In an increasingly digital world, the protection of personal data and the regulation of cyber activities are crucial for safeguarding individual privacy and maintaining trust in technology.
Zimbabwe’s Statutory Instrument (SI) 155 of 2024 <a href="https://www.techzim.co.zw/zimbabwe-cyber-and-data-protection-act/">Cyber and Data Protection Licensing Regulations</a> was promulgated into law on the 13th September 2024 outlining a framework for the appointment of Data Protection Officers (DPOs). Known as the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (hereafter “SI 155”), these rules set clear standards for entities handling personal data. The new requirements included the appointment of a Data Protection Officer.
The deadline for businesses and organizations to comply with the Cyber and Data Protection Act and appoint a Data Protection Officer (DPO) is March 12, 2025, exactly six months after the promulgation of the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations 2024 on September 13, 2024.
Many businesses have been scurrying to beat the set deadline for compliance. This is because non-compliance with SI 155 of 2024 can result in various penalties, including fines, suspension, or revocation of licenses. Organizations and individuals found in violation of the regulations may face legal actions and sanctions. In some drastic instances, the Regulations state that failure to comply with the regulations can result in fines of up to level 11 (approximately $5,000) or imprisonment for up to seven years, or both. Is your business now compliant with SI 155 of 2024?
Lenon Itai Rwizi is a Registered Legal Practitioner of the Superior Courts of Zimbabwe and can be contacted on: +263 774 159 146, +263 713 967 341 or <a href="mailto:lenonrwizi@gmail.com">lenonrwizi@gmail.com</a>. The above write up does not constitute formal legal advice, and neither does not create any type of attorney-client relationship. Please seek legal advice by <a href="https://www.facebook.com/profile.php?id=100057530166769">contacting the writer</a> ) or any attorney of your choice.

Pindula News

Zimbabwe has new rules to protect people's personal data and regulate cyber activities. Businesses need to appoint a Data Protection Officer by March 12, 2025, or they could face penalties like fines or even imprisonment. The rules are set to maintain trust in technology and protect individual privacy. Some businesses are rushing to comply before the deadline. The new law is important for businesses in Zimbabwe to follow to avoid getting in trouble. If you need legal advice, contact a Registered Legal Practitioner in Zimbabwe for help.

D-Day for Businesses in Zimbabwe to Comply with the Cyber and Data Protection Act

