LAZ Opposes Zambia’s New Cyber Laws Over Rights Infringement

On 5th December, 2024, the Law Association of Zambia (LAZ)  issued its position on the proposed legislation; the Cyber Security and Cyber Crimes Bills then under consideration by the National Assembly. In our statement, we expressed serious concern that certain provisions of the proposed legislation risked undermining fundamental rights guaranteed in the Bill of Rights and were not aligned with our national values and principles of good governance, democracy and constitutionalism enshrined in Article 8 of the Constitution.

At the time, it was our considered view that the proposed legislation had the potential to contravene fundamental rights, such as the right to privacy and freedom of expression.

We then called on the Government to withdraw the Bills from the National Assembly and to allow for a transparent and meaningful consultative process with all stakeholders, before their re-introduction on the floor of the House. Although the Government commendably heeded the calls from various stakeholders and deferred the Bills to facilitate consultations, the resultant consultative process fell short of meaningfully addressing the numerous concerns of stakeholders, including those expressed by LAZ. The Government decided to re-introduce the Cybersecurity and Cyber Crimes Bills which were then hurriedly passed through the floor of the National Assembly and have since been assented into law.

As LAZ, our position is that numerous provisions of the newly enacted Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025 (the “new cyber laws”), infringe upon the rights and freedoms of citizens, hinder a free press and have the potential to undermine the cherished democracy in our country, Zambia, which our founding leaders fought so hard to preserve.

It is important to appreciate that under Article 20 of the Bill of Rights, Part 3 of the Constitution, freedom of expression and free press is guaranteed. Article 20 provides that except with his or her own consent, no person shall be hindered in the enjoyment of the freedom of expression, that is to say, freedom to hold opinions without interference, freedom to receive ideas and information without interference, freedom to impart and communicate ideas and information without interference, whether the communication be to the public generally or to any person or class of persons, and freedom from interference with his or her correspondence. Furthermore, under Article 20 (2) of the Constitution, a free press is guaranteed by an express enactment that no law shall make any provision that derogates from freedom of the press.

However, various provisions of the new Cyber laws infringe upon these provisions. For instance, the Cyber Crimes Act, in particular:

(1) Section 5 prohibits the unauthorised disclosure of data relating to critical information or critical information infrastructure, which critical information is expansively defined to include computer data that relates to public safety, public health, economic stability, national security, international stability and sustainability, essentially making it illegal to receive ideas, impart and communicate ideas without authorization by the State.

(ii) Section 6 prohibits the unauthorised possession of data relating to critical information or critical information infrastructure, thereby making it illegal to hold opinions or information relating to computer data that relates to public safety, public health, economic stability, national security, international stability and sustainability without authorization by the State.

(iii)  Section 19 Prohibits transmission of unsolicited deceptive electronic communication, and in particular 19(1) (d) criminalizes falsifying headers of information in an electronic communication and initiate the transmission of such electronic communication to deceive or mislead users. Potentially, Journalists who publish stories under a headline which is considered misleading to users by the State can be prosecuted on the charge of falsifying headers with intent to mislead or deceive readers, and would be liable, on conviction, to imprisonment up to seven years.

(iv)  Section 21 prohibits the unlawful disclosure of details of investigation under the Act, making it illegal to communicate information relating to an investigation without authorization by the State, despite the fact that the Investigation is itself instigated by the State, and notwithstanding the merits of the said investigation. Citizens can potentially be jailed up to five years for failure to get permission from the State to disclose that they are being investigated, even when the investigation lacks merit and may in fact be malicious.

(vi) Section 22 prohibits transmission of electronic data which the State considers to be obscene, vulgar, lewd, lascivious or indecent with intent to humiliate, harass or cause substantial emotional distress to another person. Further, disseminating information which is false which causes embarrassment or defames another, is criminalized with a punishment up to 2 years. The inherent danger with these provisions is the subjective nature of the offences, with huge potential by the State to use the provisions to stifle dissent or opposing views, under the guise that the communication is false.

Section 24(1) (b) elevates the offence of inciting or attempting to incite ethnic divisions among the people of Zambia to terrorism, punishable by imprisonment for life. While LAZ does not support, and in fact condemns, any form of tribalism or inciting ethnic divisions, the potential danger lies in the weaponization of such a provision by prosecuting only political opponents. Through this provision, the State can conveniently send all those with dissenting views to life imprisonment in the name of cyber terrorism.

Additionally, there is no exemption made for the press to freely disseminate computer data relating to matters of public safety, public health, economic stability, national security, international stability and sustainability. This omission effectively criminalizes the dissemination of critical information without the authorization by the State by journalists. A free press is critical in informing the public so as to assure good governance, democracy and constitutionalism, which form the bedrock of our Society. Even the business community which disseminates critical information affecting economic stability without permission of the State may be prosecuted, an eventuality which has the potential of undermining the much-needed economic development of the country.

Furthermore, the localization of the Zambia Cyber Security Agency in the Office of the President, operating at the general direction of the President, as opposed to an independent institution, raises serious governance issues. This, coupled with the expansive definition of critical information under the Cyber Security Act, significantly heightens the risk of cyber security being used as a tool for political control rather than national protection. Such a framework undermines public trust and poses a danger to the objective and impartial enforcement of cyber laws in Zambia.

It is LAZ’s view that effective laws must strike a careful balance, ensuring that security measures are proportionate, necessary, and subject to robust oversight mechanisms that protect constitutional freedoms. Laws must also not hinder the citizens’ rights to hold accountable, those given the mantle to govern, as there can be no democracy without people’s effective participation in Governance. As a result of the enactment of the new Cyber laws, LAZ has resolved to petition the High Court to review the constitutionality of the provisions which infringe on the rights and freedoms of citizens and a free press.