Digitalization 2.0: Privacy law

Law is an adaptive resource that can and should respond to disruptive technological change by re-examining existing concepts and creating new, more adequate conceptions. This was the basic problematic of the famous and foundational article by Warren and BrandeisFootnote ¹³ in which they proposed that privacy should be recognized as a specific delictual right in light of the harms to individuals created by new technologies, like hand-held cameras.Footnote ¹⁴ In their articulation, this was a “right to be left alone”.Footnote ¹⁵

Digital technology today is more than a step beyond hand-held cameras. Today, privacy law should direct attention to the amplification of the privacy harms arising from “datafication” and “smartification” associated with mobile computing, cloud computing, the Internet of Things, machine learning, data mining and predictive analytics. An article of Daniel Solove's, although published some time ago, provides a useful starting point for assessing these enhanced risks and harms. There are four basic groups of potentially harmful activities under his taxonomy: information collection; information processing; information dissemination; and invasion.Footnote ¹⁶

Solove's taxonomy can, for the most part, accommodate an analysis of the risks to privacy in the current period of accelerated digitalization, but with some modifications. The amplified risk associated with digitalized “Big Data” of intentional and negligent data spills resulting from the failure of public and private record-keepers to secure their databases, for example, can be understood with reference to the risks inherent in the collection, aggregation and processing of increasing volumes of information across data sets by numerous public and private organizations.Footnote ¹⁷ Solove also anticipates the harms associated with decision-making concerning the “digital person” based on pooled data from many data sources. However, he does not specifically discuss the harms related to data mining and predictive analytics increasingly relied upon by public organizations to allocate public benefits and by private commercial organizations to monitor the preferences and behaviours of their customers. In this regard, Sandra Wachter and Brent Mittelstadt have recently usefully argued that the 2018 EU General Data Protection Regulation grants individuals little control over how their personal data is used to draw inferences that might damage their privacy and reputation, and that there is therefore a need for a new data protection right to “reasonable inferences”.Footnote ¹⁸

Soloves's taxonomy also usefully recognizes the structural impact of state surveillance (enabled by the new digital technologies) on power dynamics between states and individuals.Footnote ¹⁹ But his focus on the harms to the individual misses the systemic and collective nature of privacy harms that is now becoming evident. As Carissa Veliz notes, “[p]rivacy is not only about you … [p]rivacy is as collective as it is personal … privacy resembles ecological issues and other collective action problems”.Footnote ²⁰ That your data is personal seems to imply that you are the only concerned party when it comes to sharing it, but this is not necessarily the caseFootnote ²¹ as, for example, the sharing of genetic information can impact on others in a family group.

These externalities and information asymmetries have important implications for how we think about the harms and risks to which privacy law must respond today. They call into question the framing of privacy as an exclusively individual and private right designed to remedy discreet, direct and immediate harms to individuals. Both the common law and statutory data processing law (focusing largely on notice and consent) are based on this conceptual edifice. However, this individualistic framing of the privacy right is no longer fully adequate when “we ourselves are utterly enmeshed in technological systems, which shape in turn how we act and how we think. We cannot stand outside them. We cannot think without them”.Footnote ²² Data protection itself may implicate other rights beyond privacy, such as equality and dignity.

The addition of a group of activities potentially harming our social and collective existence through their systemic impact (akin to Solove's item of “invasion” but without its individualistic conceptualization) would be a valuable modification to his typology of potentially harmful groups of activities. The following sections present arguments to support the idea that privacy should be reframed from a public law perspective as both a private and a public good, essential to the functioning of a constitutional democracy.

Digitalization 2.0: The state and capital

Solove's 2006 analysis of the privacy harms that arise from the information practices of public authorities also pays insufficient attention to the way digitalization augments the state's powers of surveillance and the contemporary accretions of private power associated with platform companies like Facebook, Amazon and Google. It has become increasingly clear that the analysis of the privacy harms associated with digitalization must be situated within the context of the political economy of what can be termed “surveillance capitalism”Footnote ²³ or “digital capitalism”.Footnote ²⁴

The modern bureaucratic state apparatus has always had to map its subjects and citizens systematically, by gathering and recording information in order to carry out its public functions.Footnote ²⁵ Even those holding a restrictive view of the state's economic and social functions accepted the HobbesianFootnote ²⁶ view that the state had to provide security and that its policing powers had to include powers of search and seizure.Footnote ²⁷ Digitalization exponentially expands the contemporary state's bureaucratic powers of computation, controlFootnote ²⁸ and surveillance, leading some scholars to turn to Foucaudian concepts such as biopower and disciplinary power to examine the way digitalization is fundamentally restructuring power relations between individuals and the state: “[t]he symbol of disciplinary power is the panopticon … The symbol of control is the computer network that invisibly, constantly and continuously records every action … control systems do not rely on mere threats of surveillance. They follow through on monitoring, judging and inhibiting your freedom”.Footnote ²⁹

