of FRT can lead to
pervasive surveillance practices that infringe on this fundamental right. Critics argue that such
technologies enable the government and private entities to monitor individuals without their
consent, effectively transforming public spaces into zones of surveillance where personal
The Access to Information and Protection of Privacy Act (AIPPA) and the Interception of
Communications Act (ICA) are two critical pieces of legislation that intersect with privacy rights
4
Understanding SI 155 of 2024: New Regulations on Data Protection Licensing and Data Protection Officers in
Zimbabwe
5
Advisory on Data Privacy Laws and Regulations in Zimbabwe:
6
https://www.biometricupdate.com/202302/zimbabwe-govt-faces-criticism-over-biometric-surveillance-project-for-new-
smart-city
7
Understanding SI 155 of 2024: New Regulations on Data Protection Licensing and Data Protection Officers in
Zimbabwe
8
See footnote 2
9
MISA Zimbabwe. (2018). Digest: Facial recognition technology and privacy rights. Retrieved from MISA Zimbabwe
in Zimbabwe1011. While AIPPA aims to protect personal information, its provisions allow for
broad interpretations that can undermine privacy protections. For instance, Section 29(b) permits
public bodies to collect personal information for national security and law enforcement purposes,
which raises concerns about potential misuse of data collected through FRT. Moreover, the ICA
and extrajudicial monitoring. This is particularly concerning given recent reports indicating that
the Zimbabwean government has acquired facial recognition technology from foreign entities
like CloudWalk Technology Co., further expanding its surveillance capabilities without clear
regulatory oversight12.
In Madhuku v. Minister of Justice (2000), the Supreme Court of Zimbabwe emphasized the
necessity for legal frameworks that respect individual rights and freedoms 13. The court ruled that
any infringement on privacy must be justified under stringent legal standards. This case
underscores the importance of judicial oversight in protecting citizens' privacy rights against
potential abuses by state authorities. Another relevant case is Zimbabwe Lawyers for Human
Rights v. Minister of State for National Security (2021), where the High Court ruled against an
unlawful order by the Minister to shut down internet services during civil unrest 14. The court
highlighted that such actions infringe upon citizens' rights to freedom of expression and privacy,
reinforcing the need for accountability in government actions that affect personal liberties.
10
Interception of Communications Act (ICA)
11
Access to Information and Protection of Privacy Act (AIPPA)
12
Zimbabwe Fact Sheet | Data Protection Africa
13
Madhuku v. Minister of Justice, Constitutional Court of Zimbabwe, CCZ 1/2000,
14
Zimbabwe Lawyers for Human Rights v. Minister of State for National Security, High Court of Zimbabwe
Moreover, the recent enactment of the Data Protection Act (Chapter 11:22) aims to address
some of these issues by establishing a more robust framework for data protection 15. However,
critics point out that while this Act provides guidelines for processing personal data and
(POTRAZ) as the Data Protection Authority, it still lacks specific provisions addressing the
unique challenges posed by biometric data collection 16. For example, while the Act
criminalizes unlawful acquisition and disclosure of data, it does not adequately regulate how
While AIPPA has provided a foundation for privacy protection in Zimbabwe, its broad
provisions can lead to significant risks when applied to emerging technologies like facial
recognition. The lack of clarity regarding the scope and limitations of data collection for national
security purposes poses a direct threat to individual privacy rights. As such, there is an urgent
need for comprehensive regulations that specifically address the challenges posed by FRT to
One of the primary ethical issues associated with facial recognition technology is the violation of
individuals' right to privacy. The Access to Information and Protection of Privacy Act
(AIPPA) allows public bodies to collect personal information for national security purposes,
which can be interpreted broadly and may facilitate mass surveillance practices without adequate
oversight or accountability. The ethical implications of such practices are profound. Citizens
may find themselves monitored in public spaces without their knowledge or consent, creating a
