Country Report: South Africa
The Electronic Communications and Transactions Act, 25 of 2002 (ECTA). The Protection of Personal Information Act 4 of 2013 (POPIA).
Section 4 of ECTA provides that it applies in respect of data relating to economic transactions which are defined as transactions of either a commercial or non-commercial nature, and includes the provision of information and e-government services. It also applies to data messages which are defined as data generated, sent, received or stored by electronic means.
POPI Act
Chapter 2, Section 3 “Application and interpretation of Act” explains that the POPI Act applies to the processing of personal information.
ECTA does not apply to any data which falls outside the definition of electronic transactions and data messages.
Chapter VIII of the Act provides for the protection of personal information which is limited to personal information which has been obtained through electronic transactions. Section 51(2) provides that a data controller may not electronically request, collect, process or store personal information on a data subject which is not necessary for the lawful purpose for which the personal information is required.
This law was created for the public interest. The Act seeks to regulate electronic transactions between consumers, private and public bodies, institutions and citizens (Section 2(1)(g) of ECTA).
It also seeks to promote SMMEs (Small, medium and Micro-sized Enterprises) within the electronic transactions environment. (Section 2(1)(p) of ECTA).
Chapter 2 section 3 of POPIA
Applies to responsible party domiciled in South Africa and if not domiciled in South Africa, which makes use of automated or non-automated means in South Africa.
Not directly. According to the rules of jurisdiction of the courts, a foreign entity would only be held liable only as far as the effects of the conduct is felt in the Republic.
However, any service provider must be accredited and authenticated if they offer products or services in a foreign jurisdiction by the Minister.
ECTA Definitions
“personal information” means information about an identifiable individual, including, but not limited to:
- (a)
information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the individual;
- (b)
information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved;
- (c)
any identifying number, symbol, or other particular assigned to the individual;
- (d)
the address, fingerprints or blood type of the individual;
- (e)
the personal opinions, views or preferences of the individual, except where they are about another individual or about a proposal for a grant, an award or a prize to be made to another individual;
- (f)
correspondence sent by the individual that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
- (g)
the views or opinions of another individual about the individual;
- (h)
the views or opinions of another individual about a proposal for a grant, an award or a prize to be made to the individual, but excluding the name of the other individual where it appears with the views or opinions of the other individual; and
- (i)
the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual, but excludes information about an individual who has been dead for more than 20 years;
POPIA
Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person including, but not limited to:
- (a)
information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
- (b)
information relating to the education or the medical, financial, criminal or employment history of the person;
- (c)
any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
- (d)
the biometric information of the person;
- (e)
the personal opinions, views or preferences of the person
- (f)
correspondence sent by the person that is implicitly or explicitly of a private or confidential nature of further correspondence that would reveal the contents of the original correspondence;
- (g)
the views or opinions of another individual about the person; and
- (h)
the name of the person if it appears with other personal information relating to the person or if the disclosure if the name itself would reveal information about the person.
POPIA Part B: Processing of special personal information
Section 26 of POPIA provides:
A responsible party may, subject to section 27, not process personal information concerning:
- (a)
the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or
- (b)
the criminal behaviour of a data subject to the extent that such information relates to:
- (i)
the alleged commission by a data subject of any offence; or
- (ii)
any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings.
-
Section 28: Authorisation concerning data subject’s religious or philosophical beliefs
-
Section 29: Authorisation concerning data subject’s race or ethnic origin
-
Section 30: Authorisation concerning data subject’s trade union membership
-
Section 31: Authorisation concerning data subject’s political persuasion
-
Section 32: Authorisation concerning data subject’s health and sex life.
-
Section 33: Authorisation concerning data subject’s criminal behaviour or biometric information.
ECTA Definition -
“data controller” means any person who electronically requests, collects, collates, processes or stores personal information from or in respect of a data subject;
-
“data subject” means any natural person from or in respect of whom personal information has been requested, collected, collated, processed or stored, after the commencement of this Act;
POPIA Definitions
Information officer of, or in relation to a:
- (a)
public body means an information officer or deputy information as contemplated in terms of section 1 or 17; or
- (b)
private body means the head of a private as contemplated in section 1
Of the Protection of Access to Information Act.
