Regulation of Interception of Communications and Provision of Communication-related Information Act

1. Section 1 of the Regulation of Interception of Communications and Provision of Communication-related Information Act, 2002 (hereinafter referred to as the principal Act), is hereby amended— (a) by the definitions: insertion before the definition of "Agency" of the following " 'activate' means to allow access to the electronic communication system of the electronic communication service provider who provides a mobile cellular electronic communications service and "activated" has a corresponding meaning; 'address' means— (a) in the case of a natural person— (i) the address where the person usually resides, or where such residential address is not available— (aa) the address where the person is employed; (bb) the address where the business of the person is situated; or (ii) where such a person resides in an informal settlement and cannot provide an address contemplated in subparagraph (i), any other address, including that of a school, church or retail store, where a person usually receives his or her post; or in the case of a juristic person, the registered address or the address where the business is situated;"; (b) (b) by the substitution for the definition of "customer" of the following definition: " 'customer' means any person— (a) to whom an electronic communication service provider provides an electronic communications service, including an employee of the electronic communication service provider or any person who receives or received such service as a gift, reward, favour, benefit or donation; 4 No. 31784 Act No. 48, 2008 GOVERNMENT GAZETTE, 9 JANUARY 2009 REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT ACT, 2008 (b) who has entered into a contract with an electronic communication service provider for the provision of an electronic communications service, including a pre-paid electronic communications service; or (c) where applicable— (i) to whom an electronic communication service provider in the past has provided an electronic communications service; or (ii) who has, in the past, entered into a contract with an electronic communication service provider for the provision of an electronic communications service, including a pre-paid elec- tronic communications service;"; (c) by the insertion after the definition of "Executive Director" of the following definition: " 'family member' means— (a) a person who is related to another person— (i) biologically; or (ii) by statutory, customary or religious law, including affinity by marriage, adoption or foster care; (b) a person's permanent life partner; or (c) in the case of an orphan, a care-giver as defined in the Children's Act, 2005 (Act No. 38 of 2005);"; (d) by the substitution for the definition of "identification document" of the following definition: " 'identification document' means, in the case of a person— (a) who is a South African citizen or is lawfully and permanently resident in the Republic— (i) a green, bar-coded identity document issued in terms of section 8 of the Identification Act, 1986 (Act No. 72 of 1986), until such identity document is replaced by an identity card as contemplated in section 25 of the Identification Act; (ii) an identity card Identification Act; issued in terms of section 14 of the (iii) a temporary identity certificate issued in terms of section 16 of the Identification Act; or (iv) a South African passport issued in terms of the South African Passports and Travel Documents Act, 1994 (Act No. 4 of 1994); or (b) who is not a South African citizen or not permanently resident in the Republic, excluding a refugee, a valid passport or travel document as contemplated in paragraphs (b) and (c) of the definition of 'passport' in the Immigration Act, 2002 (Act No. 13 of 2002); or (c) who is a refugee, a valid identity document issued in terms of section 30 of the Refugees Act, 1998 (Act No. 130 of 1998);"; (e) by the insertion after the definition of "identification document" of the following definition: " 'identity number' means— (a) ^ in the case of a person who is a South African citizen or who is lawfully and permanently resident in the Republic, the number referred to as the identity number in the document contemplated in paragraph (a)(i), (ii) or (iii) of the definition of 'identification document' or the number referred to as the passport number in the document contemplated in paragraph (a)(i\) of the definition of 'identification document'; in the case of a person who is not a South African citizen or who is not permanently resident in the Republic, excluding a refugee, the to as the passport number in the document number referred 'identification contemplated in paragraph (b) of the definition of document'; or in the case of a refugee, the number referred to as the identity number in the document contemplated in paragraph (c) of the definition of 'identification document';"; and (b) (c) 60 (f) by the insertion after the definition of "indirect communications" of the following definition: 6 No. 31784 Act No. 48, 2008 GOVERNMENT GAZETTE, 9 JANUARY 2009 REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT ACT, 2008 " 'informal settlement' means a place in an urban or rural setting used for residential purposes and in respect of which no physical addresses or street particulars are officially assigned;". Substitution of section 40 of Act 70 of 2002

