The Malawi government is investing millions and billions of dollars to construct a national data centre with the aim of consolidating all the Main Distribution Areas (MDAs) and making sure that data is secured. What is more bothering is that this is a project that was done by Huawei. The government has now been cautioned not to hasten in placing its data in the centre before an independent body can come in and certify that the data centre is not one to mine data and send it outside the country.
Malawi President Lazarus Chakwera who launched the national data centre in Blantyre on behalf of the government of Malawi praised this achievement.
“We have launched the country’s first-ever National Data Centre, a digital infrastructure that raises our stakes in delivering data-driven, seamless and timely service to you fellow citizens,” he declared.
The Fruits of New Technology
The data centre is the fruit of the new wave of technological advancement that Malawi decided not to be left behind but to embrace hook, line and sinker. In fact, when Malawians started experiencing the wonders of modern technology in electronic communication devices, life could not have been easier. From basic phones to smartphones, the incessant advancement of mobile phones and computers has dramatically transformed communication trends and methods that are fundamental to modern life.
Phones and computers have now gone beyond making calls and processing documents, to instant messaging, processing pictures and videos, playing music and videos, browsing the internet, and GPS navigation and mapping systems. Evolving cellphone wireless networks accord speedy and instant connection to the internet throughout the world.
Enters Surveillance
At the peak of modern devices’ relevance to modern life are matters of surveillance and data privacy. As part of the Malawi government’s democratic oversight, it has put in place numerous laws that should be able to deal with the proliferation of information and communication technology (ICT), which has also helped to increase the processing of personal data, which is now threatening the right to data privacy and related human rights.
In 2016, the Malawi Parliament passed the Electronic Transactions and Cyber Security Bill into law. The Electronic Transactions and Cyber Security Act was put in place “to make provision for electronic transactions; for the establishment and functions of the Malawi Computer Emergency Response Team (MCERT); to make provision for criminalizing offences related to computer systems and information communication technologies; and to provide for investigation, collection, and use of electronic evidence; and for matters connected therewith and incidental thereto”.
Because the Act allows for the collection and centralization of personal data, human activists and advocates have criticized the Act as a contradiction of the right to privacy and other rights that privacy permits. The principle argument is that modern electronic communication devices collect large volumes of information, most of which is private, and that rendering that kind of data subject to interception and surveillance poses a massive threat to the privacy and democracy of citizens.
The constitution of Malawi, under Section 21, lucidly upholds the right to privacy. The section necessitates that every person shall have the right to personal privacy, which shall also include the right not to be subject to searches of his or her person, home, or property; the seizure of private possessions; or, interference with private communication, including mail and all forms of telecommunications.
Presumably, the same act that was meant to make electronic transactions easier and safer, as well as make provisions for data protection for citizens to operate tranquilly within cyberspace, has become the very act posing a threat to the same.
Government’s Way of Doing Business Digitally
According to Francis Bisika, the Principal Secretary of e-Government, a government department under the Ministry of Information and Digitization that coordinates and manages ICT development at multiple levels, the Electronic Transactions and Cyber Security bill was a preamble for the government to start doing business digitally, as previously most of the government’s businesses were done manually, which meant physical documents flowing around.
Even in terms of legal proceedings, previously Bisika said you could not tender electronic documents in court as evidence, so what the Act is doing is to allow electronic documents as part of tenderable documents in essence, and also to permit electronic documents as permissible in carrying out government business.
“As the government, seeing that the world is going digital, we pondered that was the way to go. Going digital has the advantage that it reduces the cost of doing business and of accessing information. Governing a few decades ago and governing now are very different. Not so long ago, people had no access to social media or digital space. So all we are doing is providing a platform where everybody can access information, but what they do after accessing that information is subject to the Cyber Security and E-Transactions Act,” says Bisika.
He acknowledges that the Act presents perceptible limitations, which has prompted the government to draft a new bill which aims at protecting the data of individuals and institutions with regard to who has access to data and for what purpose.
Wesley Mwafulirwa, a legal practitioner who is also conducting doctoral research at Mzuzu University on the interception of human rights and digital technology, points out that while the Act has noble goals, it employs overbroad and disproportionate means to achieve them. He says that the act has several provisions that can be challenged, one of which is data storage. Mwafulirwa conceded that data storage and processing in itself is not wrong, but unavoidable. What matters, however, is why and where the data is stored and processed, and what the safeguards are in terms of data privacy.
