The Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA)[1] is a South African law that regulates the interception of communications and associated processes such as applications for and authorisation of interception of communications. The law came into effect on 22 January 2003 when it was published in the Government Gazette of South Africa number 28075.
RICA regulates the interception of communications, the monitoring of radio signals and radio frequency spectrums and the provision of communication-related information - information relating to indirect communication in the records of telecommunication service providers. It also regulates applications for interception of communications and provision of communication-related information under certain circumstances. It regulates law enforcement where interception of communications is involved and prohibits the provision of telecommunication services which do not have the capability to be intercepted and requires telecommunication service providers to store communication-related information (CRI). The law specifies costs to be borne by telecommunication service providers related to these requirements and compensation to services providers. It provides for the establishment of interception centres an Office for Interception Centres and an Internet Service Providers Assistance Fund. Lastly it prohibits the manufacturing, assembling, possessing, selling, purchasing or advertising of interception equipment without a certificate of exemption issued by the relevant Minister.
RICA is not limited to the provisions contained in the act itself, but is supplemented by a directive, a notice, a schedule and four proclamations. The directive prescribed the technical and security requirements related to the interception and routing of communications and the recordal and storage of CRI. Schedule A of the directive applies to fixed line telecommunications operators and Schedule B and C applies to mobile cellular providers and Internet service providers respectively. The various types of listed equipment is detailed in the notice while the Schedule lists serious crimes that justify interception. Finally the four proclamations deal with the enforcement dates of the act. Since its promulgation RICA has been amended four times. Two of these amendments are already in force and two are pending.
Section 14 of the Bill of Rights in the South African Constitution of 1996[2] expressly provides that "everyone has a right to privacy, which includes the right not to have (...) (d) the privacy of their communications infringed". The rights in the Bill of Rights may be limited, section 36 of the Constitution. However, various other provisions in the Bill of Rights indirectly imply a right to safety and security. If citizens have a right to security, it creates a corresponding duty on the state. Chapter 11 of the Constitution governs this duty and authorise the police, defence force and intelligence agencies to assist the state in its security obligations. Parliament therefore attempted to balance these two conflicting rights by providing for judicial oversight and limiting interception only to those cases where a serious crime is involved.
In a ruling made by the Constitutional Court of South Africa on 3 February 2021,[3] it was found that the legislation failed to 'protect the right to privacy, as buttressed by the rights to freedom of expression and the media, access to courts and a fair trial'.
RICA provides for three main types of provisions – duties, prohibitions and procedures. The duties are directed at enabling interception, while the prohibitions are aimed at enforcing the individuals privacy right.
It is, however, neither privacy nor security that raise the most objections against RICA, but equality concerns. A recent proposed amendment to section 40 provides for preferential treatment of mobile providers by extending the enforcement of cell phone registration indefinitely.
Different communications tools and technologies are also not subject to equal treatment in RICA. An email, for example is not subject to the onerous duty that related data (like the time, date, sender and recipient of the email) should be recorded and stored while such duties apply to all telephone and cellular communications.