2. The following section is hereby substituted for section 40 of the principal Act: "Information to be obtained and kept by electronic communication service provider who provides a mobile cellular electronic communi­ cations service 40> (1) (a) Subject to paragraph (b), an electronic communication service provider who provides a mobile cellular electronic communications service shall not activate a SIM-card on its electronic communication system unless subsection (2) has been complied with. (b) Paragraph (a) does not apply to a customer of an electronic communication service provider who provides a mobile cellular electronic communications service outside the Republic who enters the geographical coverage area of a mobile cellular electronic communication service provider in the Republic and uses the electronic communication system of such provider to make, receive and send voice calls or data or access other services. (2) From the date of commencement of this section an electronic communication service provider must, subject to subsection (4), at own cost implement a process to record and store, and must record and store— the Mobile Subscriber Integrated Service Digital Network number (a) (MSISDN-number) of the SIM-card that is to be activated by an electronic communication service provider at the request of a person contemplated in paragraphs (b) and (c)\ in the case of a person who— (i) is a South African citizen or is lawfully and permanently resident in the Republic, the full names and surname, identity number and at least one address of such person who requests that a SIM-card referred to in subsection (1) be activated on the electronic communication system of an electronic communication service provider; or (b) (ii) is not a South African citizen or who is not permanently resident in the Republic, and who requests that a SIM-card referred to in subsection (1) be activated on the electronic communication system of an electronic communication service provider, the full names and surname, identity number and at least one address of such person and the country where the passport was issued; or (c) in the case of a juristic person— (i) the full names, surname, identity number and an address of the authorised representative of the juristic person; and (ii) the name and address of the juristic person and, where applicable, the registration number of the juristic person. 8 No. 31784 Act No. 48, 2008 GOVERNMENT GAZETTE, 9 JANUARY 2009 REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT ACT, 2008 (3) (a) For the purposes of subsection (2), an electronic communication service provider must, in the manner provided for in paragraph (b), verify— (i) the full names, surname, identity number and identity of the person contemplated in subsection (2)(b) and (c) and, where applicable, the country where the passport was issued; (ii) the name and, where applicable, the registration number of the juristic person; (iii) in the case of a person contemplated in subsection (2)(b)(\) and (c), the address; and (iv) the authority of the representative of a juristic person. (b) An electronic communication service provider must verify— (i) the information contemplated in paragraph (a)(\) by means of an identification document; (ii) the information contemplated in paragraph (a)(ii) by means of documentation, including a registration document, founding state­ ment, document issued by the South African Revenue Service or any other similar document; (iii) the address contemplated in paragraph (a)(in) by means of documen­ tation, including a bank statement, a municipal rates and taxes invoice, telephone or cellular phone account of not older than three months, or any other utility bill or an account of a retailer of not older than three months, or an existing lease, rental or credit sale agreement, insurance policy, a current television licence or a new motor vehicle licence document; and (iv) the authority of the representative of the juristic person by means of a letter of authority or an affidavit. (4) (a) An electronic communication service provider must ensure that— (i) the process contemplated in subsection (2); (ii) the information recorded and stored in terms of that subsection; and (iii) the facility in or on which the information is recorded and stored, are secure and only accessible to persons specifically designated by that electronic communication service provider. (b) The Minister may, in consultation with the Cabinet member responsible for communications, by notice in the Gazette, determine security standards relating to the matters contemplated in paragraph (a). (5) From the date of commencement of this section, any customer who sells or in any manner provides an activated SIM-card to a person, other than a family member, and the person who is to receive the SIM-card must, immediately upon the sale or provision of the SIM-card, provide the relevant electronic communication service provider with— (a) the full names, surname and identity number of the customer; and (b) all particulars as required in subsection (2) in respect of the person who is to receive the SIM-card. (6) (a) An electronic communication service provider must, upon receipt of the information provided in terms of subsection (5)— (i) verify the full names, surname, identity number and identity of the persons with reference to the persons' identification documents; (ii) verify the address, contemplated in subsection (3)(a)(iii), of the person the documents the SIM-card by means of who contemplated in subsection (3)(/?)(iii); and to receive is (iii) verify the particulars contemplated in subsection (2)(a). (b)An electronic communication service provider must, upon receipt of the information provided in terms of paragraph (a), immediately record and store the information as contemplated in subsection (2). 10 No. 31784 Act No. 48, 2008 GOVERNMENT GAZETTE, 9 JANUARY 2009 REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT ACT, 2008 (7) (a) An applicant may, for the purposes of making an application for the issuing of a direction, in writing, request an electronic communication service provider to— (i) confirm that the person specified in the request is or was a customer of that electronic communication service provider; and 5 (ii) provide the applicant with the information recorded and stored in terms of subsection (2). (b) An electronic communication service provider who receives a request referred to in paragraph (a) must immediately comply with that request if the person specified in the request is or was a customer of the electronic 10 communication service provider concerned. (8) If an employee or agent of an electronic communication service provider knows or suspects that an identification document submitted for verification as contemplated in subsection (3) is false, he or she must, within 24 hours, report the matter to a police official at any police station. 15 (9) An electronic communication service provider must, on its electronic communication system, record and store— (a) every MSISDN-number used with every IMEI-number; and (b) every IMEI-number used with every MSISDN-number, which must, on production of a direction, be provided to an applicant within 20 12 hours. (10) The information recorded and stored in terms of subsections (2), (6) and (9) must be stored by an electronic communication service provider for a period of five years after— (a) a customer has cancelled his or her contract with the electronic 25 (b) communication service provider; or the electronic communication service provider has ended the elec- tronic communications service provided to the customer.". Amendment of section 51 of Act 70 of 2002