Operator means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party.
POPIA provides for eight conditions for lawful processing of personal information.
Condition 1: Accountability The responsible party must ensure that the conditions set out in this chapter, and all the measures that give effect to such conditions, are complied with at the time of the determination of the purpose and means of the processing and during the processing itself.
Condition 2: Processing limitation Personal information must be processed (a) lawfully and (b) in a reasonable manner that does not infringe the privacy of the data subject
Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.
Condition 3: Processing limitation Condition 4: Purpose specification Condition 5: Information quality Condition 7: Security safeguards -
Section 19: Security measures on integrity and confidentiality of personal information
-
Section 20: Information processed by operator or person acting under authority
-
Section 21: Security measures regarding information processed by operator
-
Section 22: Notification of security compromises
Condition 8: Data subject participation -
Section 23: Access to personal information
-
Section 24: Correction of personal information
-
Section 25: Manner of Access
-
11. Does the law provide any specific definitions with regards to data protection in the digital sphere?
Chapter VIII of ECTA
Section 50(1) provides that these provisions only apply to personal information that has been obtained through electronic transactions.
The ECTA does not specify any fundamental rights as a legal basis.
POPIA it is based on the right to privacy enshrined in Section 14 of the Constitution of the Republic of South Africa, 1996.
The rights of the data subject in POPIA are described in terms of the obligations of the data controller, therefore see below.
Chapter 8: Rights of Data subjects regarding Direct marketing by means of unsolicited electronic communications, directories and automated decision making
Principles for electronically collecting personal information
Section 51 of ECTA - (1)
A data controller must have the express written permission of the data subject for the collection, collation, processing or disclosure of any personal information on that data subject unless he or she is permitted or required to do so by law.
- (2)
A data controller may not electronically request, collect, collate, process or store personal information on a data subject which is not necessary for the lawful purpose for which the personal information is required.
- (3)
The data controller must disclose in writing to the data subject the specific purpose for which any personal information is being requested, collected, collated, processed or stored.
- (4)
The data controller may not use the personal information for any other purpose than the disclosed purpose without the express written permission of the data subject, unless he or she is permitted or required to do so by law.
- (5)
The data controller must, for as long as the personal information is used and for a period of at least one year thereafter, keep a record of the personal information and the specific purpose for which the personal information was collected.
- (6)
A data controller may not disclose any of the personal information held by it to a third party, unless required or permitted by law or specifically authorised to do so in writing by the data subject.
- (7)
The data controller must, for as long as the personal information is used and for a period of at least one year thereafter, keep a record of any third party to whom the personal information was disclosed and of the date on which and the purpose for which it was disclosed.
- (8)
The data controller must delete or destroy all personal information which has become obsolete.
- (9)
A party controlling personal information may use that personal information to compile profiles for statistical purposes and may freely trade with such profiles and statistical data, as long as the profiles or statistical data cannot be linked to any specific data subject by a third party.
Chapter 3
ECTA does not require prior notification or registration. According to Chapter 6, section 57 of POPI Act one must obtain prior authorisation. Section 55(1) of POPI Act also establishes duties and responsibilities for the Information Regulator.
Not directly, however, section 40(1)(b)(vi) of POPIA provides that the duties, powers and functions of a Regulator include monitoring and enforcing compliance by conducting an assessment in respect of the the processing of personal information by that private or public body for the purpose of ascertaining whether or not the information is processed according to the conditions for the lawful processing of personal information.
See answer for question 10 above.
-
18. What are the conditions for the expression of consent?-
Section 11 of POPI Act provides for the measures to be taken regarding consent, justification and objection to collection of personal data.
-
Section 51(4) of ECTA: The express written permission of the data subject is required unless the data controller is required or permitted to handle the data subject’s data by law.
