Apple has announced a new browsing feature designed to hide a user's browsing from others.
The article linked above said the feature is banned in:
China, Saudi Arabia or Belarus, Colombia, Egypt, Kazakhstan, South Africa, Turkmenistan, Uganda and the Philippines.
However, I thought section 14 of South Africa's constitution protected the right to privacy. Why is Apple not legally able to offer the new private browsing there?
s36 says:
- (1) The rights in the Bill of Rights may be limited only in terms of law of general application to the extent that the limitation is reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom, taking into account all relevant factors, including—
(a) the nature of the right;
(b) the importance of the purpose of the limitation;
(c) the nature and extent of the limitation;
(d) the relation between the limitation and its purpose; and
(e) less restrictive means to achieve the purpose.
South Africa has laws that allow the government to demand private information. Apple publishes a report on this.
Whether there is such a prohibition is South Africa is hard to say:
Apple could not immediately indicate which regulations in South Africa prevented it from launching Private Relay here.
Apple has not asserted that it is legally impossible in South Africa, they have simply said that they aren't doing it. The explanation may be that there is a credible legal concern, that is, they are not certain whether their system is consistent with South African law. The two relevant legal pieces that I know of are the Protection of Personal Information Act and the National Data and Cloud Policy. These are complicated pieces of law, and the comment period on the Data and Cloud Policy only recently closed, so the official policy does not yet exist. There are substantial negative consequences with failure to comply with the rules, and the rules seem to include elements of government control that do not exist in the US or the EU. Some excepts from the summary of the Data and Cloud Policy
Government must capture all public data by default in digital format; Government will store non-sentive data in the government data centre; Government will develop a framework to enable both the public and private sector to share data with everyone fairly, equitably and transparently; Government will develop governance frameworks on access to data, the purpose of data and data flow maps
The official draft policy is here. See p. 27 for a couple of statements that would be surprising in the context of US law:
To ensure ownership and control: Data generated in South Africa shall be the property of South Africa, regardless of where the technology company is domiciled...All research data shall be governed by the Research Big Data Strategy of the Department of Science and Innovation (DSI). All data generated from South African natural resources shall be co-owned by government and the private sector participant/s whose private funds were used to generate such, and a copy of such data shall be stored in the HPCDPC
In the context of legal uncertainty, it is a reasonable business decision to seek further legal analysis. Recall how a few years ago, most people were uncertain about what GDPR required / forebade. I presume that Apple simply needs time to wait for the law to firm up, and for them to understand what the law says, in case their private relay feature turns out to impose unexpected obligations on them.