3. Section 51 of the principal Act is hereby amended— 30 (a) by the substitution in subsection (\)(a) for subparagraph (i) of the following subparagraph: "(i) contravenes or fails to comply with section 6(2), 7(4), 8(4), 29(8), [40(1), (2) or (3),] 42(1) or 45(1);"; (b) by the insertion after subsection (3) of the following subsections: 35 4 t(3A) Any electronic communication service provider who fails to comply with— (a) (b) the directives issued in terms of section 3Q(2)(a); section 40(1), (2), (3), (4) or any determination made thereunder, (6), (7), (9) or (10); or section 62(6)(a), (b), (c) or (d), (c) is guilty of an offence and liable on conviction to a fine not exceeding R100 000 for each day on which such failure to comply continues. 40 (3B) Any customer or person who fails to comply with section 40(5) is guilty of an offence and liable on conviction to a fine or to imprisonment 45 for a period not exceeding 12 months. (3C) An employee or agent of an electronic communication service provider who fails to comply with section 40(8), is guilty of an offence and liable on conviction to a fine or to imprisonment for a period not exceeding 12 months. 50 (3D) Any— juristic person contemplated in section 62C(1); or (a) (b) person contemplated in section 62C(2), who fails to comply with section 62C, is guilty of an offence and liable on conviction to a fine not exceeding R2 000 000 or to imprisonment for 55 a period not exceeding 10 years."; and 12 No. 31784 Act No. 48, 2008 GOVERNMENT GAZETTE, 9 JANUARY 2009 REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT ACT, 2008 (c) by the deletion in subsection (5) of the word " o r" at the end of paragraph (b) and the insertion after that paragraph of the following paragraph: "(bA) subsection (3A) does not relieve any electronic communication service provider of the obligation to comply with— (i) the directives issued in terms of section 30(2)fa); (ii) section 40(1), (2), (3), (4) or any determination made there­ 5 under (6), (7), (9) or (10); or (iii) section 62(6)fa), (b), (c) or (d)\ or". Amendment of section 62 of Act 70 of 2002