(4) The data controller may not use the personal information for any other purpose than the disclosed purpose without the express written permission of the data subject, unless he or she is permitted or required to do so by law.
Sections 26–33 (Chapter 3, Part B) of POPI Act provide for the measures to be taken when processing special personal information.
Condition 7 in sections 19–22 (Chapter 3) of POPI Act provides for the security safeguards for processing personal information which includes protecting the confidentiality and integrity of personal information.
ECTA Definitions
(Chapter VIII) Section 51(5) The data controller must, for as long as the personal information is used and for a period of at least one year thereafter, keep a record of the personal information and the specific purpose for which the personal information was collected.
(Chapter VIII) Section 51(8) The data controller must delete or destroy all personal information which has become obsolete.
Chapter 9 of POPI provides for transfers of personal information outside of the Republic. It provides in section 72 that a responsible party may not transfer personal information about a data subject to a third party who is in a foreign country unless it meets certain requirements set out in the section.
A responsible party may not transfer personal info outside South Africa to a foreign third party unless the third party is subject to law, corporate rules or binding agreements which afford the data subject protection:
See answer to question 21.
Yes,
Section 72: Binding corporate rules/binding agreements with an adequate level of protection.
Yes, section 57 of POPIA provides for circumstances where a responsible party would be required to obtain prior authorisation from the Regulator in terms of section 58.
Chapter 11 of POPIA provides for offences, penalties and administrative fines as contained in sections 100-109.
The ECTA envisions cyber inspectors however, they are not specifically created for issues relating to data protection.
Section 39 of POPIA provides for the establishment of the Information Regulator
The Minister of the Department of Telecommunications and Postal Services.
Section 39 of POPIA
The Information Regulator is an in independent juristic person subject only to the Constitution and to the law. The Information Regulator must be impartial and perform its functions and exercise its powers without fear, favour or prejudice.
It must exercise and perform its functions in accordance with POPIA and the Promotion of Access to Information Act.
It is accountable to the National Assembly.
The Minister is responsible for overseeing all aspects of the ECT Act. His or her powers and duties are provided for in chapter II of ECTA.
Section 5–9: The minister must develop and implement a national e-strategy.
Section 40 of POPIA
The powers, of POPIA provides for duties and functions of the Regulator in terms of this Act are:
- (a)
- (b)
to monitor and enforce compliance...
- (c)
to consult with interested parties…
- (d)
- (e)
to conduct research and to report to Parliament…
- (f)
to administrate codes of conduct
- (g)
to facilitate cross-border cooperation in the enforcement of privacy laws by participate in any initiative that is aimed at such cooperation
- (h)
to perform any general functions incidental or conducive to the preceding functions
Electronic Communications and Transactions Act, 2002.
National Consumer Protection Act, 68 of 2008.
Chapter VII of the ECTA makes provision for consumer protection. Section 42 sets out the scope of of application. It applies mostly to suppliers of consumer goods and services as well as to the consumers.
Section 47 of the ECTA provides that “the protection provided to consumers in this Chapter, applies irrespective of the legal system applicable to the agreement in question.”
Section 5(8) provides that the provisions in the CPA apply to a matter irrespective of whether the supplier resides or has principal office within or outside the Republic.
It is not defined in the ECTA.
The term consumer protection is not defined.
The focus of the provision is to protect consumers in the case of electronic transactions regardless of whether the goods or services sold or bought online.
There are no provisions specific to consumer protection in the definition. The CPA applies to all transactions therefore it would be understood that the rights enjoyed in the ‘terrestrial’ sphere would be enjoyed in the digital sphere.
The ECTA has not specified any fundamental rights.
The preamble of the CPA provides that it seeks to redress the injustices of Apartheid by developing and employing innovative means to:
- (a)
fulfil the rights of historically disadvantaged people and to promote their full participation as consumers;
- (b)
protect the interests of all consumers, ensure accessible, transparent and efficient redress for consumers who are subjected to abuse or exploitation in the marketplace; and
- (c)
to give effect to internationally recognised customer rights;
The ECTA makes provisions for goods and services purchased through electronic transactions.
