The phone as star witness
At the Madlanga Commission — the judicial inquiry Justice Mbuyiseli Madlanga has chaired since President Cyril Ramaphosa established it in July 2025 to probe alleged criminal-justice-system corruption — the most consequential exhibits are not documents. They are phones. Investigators have projected WhatsApp conversations pulled from seized handsets onto courtroom screens, using timestamps, contact lists and call logs to trace an alleged network linking businessman Vusimuzi "Cat" Matlala, Katiso "KT" Molefe and senior police figures, according to a July 24, 2026 TechCabal report. Suspended Police Minister Senzo Mchunu, National Commissioner Fannie Masemola, Deputy Commissioner Shadrack Sibiya and Crime Intelligence head Feroz Khan have all been named in proceedings (TechCabal). None has been found guilty of anything by the Commission, which makes no criminal findings itself — it refers matters for prosecution.
What's actually authorising the access
It's tempting to read POPIA — South Africa's Protection of Personal Information Act — as the rule that lets investigators into a seized phone. It isn't, and the distinction matters. POPIA Section 6 excludes processing by a public body from the Act's conditions where the purpose is "the prevention, detection, investigation or proof of offences" or "the prosecution of offenders," but only where "adequate safeguards have been established in legislation for the protection of such personal information" (POPIA s.6). The actual gatekeepers are elsewhere: search warrants, Criminal Procedure Act Section 205 subpoenas compelling telecom and platform records, RICA authorisation for any live interception, and the Cybercrimes Act's rules on digital evidence handling. POPIA's role is narrower and more structural — it conditions the carve-out on those other safeguards existing and holding, rather than handing police an unqualified pass.
Steelmanning the privacy objection
The strongest case against this arrangement is not hypothetical. A single seized phone doesn't just expose its owner — it exposes every contact, group chat and third party who messaged them, most of whom are not suspects and never consented to forensic review. And the objection carries extra weight here specifically because the institution being investigated is the same one usually trusted to police digital access: SAPS Crime Intelligence, whose own head is among those named. Handing broad metadata-extraction power to a force under active corruption investigation is a legitimate reason to ask whether "adequate safeguards" is doing real work or is just a phrase in a statute.
Why the layered model still holds
It holds because the safeguard isn't discretion left to SAPS — it's judicial. Forensic investigator Chad Thomas told TechCabal that evidence has to follow "the letter of law, or presiding officer will discard it," underscoring that admissibility, not police goodwill, is the actual check on overreach. And POPIA is not a dead letter sitting behind that check: the Information Regulator can levy administrative fines up to R10 million under Section 109 for processing that lacks the safeguards Section 6 demands (POPIA s.109), and it has been actively enforcing against public bodies through 2026, with compromise reports up roughly 40% year-on-year as monitoring intensifies. That's a live regulator with teeth, not a paper exemption.
The Commission's own conduct reinforces the point. Ramaphosa extended its reporting deadline to 16 November 2026 — with evidence-taking to close October 2 — specifically so it wouldn't have to "leave large parts of its work unfinished" by rushing testimony (The Presidency). Eighteen senior SAPS officials have been suspended as the process has unfolded, using digital evidence tested in open hearings rather than acted on quietly (TechCabal) — the opposite of a police force using a data-protection loophole to move fast and unaccountably.
The proportionate-regulation case
There is a version of this story where a corruption scandal involving police digital surveillance becomes the pretext for a blunt new statute restricting forensic access to seized devices — popular after a scandal, costly to legitimate investigations for years after. South Africa doesn't need that. POPIA's Section 6 exclusion, conditioned on external safeguards, plus RICA's warrant requirement, plus Section 205 subpoenas, plus an Information Regulator willing to fine public bodies, already form a layered system that lets investigators reconstruct a criminal network from a phone while keeping every step reviewable by a court and finable by a regulator. The Madlanga Commission is, if anything, evidence the framework is being tested exactly as intended — under maximum scrutiny, against the very institution meant to enforce it. Legislators should resist the urge to "fix" a law-enforcement exemption that a corruption inquiry is currently using to expose corruption.