In a landmark judgement delivered yesterday (Amabhungane v Minister of Justice), the North Gauteng High Court in South Africa ruled large parts of the South African surveillance law unconstitutional. With this progressive ruling, South Africa joins the European Court of Human Rights in requiring surveillance regimes to conform to strict standards of proportionality and of procedural and substantive safeguards, designed to protect the right to privacy.
At issue before the High Court was the Regulation of Interception of Communications Act [“RICA”]. The RICA set out the legal framework facilitating and regulating State surveillance in South Africa. It required surveillance requests to be authorised by a retired judge (“the designated judge”), and the judge, in turn, had to submit an annual report to Parliament; surveillance requests had to be highly detailed and specific, setting out the identity of the target, the grounds for surveillance (which were limited to serious offences and threats to national security), the gravity of the suspected offence, and disclosing (among other things) whether less intrusive methods had been tried and found not to be feasible, the proposed period of surveillance, and so on. These factors had to be taken into account by the designated judge, before deciding whether or not to grant a surveillance request. Surveillance requests could be real time, as well as requests for accessing past communications, stored by telecom companies.
It will be immediately noted that the RICA was already cognisant of privacy, to an extent greater than we ordinarily see in legislation (or even judicial opinions). For example, the requirement that surveillance requests must be approved by a judge is already two steps ahead of the Indian Supreme Court’s judgement in PUCL v Union of India, where an identical argument was rejected, and bureaucratic control of surveillance decisions was deemed to constitute an adequate safeguard of constitutional rights. Similarly, the highly specific justifications for surveillance went some way towards fulfilling the constitutional requirement of necessity and proportionality, and having that requirement adjudicated by a judicial mind. Therefore, the constitutional challenge in South Africa was already beginning from a (relatively) high baseline of privacy protection.
In this context, the applicants made further challenges to the statute, arguing that even in its present form, it was insufficiently protective of privacy (and other constitutional rights). Before examining the challenges, it is important to note, also, the analytical framework that the Court brought to this case. The Court began by noting that “prohibition of interception is the point of departure, reflecting the privacy norm embodied in Section 14 of the Constitution … [but sometimes] exceptions to the prohibition are created for law enforcement officers and security officials.” (paragraph 29) In its analysis of RICA, the Sutherland J. then went on to note that:
What does a qualitative assessment of RICA yield? The value of privacy is privileged and expression is given to the idea that where exceptions to respect for privacy are to be allowed, a high threshold of justification is stipulated. Self-evidently, to trespass into the private realm is permissible only to the extent that a superior claim to do so can be made out on grounds of necessity. This implies that other means to achieve the aims of the interception would have been ineffective, and the gravity of the circumstances outweighs the primary value of privacy. The safeguards model recognises the need for an independent authority to approve interceptions. This model, in which the person desiring the interception is distinct from the person authorising it, is designed to prevent, as far as possible, abuse of the system. Self-evidently, the approving authority’s efficacy in achieving this aim is dependent on the information made available to that authority, ie the designated judge. (paragraph 35)
This analytical framework is important, because it forms the backdrop of the analysis that would follow. The idea that privacy is the default and interception the exception is crucial, because it is this framing that puts the burden of justification upon the government. It is the government that has to show that other means would be ineffective (the requirement of necessity), that the interests are overriding (proportionality), and that the procedural safeguards (independent checking authority) are in place. And this framing also ensures that where there are interpretive gaps or ambiguities, those ambiguities (as we shall see) will be resolved in favour of the individual, and against the State. These may all sound very basic principles, but in an age where (as K.G. Kannabrian reminded us) the restrictions – instead of the rights – have become “fundamental”, their restatement is always important and valuable.
The Applicants’ first challenge was that the RICA did not provide for notice to the target of surveillance, even after the surveillance had ceased. The requirement of notice, the Applicants argued, was essential to securing access to justice and access to the courts (a guaranteed right under the South African Constitution). This was the only way to ensure accountability (because obviously, notice before surveillance would be literally self-defeating), check the abuse of surveillance, and provide targets with an adequate remedy in case it turned out that the surveillance was abusive.
Drawing from the legal position in the United States, Canada, Japan, and the ECHR, Sutherland J. agreed, holding that “the norm is that unless reasons exist not to give notice, notice shall be given (paragraph 47). Now, there might exist a small subset of cases (such as treason or espionage), where perpetual secrecy was necessary – but that could not be the norm. Consequently, Sutherland J. adopted a remedy that is commonly used in South Africa: he declared existing provisions unconstitutional, suspended the declaration of unconstitutionality by two years to give Parliament time to rectify the defects, and in the meantime, read in a provision into the Act, requiring that the target of surveillance be notified within ninety days after the cession of surveillance (paragraph 53). Sutherland J. also added that in exceptional cases, the designated judged could extend the period to 180 days at a time – but if it went beyond three years, a three-member judicial panel would be required to rule on any further extension.
Independence and Due Process
It should be obvious from the above that a lot would turn upon the designated judge, her character and her independence. Under the RICA as it stood, the designated judge was appointed by the government. The Applicants argued that this compromised independence, a position that – as Sutherland J. pointed out – was not “met with any serious rebuttal” (paragraph 63). The Applicants proposed that the designated judge be appointed by the Judicial Services Commission, that was also responsible for appointments to the higher judiciary. Sutherland J. held, however, that the specifics of the appointment process required greater deliberation; therefore, as an interim measure, he directed that the appointment would be at the nomination of the Chief Justice (paragraph 71).