Section 43(2)
The consumer has the right to review the entire electronic transaction; to correct any mistakes; to withdraw from the transaction, before finally placing any order.
Section 43(3)
If the consumer does not provide the consumer with the information provided for in section 43(1) and the opportunity provided for in section 43(2), the consumer has the right to cancel the right to cancel the transaction within 14 days of receiving the good or services under the transaction.
Section 44(1)
It provides that a consumer is entitled to a cooling off period which means that he or she has the right to cancel without reason and without penalty any transaction and any related credit agreement for the supply of goods or services within seven days of conclusion of the agreement.
The consumer is also entitled to a full refund within 30 days of cancellation if the consumer made the payment before he or she could exercise the right of a cooling off period.
However, these rights do not apply to electronic transactions specified in section 42.
The CPA does not have specific provisions for digital goods and services therefore it is understood that all the rights that are afforded in the terrestrial sphere will be afforded to digital services.
Chapter 2: Fundamental Consumer Rights
-
Part A: Right of equality in consumer market
-
Part B: Consumer’s right to privacy
-
Part C: Consumer’s right to choose
-
Part D: Right to disclosure and information
-
Part E: Right to fair and responsible marketing
-
Part F: Right to fair and honest dealing
-
Part G: Right to fair, just and reasonable terms and conditions
-
Part H: Right to fair value, good quality and safety
-
Part I: Supplier’s accountability to consumers
-
39. Is consumer protection law applicable to users of zero price service i.e. free of charges?
ECTA does not provided for this.
The CPA speaks of free goods and services only within the context of “promotional offers”
“promotional offer” means an offer or promise, expressed in any manner, of any prize, reward, gift, free good or service, price reduction or concession, enhancement of quantity or quality of goods or services, irrespective of whether or not acceptance of the offer is conditional on the offeree entering into any other transaction.
ECTA does not have specific security requirements but it does oblige the supplier to provide certain information provided for in section 43.
The CPA does not have specific provisions for digital goods and services therefore it is understood that all the rights that are afforded in the terrestrial sphere will be afforded to digital services.
Penalties
Section 111 provided for in terms of the CPA.
- (1)
Any person convicted of an offence in terms of this Act is liable:
(a) in the case of a contravention of section 107 (1), to a fine or to imprisonment for a period not exceeding 10 years, or to both a fine and imprisonment; or
(b) in any other case, to a fine or to imprisonment for a period not exceeding 12 months, or to both a fine and imprisonment.
- (2)
Despite anything to the contrary contained in any other law, a Magistrate’s Court has jurisdiction to impose any penalty provided for in subsection (1).
Administrative fines
Section 112
- (1)
The Tribunal may impose an administrative fine in respect of prohibited or required conduct.
- (2)
An administrative fine imposed in terms of this Act may not exceed the greater of:
- (a)
10% of the respondent’s annual turnover during the preceding financial year; or
- (b)
- (3)
When determining an appropriate administrative fine, the Tribunal must consider the following factors:
- (a)
The nature, duration, gravity and extent of the contravention;
- (b)
any loss or damage suffered as a result of the contravention;
- (c)
the behaviour of the respondent;
- (d)
the market circumstances in which the contravention took place;
- (e)
the level of profit derived from the contravention;
- (f)
the degree to which the respondent has co-operated with the Commission and the Tribunal; and
- (g)
whether the respondent has previously been found in contravention of this Act.
- (4)
For the purpose of this section, the annual turnover of a supplier at the time when an administrative fine is assessed, is the total income of that supplier during the immediately preceding year, as determined in the prescribed manner.
- (5)
A fine payable in terms of this section must be paid into the National Revenue Fund referred to in section 213 of the Constitution.
ECTA does not provide for specific bodies but the CPA does.
Chapter 5: National Consumer Protection Institutions
Part B
Establishment of National Consumer Commission
Part C
There is none under ECTA.