Law enforcement agencies in many countries are also increasingly relying on “big data” to investigate crime, as well as on dragnet surveillance technologies like CCTV cameras, GPS locational technologies and drones purchased from companies manufacturing the high-tech tools for “smart policing”.Footnote ³⁰ Such technologies operate at a wholescale or systemic, rather than individual, level. These capabilities are of undoubted value in combatting sophisticated organized crime and transnational crimes such as money laundering. However, pervasive, systemic surveillance comes at a substantial cost to privacy and the freedoms that are essential to our ability to function and flourish as a community.

The extent to which the South African Police Service is relying on these technologies is not publicly known because of inadequate oversight mechanisms and constraints on parliamentary reporting.Footnote ³¹ Also, under South African law, law enforcement agencies have not been required to observe the statutory processing rights of data subjects and so are not constrained by principles of data minimization when investigating actual crimes or even suspected criminal conduct.Footnote ³² Digitalized surveillance and crime investigation techniques based on data analytics obviously raise some important questions about the adequacy of search and seizure privacy laws, premised on a now-obsolete conception of a spatial boundary between public and private space.

To situate the threats to privacy (threats to the functioning of constitutional democracies in the digital age) properly, it is necessary to focus on these accretions of state power, as well as on the “logic of accumulation” in the age of surveillance capitalism:Footnote ³³ ownership of the “means of behavioural modification eclipses ownership of the means of production as the fountainhead of capitalist wealth and power in the 21st century”.Footnote ³⁴ Consciously invoking Marx, Shoshana Zuboff shows how an extractive economic logic has developed on the infrastructural backbone of smart computing, which instrumentalizes the most human and personal experiences to the commercial ends of platform companies and turns personal data into capital.Footnote ³⁵ These network companies have morphed into behemoth monopolies whose competitive advantage is increasingly tied to their control of the “new oil” of personal data, which is sold to other businesses as a commercial asset. Protection of privacy rights is therefore now also a competition law issue.Footnote ³⁶ Where required to do so, information collected and aggregated on the infrastructural backbone of these platform companies is also passed on to the surveillance state, creating a symbiotic relationship between the state and capital. In these circumstances, a conceptualization of privacy as a private harm threatened only by state action is an obstacle to the development of a privacy law for the digital age.Footnote ³⁷ The harms associated with private commercial power must also be reckoned with.

Democratic self-government and privacy

Accretions of public and private power and surveillance, and monopolistic power associated with digital capitalism, have some important implications for the functioning of democracies as systems of democratic self-government, which requires us to think about the relationship between privacy and democracy. The harms to democracy arise from the processing capabilities of digital technologies, which have facilitated the dissemination of polarizing propaganda and false information. Reliable procedures for arriving at agreement on the facts by public deliberation are essential to the functioning of democratic societies that aim to structure conversation among a variety of opinions and interests. The capabilities enabled by digitalization have also weakened the mass media and political parties, and represent a real danger to the integrity of elections: the evidence is now clear that voter preferences can be manipulated through targeted advertising and psychological profiling.Footnote ³⁸ The accretions of private power associated with digitalization and their intersection with public power are also accentuating underlying tendencies towards plutocracy and oligarchy in constitutional democracies today.Footnote ³⁹ This undermines the claims of their systems of authority based on popular consent and political equality.

Therefore, the capabilities enabled by digital technologies and the power dynamics that have been unleashed require reinvigoration of a commitment to individual self-determination as well as to democratic self-government, and recognition of their interdependence. Under a public law paradigm, privacy today is much more than a negative individual rightFootnote ⁴⁰ not to be interfered with by the state. It is also required as a defence against private power and a positive right essential to the functioning of a constitutional democracy based on the rule of law. In the digital era and the current pervasive system of surveillance, we need a richer concept of the constitutional value of privacy in constitutional democracies, instead of merely the right “to be left alone”. Privacy must be understood as being integrally related to individual autonomy and agency.Footnote ⁴¹ In Bernstein v Bester, the first privacy case in South Africa in the post-apartheid era, Ackermann J pointed in this direction in introducing a “communitarian” reading of the value of constitutional privacy. He said: “the scope of privacy has been closely related to the concept of identity and it has been stated that rights like the right to privacy are not based on the notion of the unencumbered self, but on the notion of what is necessary to have one's own autonomous identity”.Footnote ⁴²