chilling effect on free expression and assembly. As noted in various studies, including those
15
Data Protection Act
16
The Engine Room. (2020). Digital ID in Zimbabwe: A case study. Retrieved from The Engine Room
discussed by TechRepublic, the lack of transparency regarding how facial recognition data is
collected and used raises significant ethical concerns about informed consent and individual
another ethical concern. In many cases, there are insufficient legal frameworks governing how
FRT is implemented and monitored. The absence of clear guidelines can lead to misuse by both
government entities and private companies 18. For example, if law enforcement agencies use FRT
without proper oversight, there is a risk that they may target specific groups based on flawed
protection and privacy rights related to biometric data, particularly in the context of facial
recognition technology (FRT). The Cyber and Data Protection Act (2021) represents progress
but requires further refinement to effectively address challenges posed by FRT 20. It is essential
for the Act to include provisions that define biometric data as sensitive personal information,
regulate the collection, storage, and sharing of facial recognition data, and establish strict
guidelines for cross-border data transfers, particularly regarding partnerships with foreign
companies like CloudWalk and Digi Soft Technology 21. Without such regulations, there are
significant risks of unauthorized access and misuse of personal data. Given the increasing
laws that set clear limits on surveillance activities conducted by state authorities, require
18
Ethical Compliance for Facial Recognition Technology
19
The Ethics of Facial Recognition - Thales GroupOLOID’s Accurate, Ethical, Unbiased Facial Recognition
Passwordless Authentication Solution
20
Cyber and Data Protection Act (2021)
21
The Ethics of Facial Recognition Technologies, Surveillance, and Law Enforcement:
regarding surveillance activities and expenditures. Such legislative measures would ensure
that surveillance technologies are employed solely for legitimate purposes, such as crime
QUESTION 2
As ZimTel embarks on its ambitious project to roll out 5G infrastructure across Zimbabwe, it
faces a myriad of legal and regulatory challenges that must be addressed to ensure a
comes the necessity for compliance with local laws and international standards. This legal
opinion aims to provide guidance on four critical issues: the acquisition of additional
compliance with data protection laws in the context of cross-border data transfers, and
adherence to net neutrality principles. By navigating these concerns effectively, ZimTel can
not only align itself with Zimbabwe's regulatory framework but also maintain its competitive
To begin with , in order to proceed with its 5G rollout, ZimTel must navigate Zimbabwe’s
12:05] to regulate spectrum allocation to ensure efficient use and equitable distribution of this
22
Public Video Surveillance: Is It an Effective Crime Prevention Tool?
limited resource 23. According to Section 35 of the Act, spectrum licenses are granted based on
public interest, technical feasibility, and economic viability, which POTRAZ evaluates before
Zimbabwe (Pvt) Ltd v POTRAZ (2015), where the court underscored the necessity for fair and
equitable allocation to promote competition 24. In this case, POTRAZ was challenged over
spectrum in a manner that upholds competition and serves the public good. Drawing from this
precedent, ZimTel should ensure that its application for additional spectrum is backed by a
clear demonstration of how its 5G infrastructure will benefit both the economy and the public.
This approach aligns with the transparency and non-discrimination principles reinforced by
Zimbabwean courts and may strengthen ZimTel’s case for securing the required spectrum
licenses25.
and universal access. The Postal and Telecommunications Regulatory Authority of Zimbabwe
(POTRAZ) has the authority to mandate infrastructure sharing under the Postal and
Telecommunications Act [Chapter 12:05] if it serves the public interest and promotes efficient
23
Postal and Telecommunications Act [Chapter 12:05]
24
Telecel Zimbabwe (Pvt) Ltd v POTRAZ & Ors (HC 3975 of 2015) [2015] ZWHHC 446 (12 May 2015)
25
Licensing Processes - https://baz.co.zw/licensing-overview/licensing-processes/
26
Postal and Telecommunications Act [Chapter 12:05]
duplication of resources, reduce costs, and expand connectivity, particularly in underserved
areas27.