“There are international standards in terms of exercising the right to privacy and human rights. For example, you cannot require privacy if you keep child pornography on your device. So yes, there are some allowable limitations to the intrusion of one’s data, just that our Act does not strike a proper balance,” he said before adding:
“Even the Communications Act, which also makes provision for the Malawi Communications Regulatory Authority (MACRA) to intercept our data, is legal under our constitution. This sort of grants them a blank cheque that they can use to intercept people’s data. Some limitable allowance on surveillance is important for security and other reasons, but the systematic intrusion of people’s private data should be allowable by international human rights standards, and should meet the standards set under Section 44 of the Constitution, as well as our international law.”
Section 44 of the Malawi Constitution partially states that “no restriction or limitations may be placed on the exercise of any right and freedoms provided for in this Constitution other than those prescribed by law, which is reasonable, recognized by international human rights standards, and necessary in an open and democratic society; laws prescribing restrictions or limitations shall not negate the essential content of the right or freedom in question, and shall be of general application.”
Digital Rights Vague
Rights are the basis of civic activism, and just as with any other right, digital rights warrant advancement. While the issues of digital rights are still vague and not widely advanced in the country, a number of civil society organizations and activists have been making efforts to advocate and promote the same.
The ICT Association of Malawi lobbies for the creation of a conducive policy and legal framework for the promotion of activities and various issues in information technology in Malawi. It also strives to maintain a high level of liaison and cooperation with government departments and authorities, as well as civil society organizations.
Remarking on digital surveillance with regard to the right to privacy, the President of the ICT Association of Malawi, Bram Fudzulani, confirmed that it is indeed wrong for the government to surveil its citizens as it breaks the convention on human rights. The government should absolutely not be in a position to surveil its citizens.
He expounded that, much as the provision of the Electronic Transaction and Cyber Security Act allows the government to collect and process personal data, the same Act necessitates that the government acquire a warrant granting them authorization to go and collect digital information for any citizen and that in the absence of a court warrant granted by a judge in his or her discretion, data surveillance becomes illegal.
Activists, however, deduce that despite surveillance’s intended primary purpose being national security interests, there are still fears of misuse and abuse of data by unauthenticated parties for personal and unscrupulous interests. Information collected through digital surveillance has been used to target people, usually without ultimate consequences for the perpetrators. There are gaps that come with having legislation that allows interception of data while at the same time prohibiting unlawful interception of data. This just converts to subjecting it to collection and use without fitting safeguard measures.
The Birth of Malawi’s Digital Rights Coalition
Charles Kajoloweka, a human rights activist who is also the Director of the Youth and Society (YAS) Malawi, says that considerably, the levels of recklessness by service providers and agencies that harvest data, such as banks and communication companies, and the lack of a data protection mechanism in our system, expose a lot of Malawians to such vulnerabilities.
Kajoloweka emphasizes that digital rights activism is the way to go in order to ensure overall oversight of the digital spectrum and to provide checks and balances on the government’s expenses in all things digital. He says that there are promising prospects with the establishment of the Digital Rights Coalition (DRC), a network of non-state actors (i.e., individuals and organizations) working towards supporting, strengthening, and promoting digital rights.
“Another very important aspect of our work is to ensure the enactment of the Data Protection Law. A draft bill that should be coming to parliament soon is in place, we are told. At the moment, we still don’t have the legislation in this country, and until we have the personal data protection law in place, all the personal information given to the service providers and government agencies remains subject to abuse as there is no law to bar them,” says Kajoloweka.
The Principal Secretary e-Government, Bisika, comments that the government has a good relationship with ICTAM, which it believes speaks on behalf of ICT rights. He says that as a government, they have consulted with them continuously when dealing with issues of ICT. Their contact with civil society on digital issues is through ICTAM.
In February 2021, ICTAM coordinated a meeting where experts punched holes in the Data Protection and Privacy Bill, which is expected to be taken to parliament soon. The specialists exchanged ideas on areas that warranted amending before taking the Bill to Parliament.
The Data Protection Law, according to the Ministry of Information and Digitization, seeks to “provide a comprehensive legislative framework for the protection and security of personal data, consolidate data protection provisions currently found in various Acts of Parliament, and protect the privacy of individuals without hampering social and economic development in Malawi.”
A Huawei Data Centre that will take away Citizens’ Privacy
According to Fudzulani, ICTAM advises the government when it makes decisions that could jeopardize national security. They are able to step in and direct the government on what needs to happen on technical matters.