Understood in this way, privacy is not only a right to withdraw from society, but to be able to participate on respectful terms in a community of equals, without the constant external pressure of being watched, profiled and assessed by the state and commercial entities.Footnote ⁴³

Judicial review, constitutional rights and the principle of proportionality

There are two important but unremarkable ways in which the text of the Constitution augments the conceptual resources available for judicial reasoning in the field of South African privacy law. The first is that it entrenches (as do many modern constitutions and human rights instruments)Footnote ⁴⁴ a constitutional right to privacy. Section 14 of the constitutional Bill of Rights provides: “[e]veryone has the right to privacy, which includes the right not to have: (a) their person or home searched; (b) their property searched; (c) their possessions seized; or (d) the privacy of their communications infringed.”

It is important to note that the post-apartheid introduction of the Bill of Rights by no means extinguished the common law on the right to privacy, which continues as part of the South African legal system, albeit controlled by the Constitution as the supreme law. In addition, privacy legislation (which came fully into effect in mid-2021) created a statutory right to privacy and established a regulator for privacy rights, also with jurisdiction over the constitutional right of access to information.Footnote ⁴⁵

Secondly, beyond the entrenchment of this fundamental right to privacy, various other provisions of the Constitution read together create a strong system of judicial review. Section 7(1) provides that the Bill of Rights “is the cornerstone of democracy”, which, under section 7(2), the state is required to “respect, protect, promote and fulfil”. The Bill of Rights applies to all law and conduct,Footnote ⁴⁶ and binds the legislature, the executive and the judiciary.Footnote ⁴⁷ Section 167 concentrates the power to decide questions of constitutionality in the Court. This includes parliamentary legislationFootnote ⁴⁸ and “all law”, which must comply with the rights provisions of the Bill of Rights and the founding value of the rule of law.Footnote ⁴⁹ The Constitution can therefore be understood to establish a system of constitutional dialogue between the judiciary and the elected branches, which enhances the capacity of the legal system to respond to disruptive technological change.

In this fashion, the constitutional text already creates rich normative and interpretive resources for the judiciary to attribute meaning to the constitutional right to privacy as the centrepiece of privacy law in light of the harms associated with digitalization. Furthermore, the Bill of Rights also includes other fundamental rights, such as the rights to equalityFootnote ⁵⁰ and dignity,Footnote ⁵¹ which can support the development of a public law perspective. In a case concerning an action for defamation against a media company under common law, Kate O'Regan J said the following about the symbiotic relationship between the constitutional right to privacy and another constitutional right, the right to dignity:

The core constitutional value of dignity works in two ways: reinforcing privacy as a liberty that protects intimacy and individual choice from interference by the state or third parties; and recognizing and protecting an individual's interest in public estimations of an individual's worth. This conception has the potential to reach the harms associated with digitalization that are much less plausibly conceptualized as intrusions in protected spaces or individual decisions, including the right to control information about oneself that may be published or disseminated on digital platforms. Some jurisdictions, including South Africa, have therefore given recognition to a specific right to informational privacy.Footnote ⁵³

Constitutional rights to privacy and dignity in the Constitution are “strong” rights that cannot simply be weighed against some supposed public benefit.Footnote ⁵⁴ They can only be limited in accordance with principles of proportionality expressly set out in section 36 of the Constitution itself. This limitation clause provides:

Section 36 embeds the limitations analysis in the normative framework of a constitutional democracy. It therefore enables the court to undertake a broader harm analysis (which can include systemic harms) when assessing the constitutional adequacy of legal rules of general application, and to examine carefully both the ends and means of legislative decisions in light of the constitutional commitment to privacy and dignity. Mere utilitarian balancing of costs and benefits is obviously excluded.

Constitutional supremacy, subsidiarity and horizontality

The Constitution has distinctive features of subsidiarity and horizontality that further enhance the potential for constitutional law to respond to technological change. In its continued development of these doctrines in the “digitalization plus” age, the Court will have to stay abreast of rapidly changing technologies and shoulder much of the responsibility for the constitutional response.

The doctrine of subsidiarity consists in South Africa of the founding principle of constitutional supremacy,Footnote ⁵⁵ read with its correlate, the judge-made rule of subsidiarity. Parliamentary legislation must comply with constitutional norms to be valid. The legal norms created by legislation are therefore subsidiary ones. Where the wording of a constitutional right requires that the legislature give effect to the constitutional right,Footnote ⁵⁶ litigants are usually required to proceed in the first instance on the basis of the more concrete statutory right and not directly on the basis of the constitutional right.Footnote ⁵⁷ However, the Court has effectively embellished the statutory right with a constitutional gloss by insisting that a statutory right has to be interpreted in light of the norms of the more abstract constitutional right.Footnote ⁵⁸ So, the constitutional right provides the governing norm, even after the legislature has enacted legislation giving effect to a constitutional right.

