The Right to Privacy in Tanzania in the Era of Digital Surveillance: A Critical Analysis of the Adequacy of the Legal Framework

Review

Emmanuel Nicholaus Msuya examines whether Tanzania's legal framework adequately protects privacy against contemporary digital surveillance. Using doctrinal legal analysis, the article reads Article 16 of the Constitution together with the Personal Data Protection Act 2022, the Cybercrimes Act, the Electronic and Postal Communications Act, the Criminal Procedure Act, and relevant international and regional human-rights instruments. Its principal conclusion is that Tanzania has moved materially toward statutory protection of personal data while still lacking a coherent surveillance-governance framework. The relevant legal powers and safeguards are distributed across institutions and statutes, leaving surveillance authorization, necessity and proportionality review, independent oversight, accountability, and remedies incompletely specified.

The paper's contribution is primarily institutional synthesis rather than doctrinal novelty. It usefully distinguishes data protection from surveillance governance. A data-protection authority can supervise personal-data processing without thereby controlling when police or security bodies may intercept communications, access metadata, or conduct broader surveillance. That distinction exposes a central governance problem: recognizing privacy as a right does not itself allocate or constrain surveillance decision rights. The paper therefore shifts attention from whether Tanzania possesses privacy law to whether the state has built a credible control architecture around surveillance power.

Its methodology is appropriate to that question. The analysis selects constitutional provisions, statutes, judicial authorities, international standards, and comparative cases according to legal authority and relevance, then tests the framework against legality, necessity, proportionality, accountability, transparency, and judicial oversight. Roman Zakharov and AmaBhungane are used as persuasive comparators rather than transplanted rules. This supports the article's core finding that formal legality is not equivalent to institutional adequacy.

The main limitation is that the proposed reforms remain at the level of normative architecture. The article recommends comprehensive surveillance legislation, prior judicial authorization, a stronger Personal Data Protection Commission, and continuing legislative and judicial review. It does not specify how authorization should operate across surveillance types, how emergency exceptions would be bounded, when post-hoc review or notification would be required, what records must survive for audit and challenge, how unlawful surveillance would be detected, or what concrete remedies would be available. Those omissions do not negate the diagnosis because the paper does not claim to supply a full statutory model. They do, however, mark the boundary between identifying governance deficits and designing an executable surveillance regime.

The governance implication is sharper than the paper states explicitly. Fragmentation does more than create legal uncertainty. It can distribute responsibility so widely that no institution is clearly answerable for the full surveillance lifecycle. A rights framework can therefore coexist with effective surveillance capacity while accountability remains partial, delayed, or difficult to invoke. The reform question is not only whether Tanzania should enact another law, but whether any new framework assigns observable authority for approval, supervision, recordkeeping, challenge, remedy, and institutional sanction. That is the condition under which privacy protection becomes governable rather than declaratory.

Key Insight

A constitutional privacy right does not meaningfully govern surveillance unless the state also constrains who may authorize surveillance, how necessity is tested, who independently reviews its exercise, and how affected persons can obtain remedy.