A Harare man who is suspected to have posted nude images of <a href="https://pindula.co.zw/Mai_Titi">Mai TT</a>’s daughter on social media has been arrested.
Amin Mhaka was arrested and detained at Highlands Police Station on suspicion of leaking Felisha’s nudes after their romantic relationship had deteriorated.
ZRP spokesperson Assistant Commissioner Paul Nyathi confirmed the arrest to <a href="https://www.hmetro.co.zw/man-nabbed-for-leaking-mai-tt-daughters-nudes/">H-Metro</a>. He said:
<blockquote>
Police arrested one suspect in connection with the leaking of the nude photographs of Mai TT’s daughter.
Investigations are in progress and we will furnish more details tomorrow (today).
</blockquote>
Initially, after the explicit pictures of her teenage daughter Fifi were leaked, Mai TT posted a video suggesting there was no shame in Fifi’s naked images appearing online.
However, she later reconsidered and claimed that her daughter had been blackmailed and extorted by a boyfriend. This boyfriend allegedly leaked the pictures after Fifi could no longer afford to pay him. Wrote Mai TT on social media:
<blockquote>
The way you are shocked is the same way I’m shocked because my daughter is the most quiet, intelligent, individual.
When I counted my blessings, I counted her as well. Never have I ever held a stick to flog her because there was nothing to flog her for.
She was the best God gave me because everything about her is just perfect.
There is just a young lady who was in a relationship and trusted her boyfriend, and after breaking up, the guy leaked the pictures.
I got to find out that she was under threats the whole of last year but never told me about it. She would pay this guy not to release until she couldn’t afford anymore.
</blockquote>
In June 2023, Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) Director-General, Gift Machengete, issued a notice warning the public against the collection, sharing and broadcasting of personal information without the consent of the data subject. Read the notice:
<blockquote>
POTRAZ as the designated Data Protection Authority of Zimbabwe has noted with concern the increasing number of incidents of collection, sharing, distribution and or broadcasting of intimate images and or videos without the consent of the person whose intimate images and or videos would have been shared.
The purpose of this Notice is to advise members of the public that:
1. Intimate images and videos form part of personal information which is categorised as sensitive data under the Cyber and Data Protection Act [Chapter 12:07]. The Act prohibits the collection, sharing and distribution of sensitive data without the consent of the data subject.
2. The Cyber and Data Protection Act [Chapter 12:07] as read with Section 164E of Criminal Law Codification &amp; Reform Act [Chapter 9:07] prohibits the collection, transfer, sharing and or broadcasting of intimate images and or videos without the consent of the person concerned. The law seeks to curb the humiliation and embarrassment of persons whose intimate images and or videos would have been shared. It also empowers citizens to have control over the processing of their personal information. This is in line with the fundamental rights to human dignity and the right to privacy as enshrined in the Constitution of Zimbabwe in Sections 51 &amp; 57 respectively.
3. Those who continue to collect, share, distribute and or broadcast intimate images and or videos without the consent of the data subject of the images and or videos shall be liable for imprisonment for a period up to five (5) years or a fine up to level ten and or both such fine and such imprisonment.
4. Members of the public are strongly advised against the collection, sharing or distribution and or broadcasting of sensitive personal information, including any intimate images and or videos of any person without the consent of the data subject.
5. The Authority shall take appropriate regulatory action to ensure a high standard of data protection for all citizens.
For complaints and further guidance, contact the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) on the.regulator@potraz,gov.zw or call +263 242 333032/46/48.
</blockquote>
More: <a href="https://www.pindula.co.zw/">Pindula News</a>

Harare Man Arrested On Suspicion Of Sharing Mai TT Daughter's Private Photos

The Government said it is imperative to redefine national security which is no longer limited to sovereignty and territorial integrity but now encompasses cyberspace.
Presenting a public lecture on the evolution of information systems in the context of media and national security at the Zimbabwe National Defence University on Wednesday, 28 February, the Minister of Information, Publicity and Broadcasting Services, Jenfan Muswere said laws should be enacted to enhance the proper use of information and technology. He said (<a href="https://www.herald.co.zw/redefine-national-security-threats-in-the-context-of-social-media-imperialism/">via The Herald</a>):
<blockquote>
We need to redefine our national security which is well connected with sovereignty and territorial integrity in the context of ensuring security in our geographical space.
National security can no longer be defined in terms of territorial integrity or sovereignty in terms of physical space, but it is also defined in terms of the cyber security framework that we currently have in terms of international telecommunications.
Of importance, the media play equally an important role, especially broadband data…
My advice to the security sector is to try and ensure that we work together to develop a sustainable cybersecurity framework to complement the Cyber Data Protection Act that we currently have which seeks to ensure that we have safety and security in the use of information technology.
The fact that every citizen can broadcast whatever they want to broadcast, either negative or positive, means we need to refine our laws and ensure that we come up with sustainable ICT, publicity and broadcasting that serves as a legal framework to protect our citizens.
</blockquote>
Last week, Presidential spokesperson George Charamba said authorities must craft laws targeting Zimbabweans abusing social media.
Charamba was referring to fake statements purported to be emanating from State organs such as the army circulated on social media platforms.
Muswere said abuse of social media platforms may influence how some economic players make decisions which may result in price hikes, hoarding of products and hyperinflation. He said:
<blockquote>
Economic instability can be caused by negative online media platforms. Hyperinflation and hoarding of foodstuffs can be caused by misleading information that is being channelled via online, print and social media platforms.
</blockquote>
In 2021, the Parliament and the President of Zimbabwe enacted the Cyber and Data Protection Act to increase cyber security to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives and data subjects.
More: <a href="https://www.pindula.co.zw/">Pindula News</a>

