www.misa.org The adequacy of the pieces mentioned above of legislation in giving full effect to the relevant constitutional rights can be assessed by reference to the best international standards3. The international standards are captured and set out in various instruments, including the Southern African 4Development Community (SADC) Model Law on Data Protection, the African Union (AU) Convention on Cyber Security and Personal Data Protection (Malabo Convention),5 Declaration of Principles on Freedom of Expression and Access to Information in Africa 2019,6 the International Principles on the Application of Huma Rights to Communications Surveillance and the European Union (EU) General Data Protection Regulations (GDPR). In that regard, it is imperative to point out that the Cyber and Data Protection Act, the main legislation dealing with data protection and privacy in Zimbabwe, is mainly modelled on the EU GDPR, as it borrows the bulk of its provisions. Accordingly, it is appropriate to use the EU GDPR as the main benchmark for assessing the adequacy of the provisions of the Cyber and Data Protection Act concerning data protection and privacy. This policy brief posits that there are various yawning gaps in our data protection, privacy and surveillance legislation. The gaps include but are not limited to, the absence of independent data protection and cyber monitoring authorities, the limited scope of data subject rights, an inadequate framework for cross-border data transfers, a draconian surveillance regime and a lack of effective remedies against data and privacy breaches. Accordingly, this policy brief recommends a litany of measures to plug and bridge the gaps to achieve a legal framework that fully reflects the underlying constitutional rights. 2. Background As noted above, we have two main pieces of legislation that provide for surveillance in Zimbabwe. The major justification for surveillance laws is crime prevention, detection and investigation. The first piece of legislation is the Postal and Telecommunications Act. In terms of Section 98 of the said Act, a postal or telecommunication licensee or employee of such licensee in charge of a telegraph office is allowed to intercept or detain any telegram which he suspects of having contents that provide evidence of the commission of a criminal offence or of being sent to assist the commission of a crime; or upon request by a commissioned police officer who suspects it of having contents that provide evidence of the commission of a criminal offence or of being sent to assist the commission of a crime. The second and main piece of legislation is the Interception of Communications Act. In terms of Section 6 of the said Act, authorised persons, who are defined to include the Chief of Defence Intelligence, the Commissioner of the Zimbabwe Republic Police (“ZRP”) and the Commissioner General of the Zimbabwe Revenue Authority (ZIMRA) or their nominees, are allowed to intercept any communication upon issuance of a warrant by the Minister of Transport and Communications. In that regard, postal and telecommunication service providers are required in Section 9 of the Interception of Communication Act to ensure that their postal or telecommunications systems can technically always support lawful interceptions. In 2014, the 3. A holistic, contextual and purposeful reading of the law supports this. See, for example, Sections 34, 46 (1) (c) & (e), 326, 327 of the Constitution and the International Treaties Act [Chapter 3:05]. Several cases have confirmed the import of international standards at the domestic level. 4. Core human rights instruments such as the Universal Declaration of Human Rights, International Covenant on Civil and Political Rights and the African Charter on Human and Peoples’ Rights etcetera are relevant here. 5. Zimbabwe is not a signatory to the Malabo Convention as yet. This instrument was adopted on 27 June 2014 by the Twenty-Third Ordinary Session of the Assembly in Malabo, Equatorial Guinea. 6. https://achpr.au.int/en/node/902. See Principles 37-42 for example. Misa Zimbabwe Policy Brief 5