Turning journalism into a legal hazard

By Zororai Nkomo | 8h ago

Journalists at a press conference

March 11, 2022 marked the dawn of an era, which to date has complicated Zimbabwe’s media landscape and the practice of journalism following the promulgation and subsequent enactment of the Cyber and Data Protection Act of 2021.

While this piece of legislation purports to secure data and build trust in technology, a critical analysis of its various provisions reveals that it poses a severe and direct threat to journalists, media freedom, and the constitutional right to freedom of expression enshrined in Section 61 of the Constitution of Zimbabwe. This article aims to provide a legal analysis of how the Cyber and Data Protection Act affects journalism practice and media freedom.

The legislation transforms what should be a data protection framework into an effective tool for surveillance, censorship, and criminalisation of legitimate journalistic work. Since its operationalisation, at least five journalists have become casualties of this piece of legislation.

The most serious threat to media freedom emerges from Part XI of the Act, which amends the Criminal Law (Codification and Reform) Act. New offences introduced under this section are framed in language that is disturbingly broad and imprecise.

Such vagueness creates uncertainty, where journalists cannot reasonably predict what conduct might expose them to arrest or prosecution. By granting authorities sweeping discretion to interpret ordinary reporting as criminal behaviour, these provisions risk turning routine journalism into a legal hazard.

In doing so, they not only endanger individual reporters but also chill investigative reporting and weaken the public’s right to receive information.

Section 164C of the Act criminalises the transmission of a “false data message” where there is an intention to cause harm. While this may appear reasonable at first glance, it has serious implications for journalism practice. In the ordinary course of their work, journalists, particularly those engaged in investigative reporting, often rely on leaks, whistleblowers, and sources whose information may be strongly disputed by those in positions of power. However, disagreement is not the same as falsehood.

The real danger created by this provision is that a simple denial by a government official could become the basis for a criminal charge, effectively shifting the burden onto the journalist to defend their reporting in a criminal court. In such circumstances, the state becomes both the aggrieved party and the arbiter of what constitutes the “truth.” This creates a scary environment where journalists hesitate to publish legitimate stories on corruption, abuse of power, or human rights violations for fear of arrest and prosecution.

Keep Reading

In practice, the threat of being charged for publishing information later contested or deemed “false” risks punishing not only malicious disinformation but also bona fide reporting. By casting such a wide net, the provision does not merely deter harmful conduct, but it further risks criminalising journalistic error and silencing critical voices essential to a democratic society.

Section 164B of the Act prohibits the sending of messages intended to “coerce, intimidate, harass, threaten, bully or cause substantial emotional distress, or to degrade, humiliate or demean.” While protecting individuals from genuine abuse is an important objective, the breadth and subjectivity of this language create serious risks for media freedom.

In the context of journalism practice, particularly political reporting and commentary, strong language is often necessary to hold those in power accountable. Investigative exposés, hard-hitting opinion pieces, and even satire are designed to challenge, question, and sometimes sharply criticise public officials. Yet under such a broadly framed provision, a public official who feels embarrassed or politically threatened could characterise legitimate criticism as “harassment” or an attempt to “demean.”

This blurring of the line between abuse and accountability creates a chilling effect. Journalists may begin to temper their language, avoid controversial subjects, or decline to publish critical commentary altogether for fear of criminal sanction. In doing so, the law risks suppressing the very robust, uncomfortable, and sometimes confrontational debate that is essential to a healthy democracy. Protecting dignity should not come at the expense of silencing scrutiny.

Sections 10, 11 and 12 of the Act create serious practical obstacles for investigative journalism. Section 10 requires consent before personal (non-sensitive) data can be processed. Section 11(1) goes further, prohibiting the processing of sensitive data without the data subject’s written consent. Section 12 imposes an even stricter standard, barring the processing of genetic, biometric and health data unless the individual has expressly agreed in writing.

In a journalistic context, “processing” is not an abstract technical term; it covers the everyday work of reporting, which includes but not limited to collecting documents, recording interviews, analysing records, and publishing findings. This raises an obvious and troubling question. How is a journalist expected to obtain written consent from a corrupt politician before examining their financial dealings, or from a company before exposing abusive labour practices? The very subjects of investigative reporting are often those with the strongest incentive to refuse consent.

Although the Act provides exemptions for matters such as material used to prove an offence or processing in the “substantial public interest”, these safeguards are not automatic. They depend on how the Data Protection Authority, and ultimately the courts, interpret them. In practice, this uncertainty leaves journalists operating under a constant cloud of legal risk. Each time they handle personal information without consent in pursuit of a story of public importance, they face the possibility of civil lawsuits or even criminal charges from the powerful actors they are scrutinising.

Section 9 of the Act requires that personal data be collected for “specified, explicit and legitimate purposes” and not later used in a way that is incompatible with those original purposes. On paper, this sounds reasonable. In practice, however, it sits uneasily with the realities of journalism.

Journalism is an iterative process. A journalist may begin looking into a procurement tender and, in the process, uncover evidence of tax evasion, abuse of office, or labour exploitation.

Information gathered for one story often opens the door to another, sometimes more serious, revelation. That is not misuse; it is the very essence of accountability journalism.

Yet Section 9 could be invoked to argue that a journalist who uses information for a new or evolving story has processed it for a purpose different from the one initially stated. This creates uncertainty and legal exposure for reporters who are simply following the evidence where it leads. Instead of encouraging thorough investigations, such a provision risks penalising them, placing journalists in legal jeopardy for doing what the public expects them to do, of uncovering the full truth.

While presented as a modern data protection law, the Cyber and Data Protection Act is, in practice, a comprehensive legal framework for controlling information and suppressing dissent. The Act fundamentally undermines Section 61 of the Constitution, which guarantees freedom of the media. It replaces the possibility of robust, critical journalism with a climate of fear and self-censorship, empowering the state to police the digital public square and punish those who seek to hold it to account. It is less a law about data protection and more a blueprint for digital authoritarianism.

Zororai Nkomo is a journalist, lawyer and African Human Rights System specialist. He writes in his own personal capacity. He can be contacted at [email protected]