44. What are the powers of the bodies responsible for the implementation of the consumer protection law?
None are specified.
Chapter 5
Part C: Functions of Commission
-
Section 92: General provisions concerning Commission functions;
-
Section 93: Development of codes of practice relating to Act;
-
Section 94: Promotion of legislative reform;
-
Section 95: Promotion of consumer protection within organs of state;
-
Section 96: Research and public information;
-
Section 97: Relations with other regulatory authorities;
-
Section 98: Advice and recommendations to Minister.
The Electronic Communication and Transaction Act, 25 of 2002 regulate a handful of cybercrimes.
Cybercrimes Bill B6B-2017
Signatory/observer to the Budapest convention
ECTA provides for cybercrimes in sections 86, 87 and 88.
-
Section 86: Unauthorised access to, interception of or interference with data
-
Section 87: Computer-related extortion, fraud and forgery
-
Section 88: Attempt, and aiding and abetting
The Cybercrimes Bill provides for cybercrime in sections 2 to 16
-
Section 2: Unlawful access
-
Section 3: Unlawful interception of data
-
Section 4: Unlawful acts in respect of software or hardware tool
-
Section 5: Unlawful interference with data or computer program
-
Section 6: Unlawful interference with a computer data storage medium or computer system
-
Section 7: Unlawful acquisition, possession, provision, receipt or use of password, access code or similar data or device
-
Section 8: Cyber fraud
-
Section 9: Cyber forgery and uttering
-
Section 10: Cyber extortion
-
Section 11: Aggravated offences
-
Section 12: Theft of incorporeal property
-
Section 13: Definitions
-
Section 14: Data message which incites damage to property or violence
-
Section 15: Data message which threatens persons with damage to property or violence
-
Section 16: Distribution of data message of intimate image
The provision refers to a person which is defined as including a public body.
Any person who commits offences in chapter 2.
Yes, in accordance with ordinary criminal law and the principles of jurisdiction.
A single definition for cybercrime is not provided in either the Cybercrimes Bill nor the ECTA.
ECTA defines -
Section 85: “access” includes the actions of a person who, after taking note of any data, becomes aware of the fact that he or she is not authorised to access that data and still continues to access that data.
-
Section 86: Unauthorised access to, interception of or interference with data.
-
86.- (1)
Subject to the Interception and Monitoring Prohibition Act, 1992 (Act No. 127 of 1992), a person who intentionally accesses or intercepts any data without authority or permission to do so, is guilty of an offence.
- (2)
A person who intentionally and without authority to do so, interferes with data in a way which causes such data to be modified, destroyed or otherwise rendered ineffective, is guilty of an offence.
- (3)
A person who unlawfully produces, sells, offers to sell, procures for use, designs, adapts for use, distributes or possesses any device, including a computer program or a component, which is designed primarily to overcome security measures for the protection of data, or performs any of those acts with regard to a password, access code or any other similar kind of data with the intent to unlawfully utilise such item to contravene this section, is guilty of an offence.
- (4)
A person who utilises any device or computer program mentioned in subsection (3) in order to unlawfully overcome security measures designed to protect such data or access thereto, is guilty of an offence.
- (5)
A person who commits any act described in this section with the intent to interfere with access to an information system so as to constitute a denial, including a partial denial, of service to legitimate users is guilty of an offence.
-
Section 87: Computer-related extortion, fraud and forgery
-
87.- (1)
A person who performs or threatens to perform any of the acts described in section 86, for the purpose of obtaining any unlawful proprietary advantage by undertaking to cease or desist from such action, or by undertaking to restore any damage caused as a result of those actions, is guilty of an offence.
- (2)
A person who performs any of the acts described in section 86 for the purpose of obtaining any unlawful advantage by causing fake data to be produced with the intent that it be considered or acted upon as if it were authentic, is guilty of an offence.
-
Section 88: Attempt, and aiding and abetting
- (1)
A person who attempts to commit any of the offences referred to in sections 86 and 87 is guilty of an offence and is liable on conviction to the penalties set out in section 89 (1) or (2), as the case may be.
