Will Potraz or govt check compliance of WhatsApp Ts&Cs with AIPPA?

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is yet to confirm whether it is discussing whether a revised WhatsApp privacy policy complies with local laws. The Constitution of Zimbabwe in section 57 provides for the right to privacy. This Constitutional right, one could argue, could be used as the basis for transforming the law on privacy and data protection to include all institutions not presently covered by the present legal provisions.
Privacy and Data protection have become major issues in the global economy. Companies and individuals have become more concerned with how their personal data is handled, stored and transferred. It should be noted that the only law dealing with Data Protection, or protection of personal privacy is the Access to Information and Protection of Privacy Act Chapter 10:27. However, the Act only deals with the prevention of unauthorized collection, use or disclosure of information by public bodies. It is thus clear that private institutions are not regulated.

This comes after WhatsApp, the Facebook-owned messaging giant, sparked a public outcry about a recent update to its terms and privacy policy.

The privacy policy update relates to how it processes users' data, how businesses can use Facebook services to store their chats and who partners with Facebook to offer integration across all Facebook products.
In terms of the revised policy, it appears that there are different terms of service and privacy policies for users in the European countries and in non-European Countries.

In our opinion, we think the regulator should analysing whether the terms of service and the privacy policies indeed differ and whether the privacy policy applicable to users outside Europe, which include Zimbabwean users, are in compliance with the Access to Information and Protection of Privacy Act (AIPPA).

In essence, the new changes to WhatsApp's terms and privacy policy relate to how WhatsApp will share information within the Facebook group of companies and how any shared information will be used. Users' criticisms about the app's changed policies are rife and complaints about social media relating to personal data/information being misused are increasing. Telegram and Signal users are also increasing by the minute.

Zimbabweans were trying out alternative instant messaging service Telegram in huge numbers - and competitor Signal to an only slightly lesser extent - amid an exodus from WhatsApp.

Telegram overtook WhatsApp in iPhone downloads on 7 January, but Signal still lagged behind on the Apple platform. Android users were slower to try out the alternative messengers, only pushing Telegram to the top of the Play charts on Sunday, three days after it hit the top spot with Apple.

The protection of privacy is a principle enshrined in Zimbabwe's Constitution. While there is no designated national legislation dealing with data protection for private persons in Zimbabwe yet, there are existing laws that have a bearing on the right to privacy and protection of personal information for specified types of data, or in relation to specific activities.

The Access to Information and Protection of Privacy Act (Chapter 10:27) contains the most provisions on data protection. However, this generally only regulates the use of personal data by public bodies. The Data Protection Bill governs the processing of personal information by both private and public bodies. The legislation aim to prevent unauthorized and arbitrary use, collection, processing, transmission and storage of data of identifiable persons. The Act regulates data protection and establish a Data Protection Authority.

Other laws which refer to the protection of information as a function of other activities or the protection of specific types of data are the Courts and Adjudicating Authorities (Publicity Restrictions) Act (Chapter 07:04), the Census and Statistics Act (Chapter 10:29), Banking Act (Chapter 24:20), National Registration Act (Chapter 10:17) and the Interception of Communications Act (Chapter 11:20).

In August 2016, Cabinet, which is the highest government approval body, approved the Revised National Policy for Information Communication Technology ('ICT Policy'). According to the approved ICT Policy, the establishment of an institutional framework for enacting legislation dealing specifically with digital data protection matters and cybersecurity is anticipated.