In other places, the Constitution does not expressly require a legislative enactment; this is the case with the constitutional right to privacy (at least if that right is assumed to be sourced entirely in section 14). In any case and as noted above, giving at least partial effect to the constitutional right to privacy, Parliament enacted a privacy law in the form of data protection legislation, the Protection of Personal Information Act 2013 (POPIA).Footnote ⁵⁹

In a fascinating and significant case in January 2021, the Court grappled with the doctrine of subsidiarity precisely at the interface between common law and a statute giving effect to a constitutional right, the right to equality. In King NO and Others v De Jager and Others,Footnote ⁶⁰ the Court had to decide whether to develop the common law or to depend on the Equality Act to counter the effects of gender discrimination while enforcing the freedom of testation. The common law provided at least as clear an option to counter gender discrimination as the statutory framework did. Seeing the issue through the indirect lens of the common law, the court minority would have developed the common law while the majority opinion instead opted not to do so, achieving the desired result via direct application of either the constitutional right of equality or the law giving effect to that right. Most interestingly for our purposes here, Victor AJ, concurring with the majority, wrote separately to argue for a more direct and robust application of the Equality Act on the basis of subsidiarity:

While the authors’ public law perspective aligns with that of Victor AJ, there is one crucial difference between that equality question and the privacy-centred topic: the scope of the legislation enforcing the constitutional right or at least some part of it. In the authors’ view, Parliament's recently enacted privacy legislation does not cover the whole field of the constitutional right to privacy.Footnote ⁶² POPIA is an important statute with a significant role, but it does not even claim to treat the full scope of questions of interest exhaustively. While it is not the purpose of this article to answer them, clearly questions about the relationship between the constitutional right to privacy and the statutory rights and structures created by POPIA will arise. Although POPIA defines “personal information” and “processing” very broadly, it does not cover all the privacy harms associated with digitalization, particularly surveillance and dissemination harms, as identified above.Footnote ⁶³ The authors thus argue that section 14 of the Constitution will therefore continue to occupy a (if not the) central place in the development of South Africa's privacy jurisprudence in response to technological change.Footnote ⁶⁴

The Constitution also explicitly confers law-making powers on the Court by empowering it to develop the common law in light of the Constitution's normative commitments. Section 7(2) provides for the horizontal application of a right to bind a natural or a juristic person, depending on the nature of the right and any duty imposed by the right. The question of whether the constitutional right to privacy applies horizontally (against private actors) or only vertically (against public actors) will certainly arise as privately owned companies are an integral part of the political economy of capitalism. Where a right applies horizontally, the courts are empowered by section 8(3) to “develop the common law to the extent that legislation does not give effect to that right” and may also develop common law rules to limit the right in accordance with the constitutional limitation clause. We have already seen that no legislation covers the field of privacy harms in their entirety and can be said to give full effect to the constitutional right. Further, section 39(2) of the Constitution provides that, when developing the common law, every court must promote the spirit, purport and objects of the Bill of Rights.

The cumulative effect of these provisions is that all privacy law in South Africa is effectively constitutional law. As the late Chaskalson J observed: “[t]here is only one system of law. It is shaped by the Constitution, which is the supreme law, and all law, including the common law, derives its force from the Constitution and is subject to constitutional control”.Footnote ⁶⁵ Therefore, the meaning attributed to the constitutional right to privacy by the judiciary and the effect of that right on other existing legal frameworks (ranging from statute to subordinate legislation to agreements to common law doctrines) will be the central question in the digital age in South African privacy jurisprudence. It is a question that has received little attention until recently.Footnote ⁶⁶

Transformative constitutionalism, private power and constitutional privacy

The text of the Constitution has certain unique provisions that distinguish South Africa's version of the constitutionalist ideal from the “classical” version in the balance it strikes between “conservation” and social change. One particularity is the fact that it reaches both public and private power. This was Karl Klare's central point in his influential 1998 article in which he argued that the Constitution's transformative potential could be unlocked if the judiciary abandoned formalist interpretive practices and recognized the imperative to contribute to the realization of the political project instantiated in the text by adopting a “post liberal” theory of adjudication.Footnote ⁶⁷ By “transformative constitutionalism”, Klare meant “a long term project of judicial enactment, interpretation and enforcement committed … to transforming the country's political and social institutions and power relations in a democratic, participatory and egalitarian direction”.Footnote ⁶⁸

The main focus of the work of the generation of scholars who enthusiastically embraced Klare's work was on expansive readings of equalityFootnote ⁶⁹ and socio-economic rights,Footnote ⁷⁰ not constitutional privacy. However, the two sets of provisions that Klare identified in making his case for transformative constitutionalism will certainly be relevant to the development of South Africa's law of privacy in the digital age: section 7(2), which imposes affirmative duties on the state; and section 8(2) and (3), which extends the application of the Constitution's rights provisions to private relationships regulated by common law and thus potentially directly to private power.