- (2)
Any person who aids and abets someone to commit any of the offences referred to in sections 86 and 87 is guilty of an offence and is liable on conviction to the penalties set out in section 89 (1) or (2), as the case may be.
NB These provisions are will be repealed by the Cybercrimes Bill if/when it comes into force.
As provided for in chapter 2.
ECTA does not define it. The Cybercrimes Bill defines it in:
Chapter 1, Section 1:
“computer system” means:
- (a)
- (b)
two or more inter-connected or related computers, which allow these inter-connected or related computers to:
- (i)
exchange data or any other function with each other; or
- (ii)
exchange data or any other function with another computer or a computer system;
The definitions in the cybercrimes bill are:
“data” means electronic representations of information in any form;
“data message” means data generated, sent, received or stored by electronic means and includes-:
There is a definition of “computer data storage medium”
Chapter 1, Section 1:
“computer data storage medium” means any device or location from which data or a computer program is capable of being reproduced or on which data or a computer program is capable of being stored by a computer system, irrespective of whether the device is physically attached to or connected with the computer system;
ECTA does not define Forensic Data.
It is not defined in the Cybercrimes Bill.
ECTA does not define service provider.
The Cybercrimes Bill only defines an electronic communication service provider.
Electronic communications service provider means any person who provides an electronic communications service under and in accordance with an electronic communications service licence issued to such person under Chapter 3 of the Electronic Communications Act, 2005 (Act No. 36 of 2005), or who is deemed to be licensed or exempted from being licensed as such in terms of the Electronic
Communications Act, 2005;
An early version of the Cybercrimes Bill (the cybercrimes and cybersecurity bill) had provisions dedicated to addressing the natioal cybersecurity risks of cybercrime. See section on cyberdefence below.
ECTA does not specify one.
The Cybercrimes Bill has not specified one nor is one immediately clear from the Constitution of the Republic of South Africa, 1996.
ECTA Act does not specify them.
The Cybercrime Bill provides for rights and protections as consistent with the criminal law of South Africa.
-
60. Is there a specific procedure to identify, analyse, relate, categorize, assess and establish causes associated with forensic data regarding cybercrimes?
The Cybercrimes Bill does not provide specific procedures for this however, it provides in section 55 that the cabinet minister responsible for policing must (a) establish and maintain sufficient human and operational capacity to detect, prevent and investigate cybercrimes; (b) ensure that members of the South African Police Service receive basic training in aspects relating to the detection, prevention and investigation of Cybercrimes.
ECTA does not provide for that but it refers to the general provisions for jurisdiction of the courts (Section 90).
Chapter 6 of the Cybercrimes Bill provides for Mutual assistance.
ECTA does not provide for Mutual Legal Assistance.
Chapter 5 of the Cybercrimes Bill provides for Mutual Assistance National Executive may enter into agreements
57. (1) The National Executive may enter into any agreement with any foreign State regarding:
(a) the provision of mutual assistance and cooperation relating to the investigation and prosecution of… [the offences provided for in the Cybercrimes Bill]
This includes exceptions in accordance with the ordinary principles of mutual assistance.
Neither legislation provides for specific preventative measures that should be taken regarding cybercrime.
Chapter 5 of the Cybercrimes Bill provides for the powers to investigate, search an access or seize. The duties and responsibilities of law enforcement are outlined in this chapter.
The general rules pertaining to the National Prosecution Authority would apply. The prosecutor must carefully check the legality of the initiation of criminal cases and evaluate the submitted materials.