Equally importantly, the Applicants pointed to the lack of an adversarial process during the grant of surveillance requests; in other words, when a surveillance request was made, the parties present would be the government, and the designated judge. This, it was argued, violated the fundamental rule of audi alterem partem, or the right to be heard. The Applicants therefore proposed a familiar remedy – that a “public advocate” be appointed, who would argue such requests on behalf of the surveillance target (because, naturally, the target themselves could not be informed – see, for example, the proposals in the draft Indian Privacy Code). The government raised a familiar objection – that the designated judge, applying her judicial mind, should be trusted to sift the material impartially and objectively. In response, Sutherland J. noted – drawing from the analytical framework discussed above – that fundamental values are “to be reluctantly trampled on with as light a tread as possible.” (paragraph 74). While he did not read in a specific requirement of a public advocate, noting that it was only one of many possible options to secure a fair hearing and an adversarial process, he nonetheless struck down the relevant provisions of the RICA because of its failure to deal with the problem ex parte orders, and – once again – suspended the declaration of invalidity to allow Parliament to deal with the problem, on the basis of the principles indicated in the judgement.
Archiving and Processing
The Applicants’ third objection was that the RICA provided no safeguards with respect to how the collected data was archived and processed – including with respect to the telecommunication companies, which were required by law to store the data for up to three years. While Sutherland J. declined to find that the period of storage was too long – noting that there could be no bright-line determination in this regard (paragraph 95) – he did hold that the procedural safeguards with respect to storage and access had to be set out transparently in the statute itself, and not by means of secondary legislation (rules and directions) (paragraph 101). Furthermore, he found that there were no provisions dealing with erasure or management of surplus data, or with respect to oversight with regard to the stored data (paragraph 106). He therefore issued a suspended declaration of invalidity with regard to the relevant provisions of the RICA.
Special Exemptions for Lawyers and Journalists
An interesting challenge made by the Applicants was that lawyers and journalists – by their vary nature – required heightened protection from surveillance; lawyers because of attorney-client privilege, and journalists because of the overriding imperatives of protecting anonymous sources. Sutherland J. agreed with the principle, noting in particular the importance of investigative journalism to any free society (the South African Constitution also guarantees specific protection to the press); exceptions were limited to serious cases such as espionage or violations of human rights (paragraph 133). Accordingly, he read into the Act a positive requirement that if the target of surveillance was a lawyer or a journalist, that fact would have to be revealed to the designated judge, who would take it into account while deciding whether or not to grant the surveillance request.
Sutherland J.’s analysis is particularly interesting when we juxtapose it with the Indian Supreme Court’s repeated insistence that the press is on par with every other citizen, and cannot claim any specific privileges under Article 19(1)(a). While the Indian Constitution does not provide explicit protection to the press (unlike the South African), the argument is a red herring: it is nobody’s case that journalists have a special status or additional rights; the argument is that the practice of journalism – an integral element of the freedom of speech and expression, in its avatar of protecting the free flow of information in a democratic society – requires a certain kind of protection if it is to be meaningful at all; and that protection flows from Article 19(1)(a). It is this analysis that shines through clearly in Sutherland J.’s judgement.
The Illegality of Bulk Surveillance
The Applicants’ final argument was that the RICA did not authorise bulk or mass surveillance (i.e., surveillance without probable cause, where dragnets are placed that capture, for instance, all communications using certain keywords, that are later mined for information). In response, the government relied upon another statute – the National Strategic Intelligence Act, which allowed for the gathering, correlating and analysing of intelligence. It was here, once again, that the analytical framework we discussed at the beginning of this post became relevant; because in the absence of specific authorisation of bulk surveillance, Sutherland J. found that it could not be implied into either the NSIA or the RICA (paragraphs 151 & 163). As he noted, “Our Law demands such clarity, especially when the claimed power is so demonstrably at odds with the Constitutional norm that guarantees privacy.” (paragraph 163) He did not, however, pronounce on the constitutional validity of bulk or mass surveillance per se.
The minutiae and details of Sutherland J.’s judgment are, of course, fascinating to privacy scholars and lawyers. There are, however, a few broader points to take home. The first is his clear insistence that privacy is the default and surveillance the exception, and then actually following through by applying that framework in adjudicating the constitutionality of specific surveillance provisions. And flowing from this is a particularly important point: Sutherland J. did not write an activist judgement, with free-wheeling claims about the unconstitutionality of surveillance in general, or prohibiting all forms of surveillance; in this, he was appropriately deferential to the law-making authorities. Deference, however, does not mean subservience, or writing a blank cheque to the government under the guise of national security or public safety. Rather, Sutherland J. required the government to explain and justify the need for each impugned provision of the RICA; and where the government was not able to provide a satisfactory explanation (and indeed, as evident above, many of those issues involved little more than pure common sense!), the provision was struck down or read down. Under the garb of deference, therefore, Sutherland J. did not hide from his duty to examine surveillance provisions under constitutional standards of necessity and proportionality, and to ensure that even the surveillance authorities were bound by the rule of law. This is particularly important for us, in a time where India’s surveillance infrastructure is opaque, its legislative foundations unclear, the constitutional status of bulk surveillance unclear, constitutional challenges pending, and a Court that increasingly uses “national security” as a mantra to flee the field of adjudication. Sutherland J.’s judgement is a timely reminder of how courts ought to work in holding the executive to account under a constitutional framework/