ZimTel’s position against compulsory sharing stems from concerns that sharing its newly
built 5G infrastructure could diminish its competitive edge, as it would allow smaller
competitors to benefit from ZimTel’s investment without incurring equivalent costs. This
issue was addressed in NetOne Cellular (Pvt) Ltd v Econet(Pvt) Ltd(2018), where the court
infrastructure investments 28. The ruling emphasized that while infrastructure sharing is
beneficial to market competition, it must not undermine the incentives for companies to invest
in advanced technologies. Drawing from this case, ZimTel may argue that mandatory sharing
should be approached cautiously to avoid eroding its commercial advantage, especially given
the significant capital investment required for 5G infrastructure. 29Therefore, ZimTel could
which would allow it to recoup its investment while meeting regulatory requirements 30.
Engaging with POTRAZ to negotiate fair terms for any mandated sharing arrangement could
help ZimTel protect its interests while supporting broader network access across Zimbabwe 31.
To ensure compliance with Zimbabwe’s data protection laws and maintain adherence to net
neutrality principles, ZimTel must navigate several regulatory requirements, especially in the
governed by the Data Protection Act [Chapter 11:22,which establishes obligations regarding
27
See footnote 26
28
Netone Cellular (Private) Limited & Another v Econet WIreless (Private) Limited & Another (Civil Appeal 695 of
2015; SC 47 of 2018) [2018] ZWSC 47 (8 August 2018)
29
National ICT Policy (2016
30
ITU Recommendations on Infrastructure Sharing
31
Competition Act [Chapter 14:28]
the handling, processing, and transfer of personal data. Under Section 18 of the Act, the
transfer of personal data to foreign entities is restricted unless the receiving country provides
an adequate level of data protection, ensuring that citizens' data privacy rights are not
compromised32. ZimTel must therefore ensure that its international partners comply with these
Services (2021), the High Court underscored the importance of protecting citizens' data
privacy and emphasized that any entity handling Zimbabwean data, especially in partnerships
with international entities, must prioritize compliance with local data protection
requirements34. This precedent suggests that ZimTel must assess its international partners' data
protection policies and potentially implement binding corporate rules or data processing
agreements to ensure that the cross-border transfer of data adheres to Zimbabwe’s regulatory
standards35.
POTRAZ and reinforced through the principles of fair competition, mandates that service
providers must not discriminate against particular content providers or services. This aligns
with global net neutrality principles, which prohibit internet service providers from offering
preferential speeds or access to specific platforms. While Zimbabwe currently lacks a specific
32
Data Protection Act
33
General Data Protection Regulation (GDPR
34
MISA Zimbabwe v Minister of Information, Publicity and Broadcasting Services, Constitutional Court of Zimbabwe,
CCZ 2/16
35
statute on net neutrality, POTRAZ’s general guidelines promote an open internet. In line with
the High Court’s decision in Telecel Zimbabwe (Pvt) Ltd v POTRAZ (2018), which
exclusive access to certain content providers to align with net neutrality principles and prevent
navigate these issues, ZimTel must adopt a proactive and strategic approach. This
includes ensuring compliance with the spectrum licensing procedures set forth by
its commercial interests. Additionally, ZimTel must prioritize compliance with data
could alienate consumers and civil society groups. By effectively managing these
challenges, ZimTel can not only align with Zimbabwe's regulatory framework but
landscape.
36
Telecel Zimbabwe (Pvt) Ltd v POTRAZ & Ors (HC 3975 of 2015) [2015] ZWHHC 446 (12 May 2015)
Question 3
and access to information across the African continent 37. Adopted by the African Commission
on Human and Peoples' Rights (ACHPR), this Declaration serves as a modernized framework
that addresses traditional media freedoms and the growing influence of digital technologies.