Section 52 (5) The National Director of Public Prosecutions must make available members of the
National Prosecuting Authority:
- (a)
who have particular knowledge and skills in respect of any aspect dealt with in this Act; and
- (b)
to whom a security clearance has been issued by the State Security Agency in terms of section 2A of the National Strategic Intelligence Act, 1994, to the satisfaction of the National Director of Public Prosecutions, to provide legal assistance to the designated Point of Contact as may be
National Director of Public Prosecutions must keep statistics of prosecutions
56. (1) The National Director of Public Prosecutions must keep statistics of the number of prosecutions instituted in terms of Part I or Part II of Chapter 2, the outcome of such prosecution and any other information relating to such prosecutions, which is determined by the Cabinet member responsible for the administration of justice. (2) The statistics or information contemplated in subsection (1) must be included in the report of the National Director of Public Prosecutions referred to in section 22(4)(g) of the National Prosecuting Authority Act, 1998.
Chapter 9
S54 Electronic communication service providers or financial institutions that become aware that their systems are involved in the commission of any offences in the Cybercrimes Bill are obligated to report offences no later than within 72 hours. They must also preserve evidence as far as possible.
ECTA applies to “a person” which is defined to include a public body. Presumably, the ordinary meaning of a person is understood to apply, which is both a natural and a juristic person.
Person means a natural or juristic person, section 1. Penalties (section 14, 22) apply to persons.
Section 80–84 The Cyber Inspector provided for in chapter XII of ECTA.
s26 (1) The Cabinet member responsible for policing, in consultation with the National Commissioner, the National Head of the Directorate, the National Director of Public Prosecutions and the Cabinet member responsible for the administration of Justice.
There is no special public prosecutor office. The Cabinet member responsible for policing is required to work closely the National Director of Public Prosecutions for all matters relating to public prosecutions of cybercrime. For example, see –
Chapter 10, Section 53
Cyber response committee
Chapter _ Section _ Designated Point of Contact
RICA concerns electronic communications surveillance. It does not refer to anything related to public order.
Cybersecurity incident management system…social management systems [e.g. social unrest management/monitoring or surveillance]
Regulation of Gatherings Act (note Section 12(1)(a) is declared unconstitutional/invalid)
Proposed: Regulation of Gatherings Act Amendment Bill
(not related to cybersecurity)A telecommunication service provider must store communication-related information (30(1) RICA).
------
The Cyberwarfare Strategy is still being developed. Once developed, it will be presented to the Justice, Crime Prevention and Security (JCPS) Cluster Ministers for approval. It is earmarked for approval and partial implementation in the 2018/2019 fiscal year.
It is still being developed.
The Department of Defence Annual Performance Plan (2017) states that it is aligned with the national policy regarding South Africa’s posture and capabilities related to offensive information warfare actions.
The National Critical Infrastructure Bill.
There is no single definition.
NCPF does not include a definition of cyberattack.
NCPF Definitions
-
“Cyber warfare” means actions by a nation/state to penetrate another nation’s computers and networks for purposes of causing damage or disruption
-
“Cyber espionage” means the act or practice of obtaining secrets without the permission of the holder of the information (personal, sensitive, proprietary or of classified nature), from individuals, competitors, rivals, groups, Governments and enemies for personal, economic, political or military advantage
-
“Cyber terrorism” means use of Internet based attacks in terrorist activities by individuals and groups, including acts of deliberate large-scale disruptions of computer networks, especially computers attached to the Internet, by the means of tools such as computer viruses
-
“Cyberspace” means a physical and non-physical terrain created by and/or composed of some or all of the following
-
National Framework
The Cybersecurity strategy is still being developed.
National cyber security framework, introduction 1.1.
Cyber-warfare
“In order to protect its interests in the event of a cyber-war, a cyber defence capacity has to be built. The NCPF thus promotes that a Cyber Defence Strategy, that is informed by the National Security Strategy of South Africa, be developed, guided by the JCPS Cybersecurity Response Committee.”
It says nothing more on the issue of cyberdefence .
The NCPF does not specify this.
The Department of Defence and Military Veterans (DOD&MV) has overall responsibility for coordination, accountability and implementation of cyber defence measures in the Republic as an integral part of its National defence mandate. To this end, the Department will develop policies and strategies pursuant to its core mandate.
The NCPF envisions the implementation of the JCPS Cybersecurity Response Committee.
They will presumably be specified in the National Cybersecurity Strategy.