Abuse Of Social Media A National Security Threat - Muswere

A 33-year-old Harare man allegedly hacked into an account belonging to Premier Tobacco Auction Floors and stole US$30 000.
According to <a href="https://www.newsday.co.zw/thestandard/news/article/200021358/harare-hacker-steals-us30k">NewsDay</a>, the suspect, Nyasha Mutasa, recently appeared before magistrate Dennis Mangosi charged with contravening the Cyber and Data Protection Act.
Mutasa was released on US$200 bail.
The complainant in the case is Premier Tobacco Auction Floors, which is represented by Takadiyi Blessing Dongo, a loss control officer.
The court heard that on 03 April 2023, Mutasa acting in connivance with his accomplices opened three Nostro accounts in the names of three persons namely Tarisai Katapi, Tadiwanashe Gandiwa and Pamela Sithole.
Prosecutor Grace Mugocheki further alleged that on 04 April, Mutasa hacked the complainant’s Steward Bank account and transferred US$20 000 into the accounts that he had opened.
As a result, the complainant suffered an actual prejudice of US$30 000.
The Cyber and Data Protection Act was enacted in 2021. Its primary objective is to boost cyber security and foster confidence in the secure use of information and communication technologies by data controllers, their representatives, and data subjects.
More: <a href="https://www.pindula.co.zw/">Pindula News</a>

Hacker Steals US$30 000 From Premier Tobacco Auction Floors

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) says it will be conducting public sensitisation and awareness workshops across the country to educate citizens about their rights as enshrined under the Cyber and Data Protection Act.
The Cyber and Data Protection Act was gazetted on 11 March 2022 and the aim of the Act is to increase cyber security in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives and data subjects.
In a public notice, POTRAZ Director-General, Gift Machengete said the workshops will start in Harare Province on 20, 22, and 27 June 2023, and transport will be availed for ferry attendees to the venues. Reads the notice:
<blockquote>
The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), as the Designated Data Protection Authority of Zimbabwe, would like to inform all citizens that their online activities generate a trail of data as websites and applications collect data on among other things, individual behaviours and interests.
Some organisations also collect and process personal information for various purposes.
To ensure personal data is protected from abuse or manipulation, Government has enacted the Cyber and Data Protection Act [Chapter 12:07].
The Act ensures that individuals have better control over their personal information and that this information is processed for a legitimate purpose and in a lawful, fair and transparent manner.
In this regard, POTRAZ is organising public sensitisation and awareness workshops across the country to educate data subjects about their rights as enshrined under the Cyber and Data Protection Act [Chapter 12:07], beginning with Harare Province on 20, 22 and 27 June 2023.
Transport to the workshops will be available for registered participants only from the Main Post Office along Innez Terrace Ave at 0800 hours and back at 1430 hours.
</blockquote>
Machengete said those who intend to participate should register by clicking on https://www.potraz.gov.zw/?page_id=2439 or send an email with your contact details to the.regulator@potraz.gov.zw. For more details, you can contact POTRAZ on +263 242 333032/46/48.
More: <a href="https://www.pindula.co.zw/">Pindula News</a>