Klare's characterization of the Constitution as transformative is broadly accepted in the legal community. Such scepticism as there has been has concerned the limits of constitutional law as an instrument of progressive social changeFootnote ⁷¹ and whether transformative constitutionalism requires judicial interpretive practices informed by critical legal theory. Theunis RouxFootnote ⁷² has argued that the progressive purposes of the Constitution (for which he agrees there is ample textual evidence) can just as easily be realized by conventional adjudicative practices informed by a DworkinianFootnote ⁷³ conception of the political morality that should inform constitutional reasoning. In this context, the authors agree with Roux to this extent: rights and rule-of-law constitutionalism provide rich resources for the development of privacy rights protection. However, for the Court to develop a harm principle in the field of privacy rights, the authors think judges might have to “step outside the text” and the universe of legal norms to examine not only how technologies work (the Brandeis paradigm) but also the power relations associated with the surveillance state and digital capitalism. Klare's understanding of adjudication as inevitably political lends itself more naturally than does Dworkin's to judicial interpretive practices that incorporate consideration of the implications of power relations, which a public law perspective on constitutional privacy must take account. This raises questions about the boundaries of constitutional law as an interpretive practice. For example, can constitutional law not function more like competition law,Footnote ⁷⁴ a field of law in which it is necessary to analyse how digital markets actually work and that also examines a range of formal and informal legal frameworks?Footnote ⁷⁵ Judges of the Court will understandably be reluctant to stray into uncharted waters, especially those that threaten to erode the distinction between law and politics. However, an overanxious regard for existing boundaries will limit the court's ability to respond to the harms to constitutional democracy associated with digitalization.

Search, seizure and surveillance

The first and leading Constitutional Court case in South African privacy law is Bernstein v Bester (Bernstein),Footnote ⁷⁶ a “search” case in which Ackermann J provided an extended exposition of the philosophical underpinnings of the right to privacy and comparative jurisprudence. Although this case was decided under section 13 of South Africa's Interim Constitution (Interim Constitution),Footnote ⁷⁷ all subsequent cases have invoked the core elements of his reasoning, sometimes somewhat formulaically, and generally avoided any further reflections on the content and scope of constitutional privacy. The case involved a challenge to the constitutionality of sections of the Companies Act 1973 that provided for the directors, officers and persons known or suspected to be in possession of any property of a company in a winding-up to be summoned and to be required to answer questions. The attack was based on the section 13 right to personal privacy and the right not to be subject to the seizure of private possessions or the violation of private communications.Footnote ⁷⁸

The Court, distinguishing place, relationship and person-oriented conceptions of privacy, came to the conclusion on the facts that it could not be said that there had been an invasion of private living space, of any specified relationship or that the information within the knowledge of a director, officer or auditor of a limited liability company regulated by law fell within that person's personal privacy. Regarding the determination of the scope of the right, Ackermann J adopted the “reasonable expectation” test. Under this test, there is an inviolable inner sanctum, such as family life, sexual preference and the home, which becomes progressively more attenuated as individuals enter public spaces and communal relationships with others.Footnote ⁷⁹ The test has found an enduring place in the Court's privacy jurisprudence and will be important in future cases concerning the impact of digitalization on constitutional privacy.

The test is drawn from the Fourth Amendment to the US Constitution. Under this test, a party seeking to establish an unconstitutional invasion of the right to privacy by the government must have “a subjective expectation of privacy that the society has recognized as objectively reasonable”.Footnote ⁸⁰ Announcing this test of an unconstitutional search, Katz v US significantly reversed the US Supreme Court's earlier decision in Olmstead v US,Footnote ⁸¹ which had held, over an eloquent dissent by Brandeis J, that wiretapping did not amount to “trespass” as there was no physical entry and so there was no unconstitutional “search”. The formulation of the new Katz test was an attempt to preserve an original conception of freedom that technological change had erased. The aspiration, says Lawrence Lessig “was to draw a line around private spaces that reflected our … understanding of privacy, in the light of the current potential of technology”.Footnote ⁸²