4. Section 62 of the principal Act is hereby amended by the substitution for subsection 10 (6) of the following subsection: "(6) (a) Notwithstanding section 40(1), an electronic communication service provider who, prior to the date of commencement of this section, provides a mobile cellular electronic communications service must, within 18 months from the said date, record and store the information contemplated in section 40(2) in respect of all customers whose SIM-cards are activated on its system, if the information in question has not already been recorded and stored in terms of section 40. (b) Section 40(2), (3), (4), (9) and (10) applies with the necessary changes in respect of the information recorded and stored in terms of paragraph (a). 15 (c) The obligations and rights conferred upon a person and an applicant in terms 20 of section 40(7) and (8) apply with the necessary changes. (d) An electronic communication service provider shall not allow service continuation on its electronic communication system in respect of any activated SIM-card if the information referred to in paragraph (b) has not been recorded and stored at the expiry of the 18-month period contemplated in paragraph (a).". 25 Insertion of sections 62A, 62B and 62C in Act 70 of 2002

5. The following sections are hereby inserted in the principal Act after section 62: "Determination of tariffs

62A. The Minister may, in consultation with the Cabinet member responsible for communications, at the request of any electronic commu­ nication service provider who provides a mobile cellular electronic tariffs of compensation communications service, determine uniform payable by the electronic communication service providers who provide a mobile cellular electronic communications service, to persons employed to record and store the information contemplated in sections 40 and 62(6) of the Act. 30 35 Information to be provided to customers

62B. An electronic communication service provider who provides a mobile cellular electronic communications service must, from the date of commencement of this section, inform— (a) a customer of his or her obligations in terms of sections 40, 41 and 40 62(6) and 62C of the Act; (b) a customer of the manner in which the obligations must be complied with; and (c) a customer of the consequences of non-compliance with the obliga- 45 tions. Keeping of information by juristic persons and persons who lease SIM-cards 62C. (1) Any juristic person, having complied with section 40(2) or 62(6), and who provides a SIM-card to a person in its employment must, 50 before handing over the SIM-card to the other person— 14 No. 31784 Act No. 48, 2008 GOVERNMENT GAZETTE, 9 JANUARY 2009 REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT ACT, 2008 (a) record the particulars as required in section 40(2) and the date on and period for which the SIM-card is provided; and (b) verify— (i) the full names, surname, identity number and identity of the person to whom the SIM-card is provided; and the address contemplated in section 4Q(3)(a)(ui), by means of documentation contemplated in section 40(3)(b). (ii) (2) Any person, having complied with section 40(2) or 62(6), and who rents a SIM-card to another person must, before handing over the SIM-card to the other person— (a) record the particulars as required in section 40(2) and the date on and period for which the SIM-card is rented; and (b) verify— (i) (ii) the full names and surname, identity number and identity of the person to whom the SIM-card is rented; the name and, where applicable, the registration number of the juristic person; and the address contemplated in section 4Q(3)(a)(iii), by means of documentation contemplated in section 40(3)(b). (iii) 10 15 (3) The information referred to in subsections (1) and (2) must be stored 20 for a period of five years. (4) (a) An applicant may, for the purposes of making an application for the issuing of a direction, in writing request a person contemplated in subsection (1) or (2) to provide the applicant with the information recorded and stored in terms of subsection (1) or (2), respectively. 25 (b)A person contemplated in subsection (1) or (2) who receives a request referred to in paragraph (a) must immediately comply with that request if the request relates to any SIM-card in its, his or her possession or to any person to whom the SIM-card was provided or rented. (5) If a person contemplated in subsection (1) or (2) knows or suspects 30 that an identification document submitted for verification as contemplated in section 40(3) is false, it, he or she must, within 24 hours, report the matter to a police official at any police station.". Substitution of section 63 of Act 70 of 2002

6. The following section is hereby substituted for section 63 of the principal Act: 35 'Short title and commencement 63. (T) This Act is called the Regulation of Interception of Communica­ tions and Provision of Communication-related Information Act, 2002, and comes into operation on a date fixed by the President by proclamation in the Gazette. (2) Notwithstanding subsection (1), sections 40 and 62(6) come into the Regulation of Interception of Information operation on Communications and Provision of Communication-related Amendment Act, 2008, takes effect.". the date on which Short title and commencement

7. This Act is called the Regulation of Interception of Communications and Provision into Information Amendment Act, 2008, and comes of Communication-related operation on a date determined by the President by proclamation in the Gazette. 40 45