During the December holiday season South African media surfaced public concerns about the news of drone-enable surveillance of beaches by the City of Cape Town (CoCT) to enforce a ban on alcohol on Cape Town's beaches. Members of the public expressed concern about being filmed in their beachwear, albeit in a public place. One source of discomfort was male CoCT officials in a remote location scrutinizing drone images of female bodies in near real time.
In response to public concern Cape Talk Radio invited me to discuss the tensions between individual privacy in public places and questions of public order. You can listen to a recording of that interview here to understand the issues and some of the emotions around them.
While this incident and discussion on Cape Talk focused on the specifics of Cape Town's beaches and South African law, many of the issues raised are salient across the continent. In an all too abbreviated analysis in the interview I suggested that it is likely that South Africa’s Protection of Personal Information Act (POPIA) 2013 does apply to the collection and use of drone-enabled video by CoTC authorities.
The Law
In section 5(3) the Act exempts activities “the purpose of which is the... investigation or proof of offences, the prosecution of offenders” from the application of the Act - but only “to the extent that adequate safeguards have been established in legislation for the protection of such personal information”. However South Africa does not have specific legislation which deals with the protection of personal information during the investigation, proof and prosecution of offences. Nor does legislation dealing with investigation, such as the Criminal Procedure Act, include such protections, which is unsurprising since it dates from 1977.
The surveillance could arguably be justified by another apartheid statute, the Control of Access to Public Premises and Vehicles Act, 1985, assuming it is not unconstitutional. But this Act also lacks any protection of personal information provisions. In the absence of other legislation it seems likely that POPIA applies to the collection of personal information through drone surveillance. POPIA may treat law enforcement as a lawful reason for collection and processing, but these activities are subject to all the other strictures of POPIA including a prohibition on use for another purpose. The CoCT could thus not use the footage of happy holiday goers for a marketing campaign.
This does not resolve all the questions. For example, when does a photograph that includes a person include personal information? The obvious answer is that it does so when the person is identifiable in the photograph. But identifiable to whom, and using what means? If someone can be identified through subtle clues known only to a close friend or family member then is that person identifiable? Or if someone can be identified by technological capacities not available to most people, does the photograph include personal information? For example image enhancement could create a closeup of a finger that could be run through a fingerprint database to identify a person. Following this logic would seem to render all photographs that include a person as personal information because there may be a technology in future that could identify the person. One way to address this issue would be to regard the identification of a person using an advanced technology as the moment at which the personal information is captured, rather than when the photograph is taken.
It's important to pause at this point and note that there is no blanket prohibition on taking photographs in public. In South Africa, as in most jurisdictions, a person has a diminished expectation of privacy in the public sphere. Personal data protection laws usually exempt purely private activities from their scope. When a stranger photobombs your holiday snaps, despite your efforts to produce Instagram worthy pics that give the impression you were alone on the beach with your friends, then it is likely that your photograph would be exempt from personal data laws. However, taking video of people on the beach and using it for commercial purposes would have to comply with personal data laws, including the requirement of consent.
Balancing Competing Considerations
The way in which these issues must balance competing considerations and also devolve into finer details illustrates how the introduction of wide-ranging and broad personal data protection laws, while essential, does not address all the challenges of privacy. Such laws are often ahead of a social consensus of when privacy can be expected, and when that expectation must be tempered in particular circumstances.
This is not simply a question of individual autonomy - but also what kinds of powers state actors should be able to accumulate through the deployment of technological innovations. But the use of new technologies may have unanticipated consequences for state actors too. The rationale given by the City of Cape Town for the prohibition on people taking alcoholic drinks to public beaches is that intoxication can lead to violence, and endanger people swimming in the ocean. While public safety seems to be a compelling reason to permit collection and processing of personal data does it require the CoCT to use its near real time surveillance to prevent or react to other dangers?
Since the CoCT is scrutinizing the feeds should it be obliged to look for and respond to people being swept out to sea by a riptide or potentially endangered by an approaching great white shark? Since the city justifies its surveillance by reference to public safety can it choose to respond to some threats and not others? Or does the failure to use the surveillance feeds to respond to all threats to public safety undercut the justification for it, rendering it unlawful?
While more and more African jurisdictions are enacting personal data laws and creating regulators to enforce them, the application of these laws to the many diverse contexts of human life presents us with many intriguing questions that are as yet unanswered.
Comments
Post a Comment