However, in the age of “digital surveillance”, these original understandings of the boundary between the private and public domains, and accordingly of the application of the Katz test, are obsolete. Digital technologies, as Lessig has observed elsewhere: “change … radically. They not only make more behavior monitorable; they also make more behavior searchable. The same technologies that gather data now gather it in a way that makes it searchable. Thus increasingly life becomes a village composed of parallel processors, accessible at any time to reconstruct events or track behavior”.Footnote ⁸³ Lessig thus asks, the authors believe appropriately, whether we need a second kind of privacy: “privacy in public”.Footnote ⁸⁴

Langa J, appeared to open the door to reconsideration of the application of the reasonable expectations test in South Africa in light of technological change in Investigating Directorate, Serious Economic Offences v Hyundai Motor Distributors,Footnote ⁸⁵decided some years after Bernstein. This matter concerned the constitutionality of legislation that did not specifically require the prosecuting authorities to show reasonable suspicion as a condition precedent when applying for a judicial warrant authorizing a search. In an incidental but important dictum, Langa DP, for the Court, added the following gloss to the reasonable expectation test of the scope of constitutional privacy:

When a court reconsiders this language in a future case where the specific question before it concerns constitutional privacy in the time of digitalization, it will have to consider when and whether individuals are able to decide effectively what information to reveal publicly. Much of the collecting, permanent recording and transfer of data today occurs without the knowledge or even awareness of data subjects. Consent under these circumstances is no more than a fiction. What the courts will demand to enable a meaningful exercise of choice will be a critical constitutional question, as will the nature of the constitutional enquiry into both subjective and objective reasonableness.

The relevant case subsequent to Bernstein was also a physical search case under the Interim Constitution. In Mistry v Interim National Medical and Dental Council (Mistry),Footnote ⁸⁷ legislative powers were broad enough to allow inspectors to “enter any home where aspirins, ointments or analgesics happen to be and once there … [to] inspect not only medicine cabinets or bedside drawers, but also files that might contain a person's last will and testament, private letters and business papers”.Footnote ⁸⁸ In finding that the statutory authority to enter private homes without a warrant and to rifle through intimate possessions intruded the inner sanctum of persons in breach of their privacy rights, the Court held that it was not necessary to decide threshold questions such as what constituted a search and seizure.Footnote ⁸⁹ While leaving open other textual sources, including the right of access to information, the Court effectively recognized for the first time in South African law that a constitutional right to informational privacy is “covered under the broad protection of privacy guaranteed by section 13”.Footnote ⁹⁰ Mistry went on to say that whether this privacy right is violated depends on the intrusiveness of the manner in which the information is obtained, whether it is about intimate aspects of personal life, whether it involves data provided for one purpose that was then used for another and whether it was disseminated to the press or general public, or to persons from whom there was a reasonable expectation that it would be withheld.Footnote ⁹¹

Although the matter did not examine the implications of digitalization for data collection, processing and dissemination, the influence on Mistry of a case of the German Constitutional Court,Footnote ⁹² the case that first recognized a personal right to control private information, is clear. In this 1983 case, the German Constitutional Court engaged the digitalization question directly: “[t]he individual's decisional authority needs special protection in view of the present and prospective conditions of automatic data processing. It is particularly endangered because … the technical means of storing highly personal information about particular persons is practically unlimited, and information can be retrieved in a matter of seconds with the aid of automatic data processing, irrespective of distance”. As the German court correctly observed, “[t]he possibilities of acquiring information and exerting influence have increased to a degree hitherto unknown and may affect an individual's behaviour because of the psychological pressure that public awareness may place upon the individual”.Footnote ⁹³

The fourth case is AmaBhungane v Minister of Justice and Correctional Services,Footnote ⁹⁴ which concerned the constitutionality of the Regulation of Interception of Communications and Provision of Communication-Related Information Act 2002 (RICA) under the general right of constitutional privacy in section 14 of the Constitution, despite the fact that the section also specifically prohibits “searches of one's person and home”Footnote ⁹⁵ and protects the privacy of communications.Footnote ⁹⁶ A 2021 decision, it is the most recent and most important case in this context, because the Court dealt explicitly with the impact of digital technologies on the functioning of the coercive apparatus of the state from a privacy perspective for the first time

In the Court's telling, the adoption of RICA was “informed by considerable technological developments in electronic communications”,Footnote ⁹⁷ as the legislation authorizes “the interception of both direct and indirect communications, which are defined broadly to include oral conversations, email and mobile phone communications (including data, text and visual images) that are transmitted through a postal service or telecommunications system”.Footnote ⁹⁸ We do not yet know how a court will deal with “digital searches” by agencies of law enforcement under section 14(a) and (b), but of some considerable significance is the fact that the Court introduced the concept of “state surveillance” into its lexicon and analysis. This includes searches by technology. The opening paragraph of the judgment states:

