Is Apple&#39;s private relay feature illegal in Colombia and South Africa, and if so, why?
<p><a href="https://www.theguardian.com/technology/2021/jun/08/apple-private-relay-feature-to-be-withheld-in-china" rel="nofollow noreferrer">Apple has announced a new browsing feature</a> designed to hide a user's browsing from others.</p>
<p>The article linked above said the feature is banned in:</p>
<p><em>China, Saudi Arabia or Belarus, Colombia, Egypt, Kazakhstan, South Africa, Turkmenistan, Uganda and the Philippines.</em></p>
<p>However, I thought section 14 of South Africa's constitution protected the right to privacy.  Why is Apple not legally able to offer the new private browsing there?</p>

<h2>These rights are not unrestricted</h2>
<p>s36 says:</p>
<blockquote>
<ol start="36">
<li>(1) The rights in the Bill of Rights may be limited only in terms of law of general
application to the extent that the limitation is reasonable and justifiable in an open
and democratic society based on human dignity, equality and freedom, taking into
account all relevant factors, including—</li>
</ol>
<p>(a) the nature of the right;</p>
<p>(b) the importance of the purpose of the limitation;</p>
<p>(c) the nature and extent of the limitation;</p>
<p>(d) the relation between the limitation and its purpose; and</p>
<p>(e) less restrictive means to achieve the purpose.</p>
</blockquote>
<p>South Africa has laws that allow the government to demand private information. Apple publishes a <a href="https://www.apple.com/legal/transparency/za.html" rel="nofollow noreferrer">report</a> on this.</p>
<p>Whether there is such a prohibition is South Africa is hard to <a href="https://mybroadband.co.za/news/internet/400893-apple-will-not-launch-feature-to-hide-online-identity-in-south-africa-or-china.html" rel="nofollow noreferrer">say</a>:</p>
<blockquote>
<p>Apple could not immediately indicate which regulations in South Africa prevented it from launching Private Relay here.</p>
</blockquote>

<p>Apple has not asserted that it is legally impossible in South Africa, they have simply said that they aren't doing it. The explanation may be that there is a credible legal concern, that is, they are not certain whether their system is consistent with South African law. The two relevant legal pieces that I know of are the <a href="https://popia.co.za/" rel="nofollow noreferrer">Protection of Personal Information Act</a> and the <a href="https://www.michalsons.com/blog/national-data-and-cloud-policy-in-south-africa-draft/49239" rel="nofollow noreferrer">National Data and Cloud Policy</a>. These are complicated pieces of law, and the comment period on the Data and Cloud Policy only recently closed, so the official policy does not yet exist. There are substantial negative consequences with failure to comply with the rules, and the rules seem to include elements of government control that do not exist in the US or the EU. Some excepts from the summary of the Data and Cloud Policy</p>
<blockquote>
<p>Government must capture all public data by default in digital format;
Government will store non-sentive data in the government data centre;
Government will develop a framework to enable both the public and
private sector to share data with everyone fairly, equitably and
transparently; Government will develop governance frameworks on access
to data, the purpose of data and data flow maps</p>
</blockquote>
<p>The official draft policy is <a href="https://www.gov.za/sites/default/files/gcis_document/202104/44389gon206.pdf" rel="nofollow noreferrer">here</a>. See p. 27 for a couple of statements that would be surprising in the context of US law:</p>
<blockquote>
<p>To ensure ownership and control: Data generated in South Africa shall
be the property of South Africa, regardless of where the technology
company is domiciled...All  research data  shall be  governed  by the
Research  Big  Data Strategy of the Department of Science and
Innovation (DSI). All data generated from South African natural
resources shall be co-owned  by  government  and the  private  sector
participant/s  whose private funds were used to generate such, and a
copy of such data shall be stored in the HPCDPC</p>
</blockquote>
<p>In the context of legal uncertainty, it is a reasonable business decision to seek further legal analysis. Recall how a few years ago, most people were uncertain about what GDPR required / forebade. I presume that Apple simply needs time to wait for the law to firm up, and for them to understand what the law says, in case their private relay feature turns out to impose unexpected obligations on them.</p>

privacy constitutional-law south-africa communications-law