Shanil's SIM Card 'Active After Her Death' - Family Demands Answers

The family of Shanil Dzimbiri Muluzi, a victim of the June 2024 military plane crash in Malawi, has raised serious concerns before a Parliamentary Ad Hoc Committee regarding her SIM card's alleged activity and potential swapping after her death. This development highlights critical legal issues at the intersection of telecommunications regulation, data protection, and criminal investigation in Malawi. The incident calls into question the integrity of digital evidence handling in high-profile cases, the responsibilities of mobile network operators concerning deceased subscribers' data, and the adequacy of existing legal frameworks, particularly the recently enacted Data Protection Act, 2024, in safeguarding personal digital assets post-mortem. Practitioners must consider the implications for data privacy, forensic investigations, and the evolving landscape of digital estate management in Malawi.

The tragic military plane crash of June 10, 2024, which claimed the lives of Malawi's Vice President Saulos Chilima and eight others, including former First Lady Patricia Shanil Dzimbiri Muluzi, continues to unravel complex legal and ethical questions. A recent appearance by Edna Muluzi, Shanil Dzimbiri Muluzi’s daughter, before a Parliamentary Ad Hoc Committee has brought to light deeply troubling allegations: that her mother's SIM card showed activity and may have been swapped after her reported time of death.

These claims extend beyond mere technical anomalies, striking at the heart of data privacy, the chain of custody for digital evidence, and the accountability of both state actors and telecommunications providers. The family's demand for answers, encapsulated in a list of eleven pointed questions, underscores a broader public expectation for transparency and justice in the investigation of this national tragedy. For legal professionals, this case presents a compelling study of how traditional legal principles grapple with the complexities of digital footprints in an increasingly interconnected world, particularly within the nascent data protection landscape of Malawi.

Malawi's legal framework governing telecommunications and data privacy has undergone significant evolution. The Malawi Communications Regulatory Authority (MACRA), established under the Communications Act, 2016, is the primary body responsible for regulating communication services, including electronic communications. A key aspect of this regulation is the mandatory SIM card registration, which was enforced in 2018 under Section 92(1) of the Communications Act, 2016. This provision requires individuals to register their SIM cards with their full name, identity card number, and residential address, with Section 94 stipulating penalties for the use of unregistered SIM cards.

Regarding data protection, the Electronic Transactions and Cyber Security Act, 2016 (ETCSA), initially contained provisions aimed at regulating electronic transactions, protecting against cybercrime, and ensuring the security of digital communications, including aspects of data protection and privacy under Part VII. However, Malawi has since enacted the dedicated Data Protection Act, 2024, which repeals the data protection provisions of the ETCSA and designates MACRA as the national data protection authority. This new Act establishes comprehensive guidelines for processing, storing, and sharing personal data, mandating principles such as lawfulness, fairness, transparency, purpose limitation, and data minimisation, while also empowering data subjects with rights to access, correct, and erase their personal data.

The allegations surrounding Shanil Dzimbiri Muluzi's SIM card activity post-mortem raise several critical legal questions under Malawian law. Firstly, the reported 'iCloud activity' and potential SIM card swapping directly implicate the data protection principles enshrined in the Data Protection Act, 2024. This Act requires personal data to be processed lawfully, fairly, and transparently, and only with the unambiguous consent of the data subject, or under specific legal obligations or vital interests. The alleged access and alteration of a deceased person's digital identity without clear authority would constitute a significant breach of these principles, potentially leading to investigations by MACRA, which is empowered to investigate violations of the Act.

Secondly, the mandatory SIM card registration under the Communications Act, 2016, links a SIM card directly to an individual's identity. If a SIM card was indeed swapped, it implies either a failure in the telecommunications provider's security protocols, or unauthorised access and manipulation of registered subscriber information. This could expose the mobile network operator to regulatory penalties under MACRA's oversight, which includes powers to fine or even revoke licenses for non-compliance. Furthermore, the family's concerns about who accessed the phone and under what authority point to potential breaches of privacy guaranteed under Section 21 of the Constitution of Malawi, which protects against interference with private communication.

Thirdly, in the context of a high-profile investigation into a plane crash, the integrity of any digital evidence, including phone records and SIM card data, is paramount. Any unauthorised access or manipulation could compromise the entire forensic process and undermine the credibility of the parliamentary inquiry. While Malawian law provides for the investigation, collection, and use of electronic evidence under the ETCSA, the specific procedures for handling digital assets of deceased persons, particularly in criminal or quasi-criminal investigations, require robust protocols to maintain the chain of custody and prevent tampering. The absence of clear legal provisions specifically addressing the management of digital assets post-mortem, beyond general data protection principles, creates a lacuna that can lead to such disputes.

Finally, the incident highlights the broader challenge of digital estate planning in Malawi. While global trends show an increasing need for individuals to make provisions for their digital assets in their wills, Malawian estate law has yet to fully adapt to this modern necessity. Without explicit instructions from the deceased or clear statutory guidance, families and executors face significant hurdles in managing digital accounts, including SIM cards, email, and social media. The current parliamentary inquiry, therefore, has the potential to not only address the specifics of this tragic crash but also to catalyse legal reforms to better protect digital rights and assets in Malawi.

The revelations concerning Shanil Dzimbiri Muluzi's active SIM card post-mortem present a significant legal challenge for Malawi, demanding a thorough and transparent response from the Parliamentary Ad Hoc Committee. For legal practitioners, this case underscores the critical importance of understanding the interplay between telecommunications law, data protection legislation, and criminal procedure, especially when dealing with digital evidence. The Data Protection Act, 2024, and the Communications Act, 2016, provide a framework, but the specific application to deceased persons' digital assets, particularly in contentious circumstances, requires careful navigation and potentially further legislative clarity.

Practitioners should closely monitor the committee's findings and recommendations, as they could set crucial precedents for how digital assets are treated in future investigations and estate matters. This incident serves as a stark reminder for individuals to consider digital estate planning and for policymakers to review and strengthen laws to ensure the integrity of digital identities and data, even after death. The outcome of this inquiry will not only impact the quest for justice for the plane crash victims but also shape the future of digital rights and accountability in Malawi.