The first point to be made about the Court's rights analysis in terms of the constitutional right to privacy is that it attached particular importance to constitutional privacy in the light of South Africa's experience under a “police state”.Footnote ¹⁰⁰ It said the privacy right is “axiomatically … singularly important in South Africa's constitutional democracy”.Footnote ¹⁰¹ The Court added that invasion of an individual's privacy rights infringes the “cognate right to dignity”,Footnote ¹⁰² which the Court has termed elsewhere the “cornerstone of South African democracy”.Footnote ¹⁰³ The effect of this reasoning is to strengthen privacy protection and to require persuasive justification for state action that invades the right.

It is a short step from here to recognize the particular threats posed by digital policing to constitutional privacy, which are evident in the paragraph quoted above. Yet the Court also continues to rely on the Bernstein privacy paradigm, which affords strong protection for intimacy but works less well as a framework for identifying the threats posed by digital policing to constitutional privacy. The Court reasoned as follows: “[i]magine how an individual in that situation would feel if she or he were to know that throughout those intimate communications someone was listening in or reading them”.Footnote ¹⁰⁴ The clandestine interception and surveillance of an individual's communications is therefore “violative of an individual's inner sanctum” and “a highly and disturbingly invasive violation of privacy”.Footnote ¹⁰⁵ However, is surveillance and monitoring, with our knowledge, of communications that are not intimate less disturbing and invasive? The Court appears to recognize potential problems with its reasoning, which arise from the impact of digitalization on the boundary between the private and the public or, as Lessig would term it, “privacy in public”.Footnote ¹⁰⁶ It acknowledges that the legislation “allows interception of all communications. The sanctioned interception does not discriminate between intimate personal communications and communications … privacy is breached along the entire length and breadth of the ‘continuum’. And this intrusion applies equally to third parties who are not themselves subject to surveillance”.Footnote ¹⁰⁷

After finding that there can be no question that “surveillance of private communications limits the right to privacy”,Footnote ¹⁰⁸ the Court then considered whether the limitation is “reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom”.Footnote ¹⁰⁹ It is at this second stage that some of the main elements emerge of the Court's reasoning in upholding the High Court's declaration that the basic structural elements of RICA are unconstitutional. In essence it said that RICA did not pass the test of constitutionality because its design features fell short of what the rule of law requires, in that it failed to provide safeguards for independent judicial supervision and for the notification of subjects of surveillance; it allowed the police to seek permission to intercept on an ex parte application without adequate safeguards; it failed to provide adequate procedures to ensure that data obtained through surveillance is managed lawfully; and it failed to provide adequate safeguards where the subject of surveillance is a practising lawyer or journalist.Footnote ¹¹⁰ The rule of law also informed the Court's conclusion that unregulated, untargeted bulk surveillance of all information is “an extreme violation of privacy … in violation of comparative and international law”.Footnote ¹¹¹ It is clear therefore that the Court in this case relied on its proportionality analysis to impose strong rule-of-law constraints on state surveillance, thereby subjecting systemic aspects of the system of surveillance to constitutional standards.

Of these four cases, only the 2021 matter, AmaBhungane, engages with the consequences of digitalization. On a superficial reading, the earlier cases of Bernstein, Hyundai Motor Distributors and Mistry would not appear to offer much to those concerned with the dangers posed to privacy by digitalization. However, a reading of them based on dignity rather than narrowly on liberty has emphasized the links and the potential these types of cases have in safeguarding the concept of privacy in public and the right of information privacy. However, taken as a whole, South Africa's decided privacy jurisprudence demonstrates how the constitutional elements of rights and proportionality analysis, as well as constitutional supremacy, have laid a good foundation for continued engagement with future state surveillance practices.