Built on Article 9 of the African Charter on Human and Peoples' Rights, which guarantees the
right to receive, impart, and access information, the Declaration updates the 2002 principles
by responding to new challenges such as online censorship, data privacy, and digital access. It
also aims to harmonize African standards with global human rights norms, emphasizing the
interests, such as protecting national security and public health. In doing so, it establishes that
37
Declaration of Principles on Freedom of Expression and Access to Information in Africa (2019) by the African
Commission on Human and Peoples' Rights (ACHPR).
38
See footnote 13
any limitations on these rights must meet strict criteria of legality, necessity, and
proportionality. Additionally, it affirms the vital role of media diversity, the protection of
journalists, and the public's access to digital platforms. In the landmark case of Lohé Issa
Konaté v. Burkina Faso (2014), the African Court on Human and Peoples’ Rights underscored
the importance of such protections, ruling that freedom of expression must not be excessively
restricted, especially where it serves the public interest 3940. By establishing clear guidelines,
the 2019 Declaration aims to foster an environment where freedom of expression and access
to information are safeguarded, supporting the broader goals of human rights and democratic
(2019) provides a critical framework for safeguarding the rights of journalists and promoting
transparency across the continent. This Declaration emphasizes that freedom of expression is
essential for democracy and good governance, urging states to create an environment where
case law illustrates both the challenges and advancements in protecting journalistic freedoms,
One pivotal case is Chimakure & Others v. Attorney General, where the Constitutional Court
ruled that criminal provisions penalizing false statements had a chilling effect on freedom of
expression, declaring that the maximum penalty of twenty years was excessively harsh and
39
International Federation of Journalists (IFJ) - IFJ Report on Lohé Issa Konaté Case
40
Lohé Issa Konaté v. Burkina Faso, Application No. 004/2013, African Court on Human and Peoples' Rights,
Judgment delivered on December 5, 2014.
41
African Commission Publishes Revised Declaration- Centre for Human Rights, University of Pretoria
inconsistent with democratic principles 42 43. The court emphasized that freedom of expression
should not depend on the truthfulness of statements made, reinforcing that even false
statements deserve protection under the law. Similarly, in Chavunduka & Anor v. Minister of
Home Affairs, the Supreme Court declared unconstitutional a law criminalizing “false news,”
asserting that it imposed unjustifiable limitations on freedom of expression 44. The court noted
that such laws could lead to self-censorship among journalists, ultimately undermining public
discourse. In Scanlen & Holderness v. Zimbabwe, the African Commission on Human and
Peoples’ Rights criticized onerous accreditation requirements for journalists, stating that such
45
regulations infringed upon the rights to freedom of expression and access to information .
This aligns with the Declaration's call for legal frameworks that protect journalists from undue
In South Africa, similar principles have been reinforced through landmark cases such as S v.
Manamela, where the Constitutional Court asserted that freedom of expression includes the
right to express unpopular views without fear of retribution 47. The court highlighted that any
limitations on this right must meet strict criteria under the South African Constitution,
mirroring standards set out in the 2019 Declaration. Another relevant case is Khumalo v.
42
Constantine Munyaradzi Chimakure, Vincent Kahiya, and Zimind Publishers (Pvt) Ltd v. The Attorney-General of
Zimbabwe, Constitutional Court of Zimbabwe, CCZ 14/2014
43
[PDF] PUBLIC STATEMENTS PREJUDICIAL TO THE STATE Chilling freedom of ...
https://zimlii.org/akn/zw/doc/journal-article/2017-02-28/public-statements-prejudicial-to-the-state-chilling-
freedom-of-expression-to-the-bone-with-a-chilling-offence-case-note-on-chimakure-others-v-attorney-general-
2013-2-zlr-466-s/eng%402017-02-28/source.pdf
44
Chavunduka & Anor v. Minister of Home Affairs, Supreme Court of Zimbabwe, SC 1/2000
45
Scanlen & Holderness v. Zimbabwe, African Commission on Human and Peoples’ Rights, Communication No.