POTRAZ Plans To Educate Citizens About The Data Protection Act

The Media Institute of Southern Africa (MISA) says the sending of unsolicited political messages to mobile phone users violates the Cyber and Data Protection Act.
This comes after voters across the country have been bombarded with messages purportedly from President Emmerson Mnangagwa soliciting votes ahead of forthcoming general elections.
MISA has written a letter to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) dated 11 April asking how third parties were accessing citizens’ personal data, including phone numbers.
In the letter, MISA Zimbabwe chapter director Tabani Moyo noted that the messages were based on constituency segmentations as per the voters’ roll. Part of the letter reads:
<blockquote>
Over the past few weeks, mobile phone users have reported receiving unsolicited political messages that are personalised and highly targeted through local and constituency-based segmentation.
The messages’ personalisation and targeted nature are closely related to the information in the voters’ roll.
There is every reason to believe that the unsolicited texts violate the Cyber and Data Protection Act which governs the use of personal biometric data.
The Act states that the use of personal biometric data in this way is prohibited unless the data subject gives consent in writing.
… In that regard, MISA Zimbabwe seeks to know how third parties have access to subscriber numbers and are sending unsolicited messages in a possible breach of the law.
</blockquote>
One of the messages sent to a subscriber reads:
<blockquote>
Kwaziwai. Iyi ndiyo WhatsApp nhamba yangu yeSeke 0719******, ichengetedzei mufoni menyu nekuzivisa vamwe vagari vemaSeke. Ndichange ndichikuzivisai paWhatsApp STATUS yangu, zvirikuitwa nehurumende kuvaka nyika yedu nemuno maSeke. Ndatenda, ndini wenyu President ED Mnangagwa.
</blockquote>
Moyo indicated that mobile telecommunication operators, that is Econet, NetOne, and Telecel, as well as Zimbabwe Electoral Commission (ZZEC) have denied leaking citizens’ personal information to ZANU PF.
He said POTRAZ ought to clarify the matter and ensure that citizens’ right to privacy will remain protected.
More: <a href="https://zero.pindula.co.zw/">Pindula News</a>

Unsolicited ED Mnangagwa Texts Illegal - MISA

The government says it will establish a National Computer Incident Response Team (NCIRT), which will receive and respond to cybercrime reports in the country.
According to <a href="https://www.britannica.com/topic/cybercrime">Britannica</a>, cybercrime, also called computer crime, is the use of a computer as an instrument to further illegal ends, such as committing fraud, trafficking in child pornography and intellectual property, stealing identities, or violating privacy.
Speaking at a cyber-security dialogue at the University of Zimbabwe on Thursday, Minister of ICT, Postal and Courier Services, Jenfan Muswere, said the government has passed laws to combat cyber-crimes. He said:
<blockquote>
As a result, the Government has responded swiftly through regulatory measures such as the enactment of the Cyber and Data Protection Act, as well as supporting directives and other related legislation to enforce provisions of the law across all sectors of the economy.
In addition, the ministry, working with its stakeholders, has designed a programme to train personnel in Government ministries, departments, and agencies on ICT skills and cybersecurity awareness.
We believe there is room for collaboration with institutions of higher learning such as the University of Zimbabwe in this regard.
In addition, the ministry, working with POTRAZ (Postal and Telecommunications Regulatory Authority of Zimbabwe) and the International Telecommunications Union, is setting up a National Computer Incident Response Team (NCIRT) to provide a focal point for incident reporting and response in the country.
</blockquote>
| <a href="https://www.sundaymail.co.zw/new-govt-sets-cybercrime-response-team">The Sunday Mail</a>

Govt To Set Up Cybercrime Response Team

A CCC member in Kadoma, Mashonaland West Province, Emmanuel Manguda has been arrested on allegations of insulting President Emmerson Mnangagwa.
Manguda, an interim CCC Kadoma district secretary, allegedly posted an image deemed derogatory to Mnangagwa.
He is being charged for contravening section 164B of the Cyber and Data Protection Act for cyberbullying and harassment.
According to the Zimbabwe Lawyers for Human Rights (ZLHR), Manguda posted a picture of a cockroach bearing the head of the President in May.
He is yet to appear in court.
If found guilty, Manguda faces up to 10 years in jail, a fine or both.
Section 164B of the Act says anyone who posts a message, picture or material with the intent to coerce, intimidate, harass, threaten, bully or cause substantial emotional distress, or to degrade, humiliate or demean any other person shall be guilty of an offence. | <a href="https://www.newsday.co.zw/local-news/article/200000835/ccc-activist-nabbed-for-insulting-president">NewsDay</a>

DPA Latest News

Latest Jobs