Publication, dissemination and use

Before the adoption of the Constitution and the right to privacy, and before the Interim Constitution was introduced, the South African legal system recognized the right to privacy as an independent personal right under the common law of delict, the actio iniuriarum. In this context, the main importance of the actio has been in affording some protection to individuals against the excesses of the mass media. In Financial Mail (Pty) (Ltd) v Sage Holdings Ltd Footnote ¹¹² the Appellate Division, the country's highest court at the time, clarified that a breach of privacy under common law could occur either by unlawful intrusion upon the personal privacy of another or the unwanted disclosure of private facts that a person has a right to conceal. In his taxonomy of the common law right to privacy, Professor David McQuoid-Mason adds placing a person in a false light by publishing non-defamatory but false statements, and the misappropriation of a person's image or likeness without consent or permission.Footnote ¹¹³ It has been suggested that the latter is more properly considered as a breach of the separate right to an identity.Footnote ¹¹⁴ However, in Bernstein, Justice Ackermann pointed to the close relationship between privacy and “what is necessary to have one's own autonomous identity”.Footnote ¹¹⁵ In agreement with McQuoid-Mason, the post-1994 Supreme Court of Appeal extended protection to features of a person's identity in Grutter v Lombard Footnote ¹¹⁶ under the actio iniuriarum. Appropriation of an individual's image or likeness for the benefit of another, or for commercial purposes and without consent, therefore constitutes an actionable breach of privacy rights under both South African common law and the Constitution,Footnote ¹¹⁷ on which further below.

A full specification of the public law perspective on privacy should identify the potential of the four privacy delicts (intrusion, disclosure, false light and appropriation) recognized under common law to provide protection against the specific harms associated with digitalization. As noted above, digitalization magnifies the risks of data spillages and uses and abuses of personal information harmful to the privacy of individuals in ways that could not have been imagined in Brandeis's world of the hand-held camera.Footnote ¹¹⁸ While the detail must await further research, we can offer a high-level answer here to the question of what relief the law of delict provides. The answer is some protection, but that the conceptual structure of the law of delict as designed to remedy specific, discreet and quantifiable harms does not reach the systemic issue of power or Solove's aggregation problem.Footnote ¹¹⁹ The delicts are all furthermore currently cast in the paradigm of concealment and secrecy.Footnote ¹²⁰ The delict of intrusion, for instance, can provide only limited protection in the face of the consolidation of public records in centralized databases, and the collection and dissemination of information in cyberspace, which is a public space. Of course, we do not yet know how the Court will use its powers to develop the common law in response to digitalization and we do not yet know whether it will recognize a new “constitutional delict” for the breach of privacy rights as proposed by McQuoid-Mason. The authors’ view, which aligns with McQuoid-Mason's and is open to exploring the possibilities of developing the common law of delict within a constitutional framework, also finds some support in the argument recently made by Emile Zitzke, reflecting on the award for damages for egregious failures by the Gauteng Department of Health for the care of mental health patients. Zitzke asks whether constitutional damages as opposed to the “old” version of the common law was the appropriate vehicle to consider what remedy would be “just and equitable” in this case.Footnote ¹²¹

The two delicts with the greatest potential, in the authors’ view, are the appropriation delict and disclosure of private facts delict. Under a public law paradigm and a transformative constitution, it is difficult to see why the sale of personal information collected from users or purchased as a commodity cannot potentially give rise to liability, at least where there is a “spillage”. The disclosure of private facts delict has thus far primarily been invoked against traditional mass media. But who are the media today? And what constitutes “publication” in the time of digitalization? We increasingly rely on social media companies to communicate and on Big Tech platform companies that aggregate and sell our personal data for information and news. This is why Jack Balkin has suggested that they should be regarded as “information fiduciaries” that should be held to higher legal and ethical standards than they are at present under US law.Footnote ¹²²

It is becoming clear that these monopolies can (and do) exercise control over content and therefore effectively act as custodians of the virtual public square. However, under South African law, it is not clear whether they can attract liability as other media companies do for the publication or inadvertent disclosure of private facts or defamatory statements under the actio iniuriarum. Section 73 of the Electronic Communications and Transactions Act 2002 immunizes internet service providers that are “mere conduits” from liability for “providing access to, or for operating facilities for information systems, or for information systems or transmitting, routing or storage of data messages”. So far as the authors are aware, there is as yet no South African case in which monopolistic platform companies or other web-based publishers have been sued under common law. However, individuals who post material are treated as publishers and can be held liable under common law. This is what happened in a recent case, Economic Freedom Fighters and Others v Trevor Manuel,Footnote ¹²³ in which a former minister successfully sued members of a political party under common law for delictual damages for posting defamatory statements about him on Twitter. The corporation owning the digital platform was not cited as a respondent. However, what about other kinds of harms to privacy that result from digital processing of personal information or result from the publication of such information on digital platforms? Or from the “spillage” of personal information? And can the platforms themselves be held liable? This question, in turn, implicates the issue of the design of intermediary liability rules in South Africa. Indeed, to what constitutional standards can and should they be held? These questions have not yet been answered. However, the authors think that within our system of constitutional democracy exist considerable normative and institutional resources to develop a “public law paradigm” that is responsive to the risks to privacy and other rights in our age of digitalization.