“I will give you an example of the recent developments that have happened, where the government is investing millions and billions of dollars to construct a national data centre with the aim of consolidating all the Main Distribution Areas (MDAs) and making sure that their data is secured. Now our role as a professional body, also understanding that this is a project that was done by Huawei and the precedence that Huawei has in Africa, we stepped in and said no. We feel, that before the government actually places its data in this data centre, we need an independent body to come in and really certify that the data centre is not one to mine data and send it outside the country. The government understood and allowed us to say okay, bring an independent body, let them do an assessment and give us a report,” he says.
“We ensure that the government is not overstepping its mandate, and that comes in many aspects. If the government is introducing a new law that we feel is tramping on people’s rights, then we play a role as the surveillance organization to sensitize, mobilize, and even work with parliamentarians in authenticating bills when it comes to parliament,” says Fudzulani.
People’s Ignorance of the Electronic Transfers and Cyber Security Act
Despite being operative for about six years, the average Malawian is still not adequately cognizant of what the Electronic Transfers and Cyber Security Act entails.
There is an apparent communication gap, despite the increasing number of people using digital devices, accessing and processing online information, and making transactions online. It is of importance that citizens are aware of what the act means and the implications that it poses for their existence. At the barest minimum, citizens should at least have the right to know when they are under surveillance; the techniques used; how records are held and secured; who has access to them; safeguarding measures in place to avoid abuse; as well as legislation and policies that are in place in that regard.
On public awareness, Kajoloweka says that another key role of digital rights activists is to motivate activities aimed at raising public awareness around digital rights issues and how they impact society’s life. He remarked that because the percentage of people with internet access in Malawi is very low, the majority of the citizens who are not connected don’t have access to information on digital privacy that is largely available online.
With only about 14.6% of Malawians having access to the internet, over 86% of the country’s population has no access to the internet at all, which already explains the violent digital exclusion that ordinary citizen faces.
As a result, Kajoloweka says that most Malawians, including those that have access to technology, are not fully, or even slightly, aware of the Electronic Transaction and Cyber Security laws and how they affect them.
He also attributed this to the low rates of legal literacy in Malawi, which is very low, whereby most citizens are not motivated to read and understand the law, even those that are considered to be sophisticated. He added the last aspect is that service providers that harvest data, like banks and telecommunication companies, should also take a proactive role in investing in public awareness around digital rights and data management.
Maclan Kanyang’wa, a Political Science researcher based at the Malawi University of Business and Applied Sciences, echoes the need to advocate for data protection laws, but most importantly, raise public awareness regarding their right to privacy.
He said that research has shown that the right to privacy is a concept which is misunderstood, among others because the issue is complicated with a lack of proper terminology in vernacular for ”privacy”. The vernacular translation carries a negative connotation: ”kuchita zinthu mwa mchibisibisi”, which literally means “doing things in secrecy”.
There is a need for civic education or media literacy because, even via social media, users share information that third parties can use to their disadvantage. People are denied jobs because employers have used digital trace data available on social media platforms to dig into their past contacts and activities or affiliations, and that is why people need to know their digital rights.
“There is a need to integrate media literacy and civic education in schools, especially primary schools, and even early childhood education to create a better understanding of these issues and communication technologies in general and their implications,” he says.
The ICTAM President says that if there was proper coordination among stakeholders of digitization, effort to engage the communities and civic education on issues of their rights, not just their offline rights but even digital rights, then it would be easier to incorporate their misunderstandings into the programming of digital management. As a country, we could consolidate our efforts and take the messages to the public.
“I think in the same space to say that they can leverage our professionals in making the village champions take on the issues of decentralization and digital literacy in the rural communities. We will want to see how that can actually impact the communities, but I think it is one way of just saying how we leverage the numbers that we have and then at the same time impact the communities that we have on issues of digital literacy,” says Fudzulani.
Digital rights activists have further argued that government departments are empowered and mandated under law to ensure civic education on data privacy and protection. Citizens and companies are contributing to the universal access fund, which aims to be ploughed back to the public.
The Principal Secretary for e-Government observes that lack of information and misinformation can be addressed by having forums that educate people on issues about information, some of which are already in place. When the government passed the Access to Information Act, one of the goals was to educate people about who has what information and who should have access to it.
The draft has since been finished, and the stakeholder consultation on the draft completed.
According to the Principal Secretary for e-Government, what remains of the bill is to be presented to the Ministry of Justice, where it has to undergo a verdict and then be presented to Parliament for passing into a bill.
Going through the draft, it is clear that it has tried to provide the hope of covering the areas that the Electronic Transfer and Cyber Security Act left gaping.
—This article on digital surveillance was supported by the Media Policy & Democracy Project, jointly run by the University of Johannesburg and the University of South Africa.
© investigativeplatform-mw. All Rights Reserved.
.jpg)