Loading Cyber Conduct…
Please wait while the page loads.
Loading Cyber Conduct…
Please wait while the page loads.
What does South African law mean when someone intercepts private computer data without lawful authority?
Section 3 of the Cybercrimes Act 19 of 2020 makes it an offence to unlawfully and intentionally intercept data, including certain electromagnetic emissions from a computer system carrying that data, when the data is within or being transmitted to or from a computer system.
The important distinction is that interception concerns obtaining or making non-public data available to someone who is not the lawful owner or holder, sender, recipient or intended recipient of that data.
Section 3 defines interception of data as the acquisition, viewing, capturing or copying of data of a non-public nature through a hardware or software tool contemplated by the Act, or through any other means, in a way that makes some or all of the data available to someone who is not one of the authorised parties identified by the Act.
The definition also includes examining or inspecting the contents of the data and diverting the data, or part of it, from its intended destination to another destination.
These concepts can overlap, but they are not identical.
Section 2 deals with unlawfully and intentionally accessing a computer system or computer data storage medium.
Read Unlawful AccessSection 3 deals with unlawfully and intentionally intercepting data, including certain non-public data being transmitted to or from a computer system.
Intercepting data that is not public while it is being transmitted can raise an unlawful-interception issue, depending on the circumstances and whether the interception was authorised.
Interception is not limited to making a copy. Section 3 includes the acquisition, viewing, capturing or copying of non-public data.
The Act's definition also includes diverting data, or part of it, away from its intended destination to another destination.
Section 3 separately addresses certain possession of data or its output where the person knows, or in specified circumstances cannot satisfactorily explain possession of data reasonably suspected to have been unlawfully intercepted.
Interception can involve data moving through computer systems and networks. The fact that data is technically travelling through a network does not mean that anyone who can observe that traffic is automatically authorised to obtain or inspect its contents.
The exact legal position depends on the type of data, how it was obtained, the systems involved, the authority under which the activity occurred and the particular law that applies.
Not every form of monitoring or interception is automatically unlawful. South Africa also has legislation regulating the interception of communications and the provision of communication-related information.
The Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002, commonly known as RICA, regulates certain interception activities and provides for applications and directions authorising interception in specified circumstances.
Cyber Conduct does not treat every network-monitoring activity as automatically criminal. Whether interception is lawful can depend on the authority, purpose, circumstances and legislation involved.
If you believe your data or communications may have been intercepted, avoid attempting to investigate by further interacting with the suspected system or person. Preserve relevant evidence such as messages, notifications, account-security alerts, device information and other records that may help establish what happened.
If the matter involves an actual suspected crime, financial loss, threats or a serious compromise of personal information, consider reporting it through the appropriate official channel and obtaining professional legal advice where appropriate.
The Cybercrimes Act deals with several related forms of conduct. Other sections address unlawful access, software and hardware tools, interference with data or computer programs, interference with computer systems, password and access-code offences, fraud, forgery and extortion.
This page is based primarily on section 3 of the Cybercrimes Act 19 of 2020. RICA is relevant to the separate legal framework governing certain interception of communications.
Cyber Conduct provides general educational information, not legal advice. The application of the law depends on the facts of an individual situation. If you are dealing with an actual criminal investigation, accusation or legal dispute, consider obtaining advice from a qualified legal professional.