Data Protection Bills Threaten Right to Privacy and Expression in Malawi
Parliament in December 2023 passed the data protection bill, but it remains to be seen if the president will assent into law.
Lilongwe, Malawi-In April 2022, Malawi police arrested a prominent investigative journalist, Gregory Gondwe over a story that exposed irregularities in government contracts, writes Charles Pensulo.
The story published on Platform for Investigative Journalism for which he is executive director exposed how the Attorney General facilitated payments to a businessman who is under investigation by the UK's National Crime Agency and the Malawi Anti-Corruption Bureau.
The police seized the reporter’s IT equipment including phones and laptops to trace and force the reporter to disclose the source of the information.
Gondwe was later released following criticism from MISA Malawi and the Media Council of Malawi, with the government spokesperson saying they will investigate the circumstances which led to the arrest.
However, critics have always pointed out that the government has been collecting citizens’ information without corresponding data protection frameworks for the protection of the people.
Experts say data centralization paves the way for state surveillance and note that in Malawi, evidence of state surveillance is emerging.
Between 2021 and 2022, over eight people have been arrested, and two of them have been convicted for their various online activities, according to a digital rights expert.
Jimmy Kainja said: "However, one thing that stands out from these arrests is that those detained had allegedly offended influential people in the country, including the State President, a Member of Parliament and one of the big banks."
Kainja who is also a senior lecturer in communications and cultural studies at Chancellor College of the University of Malawi cited an example of a case concerning one Chidawawa Mainje, a nurse who was arrested on 1 May 2022.
His arrest came over a WhatsApp political conversation and was charged under section 86 of the Electronic Transactions and Cyber Security Act of 2016.
The section criminalizes the use of computers for making any request, suggestion or proposal which is'obscene, lewd, lascivious or indecent'.
It also prohibits 'threatening to inflict injury or physical harm to the person or property of any person'.
"WhatsApp has end-to-end encryption, which means this discussion was not open to the public, yet the police moved in to arrest an individual over a private conversation," Kainja wrote back then.
Gondwe was however arrested under a slightly different provision of the same act which activists have always said has loopholes and could be used to silence those who are considered to have dissenting opinions.
"I got arrested for doing journalistic work. What the state demanded from me is unheard of in the modern democratic dispensation because they wanted me to reveal my source," Gondwe said in an interview.
He was charged under section 91 of the same act which says any person who transmits any unsolicited electronic information to another person 'for illegal trade or commerce or other illegal activity' commits an offence and shall, upon conviction, be liable to a fine of K2,000,000 and imprisonment for five years.
"But as you can see, I exposed wrongdoing in government using a memo that Attorney General Thabo Chakaka Nyirenda had authored," he said.
"And the police had to use this law and labelled our journalistic action as spamming. This is running out of ideas to gag the media.”
Executive Director at the Centre for Human Rights and Rehabilitation Michael Kaiyatsa said his organization has documented over 20 cases since 2019 where authorities have used 'retrogressive provisions to stifle freedom of expression of online users, journalists, bloggers and human rights defenders'.
"For instance, [the legislation] states that online communication may be restricted to “protect order and national security,” while article 24 states that online communication may be restricted to “facilitate technical restriction to conditional access to online communication.”
The Act also penalizes what is termed as “offensive communication” via Information and Communications Technology (ICT) with penalties of fines or a maximum 12-month prison sentence.
"Such provisions have facilitated digital rights violations in Malawi, which have lately taken many forms, including state surveillance, access restrictions to the internet and criminalization of some forms of online communication," he said.
Kaiyatsa observes online surveillance undermines the privacy of communications and the right to anonymity, consequently leading to self-censorship and the withdrawal of some individuals and groups from the online public sphere.
Gondwe said hours leading up to his arrest the law enforcers had to 'eavesdrop' on his mobile phone communication and speak to his younger sister.
He believes this was a form of harassment to force her to disclose more about him 'as if it was going to be hard just to give me a call and talk'.
"So, when you look at press freedom, I can declare without fear of reprisals that we don't have it because the police are still being used wrongly to settle political issues…", he said.
The result, according to the activist is the derailment of freedom of speech and freedom of the press and expression "which allows them to operate willy-nilly and without being called to account.'
Kaiyatsa said as activists, they have engaged various authorities, including members of parliament, to remove the problematic provisions in the Cyber Security Act.
"We're considering moving the Courts to review the constitutionality of some of the provisions in the act, particularly to determine whether the restrictions on online communication are in line with the right to freedom of expression, freedom of the press and the right to access of information enshrined in the Constitution," he said.
"The biggest implication is that it makes you vulnerable as a journalist. Journalists can only be safe if they continue to exercise vigilance and pro-activeness whenever they come under threat from the authorities," noted Kainja.
The minister of information did not respond to requests for comments.
Kainja said there are legislations that "can facilitate state surveillance", primarily the mandatory SIM card registration and the national ID.
In 2016, Malawi passed the Communications Act of 2016 to make SIM card registration mandatory. People are required to provide their full name, identity card number or other ID, residential and business addresses, and 'any other information the telecommunications provider deems necessary'.
The national ID has allowed for data centralization, according to Kainja. He however admitted various states always have the means of monitoring what their citizens are doing.
Kainja also suggested that the law on defamation should be civil, and not criminal as its the current situation since it facilitates some of these arrests. As it stands, the law currently is being used to protect influential individuals and institutions against ordinary citizens, he said.
"It has a chilling effect and curtails freedom of expression, which the Constitution protects," he added.
Parliament in December 2023 passed the data protection bill, but it remains to be seen if the president will assent into law.
Meanwhile, the date of operationalisation is yet to be decided.
But MISA Malawi has since commended Members of Parliament for the passing of the 'long-awaited bill' writing the absence of data protection law in Malawi has resulted in compromised privacy.
"We believe, if assented, the Bill will protect Malawians and the general public from cyber threats, cybercrimes and unwarranted surveillance," the statement read.
The bill provides, among other things, key definitions, data processing principles, data subject rights, obligations of controllers and processors, breach notification requirements, and provisions on cross-border transfers.
This work was produced as a result of a grant provided by the Africa-China Reporting Project at the Wits Centre for Journalism at the University of the Witwatersrand, Johannesburg. The opinions held are of the author.