313/05
46
United Parties v. Minister of Justice, Supreme Court of Zimbabwe, SC 5/1997,
47
S v. Manamela and Another (Director-General of the Department of Justice Intervening), Constitutional Court of
South Africa, CCT 54/00
Holomisa, where the court ruled in favor of a politician defamed by a newspaper article,
emphasizing that while reputational rights are important, they should not unduly restrict
academic freedom and expression in educational institutions, reinforcing that these freedoms
are vital for fostering critical discourse 49. The case of Mediaclub v. South African
Broadcasting Corporation further illustrated how media entities must be allowed to operate
freely without undue interference from state bodies 50. Lastly, in Tiso Blackstar Group v.
Minister of Home Affairs, the court ruled against government attempts to restrict media
coverage during elections, affirming that a free press is essential for democratic processes 51.
These cases collectively illustrate the ongoing struggle in both Zimbabwe and other African
countries to align national laws with international standards for freedom of expression as
articulated in the 2019 Declaration. They underscore the necessity for continued advocacy and
reform to ensure that journalists can fulfill their critical role in society without facing legal
guide for African nations to enhance protections for journalists and foster a more open and
democratic environment.
Data surveillance and the protection of privacy rights are critical issues addressed by the
48
Khumalo v. Holomisa (CCT 12/00), Constitutional Court of South Africa
49
Makhanya v. University of Zululand (CCT 12/09), Constitutional Court of South Africa
50
Mediaclub (Pty) Ltd v South African Broadcasting Corporation Ltd (A1654/06), High Court of South Africa
(Gauteng Division)
51
Tiso Blackstar Group (Pty) Ltd v Minister of Home Affairs and Others (A1864/18), High Court of South Africa
(Gauteng Division)
52
African Court on Human and Peoples’ Rights. (2013). Media Rights Agenda v. Nigeria
(2019), particularly in Principles 40 and 41, which call for safeguarding personal data and
limiting state surveillance to comply with human rights standard 53s. In Zimbabwe, the Data
Protection Act [Chapter 11:12], enacted in December 2021, establishes a legal framework
aimed at enhancing data privacy and protecting individuals from unlawful surveillance
practices54. The Act mandates that personal data be processed fairly and securely, requiring
data controllers to adhere to strict guidelines regarding the collection and handling of personal
information55.
highlighted concerns over the legality of surveillance practices under the Access to
Information and Protection of Privacy Act, which has been criticized for infringing on privacy
President of the Republic of South Africa (2006) reinforced the necessity of a transparent
accountability57. Moreover, in Tshwane City v. Afriforum (2019), the court acknowledged the
implications of data collection on citizens' rights, suggesting that surveillance without consent
could infringe on the right to privacy as enshrined in the Constitution 58. Additionally, the
South African case of Black Sash Trust v. Minister of Social Development (2017) focused on
the need for transparency in governmental data management, arguing that individuals should
have access to information on how their data is collected and used. Collectively, these cases
53
Declaration of Principles on Freedom of Expression and Access to Information in Africa (2019
54
Data protection Act Zimbabwe
55
African Court on Human and Peoples’ Rights. (2015). Mbanza v. Angola.
56
Kudakwashe Munetsi v. Minister of Home Affairs, Zimbabwe High Court, 2020.
57
Matatiele Municipality v. President of the Republic of South Africa, 2006 (6) SA 477 (CC
58
Tshwane City v. Afriforum, 2019 (2) SA 215 (CC
illustrate the complex interplay between surveillance, privacy, and freedom of expression
Information in Africa (2019) serves as a crucial instrument for advancing human rights across
the continent, particularly regarding data privacy and surveillance issues. By establishing
clear guidelines for protecting personal data and limiting state surveillance, it aligns with
The case law from Zimbabwe and South Africa demonstrates both progress and challenges in
implementing these principles, highlighting the need for continued advocacy and reform to
ensure that individuals' rights are upheld in an increasingly digital world. As African nations
work towards these goals, they can draw upon these legal precedents to foster an environment
59
Black Sash Trust v. Minister of Social Development, 2017 (4) SA 246 (CC).