Can Mauritians Still Trust the Privacy of Their Communications?

From the Jooty-Needroo Case to the “Moustass Leaks”

Qs & As

By LEX

The revocation of the CEO of the Sugar Investment Trust, following the circulation of a controversial audio recording allegedly linked to political discussions, has sparked a debate extending well beyond the circumstances of a single individual. The affair raises important legal questions concerning the admissibility of digital evidence, the protection of personal data, the emergence of AI-generated deepfakes, and the security of private communications. More fundamentally, it invites reflection on whether Mauritius’ legal and regulatory framework is adequately equipped to safeguard privacy, uphold due process and preserve public confidence in the digital era. Read on:

 * The revocation of Mrs Nishta Jooty-Needroo from her position as CEO of the Sugar Investment Trust (SIT) followed the circulation of a controversial audio recording on social media. The contents of the recording led to allegations of political manoeuvring and discussions regarding an important electoral database in Constituency No. 5, raising concerns about the alleged impartiality and political alignment of the head of a parastatal body. How do you react to this revocation?

The revocation of Mrs Nishta Jooty-Needroo as CEO of the Sugar Investment Trust (SIT) raises serious concerns regarding the potential for political interference in the management of parastatal bodies. While the SIT Board issued a communiqué confirming her departure, the circumstances surrounding the decision highlight broader issues relating to institutional integrity, due process and public trust.

* Mrs Jooty-Needroo has publicly claimed that the audio recording is entirely fabricated and has described it as a manipulated recording. Is it correct to say that, under Mauritian law, the admissibility of electronic evidence — such as digital audio recordings — depends on establishing its authenticity, integrity and relevance? If so, what standard of proof is required to authenticate a disputed digital audio recording before a Mauritian court?

Yes, the admissibility of electronic evidence — such as digital audio recordings — under Mauritian law fundamentally depends on establishing its authenticity, integrity and relevance.

Mauritian law, which is a hybrid of civil law and English common law traditions, recognises electronic records as admissible evidence, provided that certain technical and legal requirements are satisfied. The evidence must first be relevant, meaning that the audio recording must be capable of proving or disproving a fact in issue in the proceedings.

Its authenticity must also be established; that is, it must be demonstrated that the recording is what it purports to be, including the identity of the speakers and the circumstances in which it was made. The integrity of the recording must further be proven by showing that it has not been tampered with, edited or altered since it was originally captured.

Finally, the legality of the recording may also be examined. It must be established that it was not obtained in violation of fundamental rights or privacy laws, as such circumstances could affect its admissibility before a court.

* What does the Data Protection Act 2017 provide with regard to the unauthorised recording and subsequent public dissemination of private conversations? Does such conduct constitute a breach of privacy under the Act, and if so, what penalties or other legal consequences does it prescribe?

Under the Data Protection Act 2017 (DPA), the unauthorised recording and public dissemination of private conversations — including through social media platforms — may constitute unlawful processing of personal data and a serious infringement of an individual’s right to privacy.

The definition of personal data under the Act includes information that can identify an individual, which may extend to audio recordings, video recordings, photographs and other identifying information. The disclosure or dissemination of private conversations without a lawful basis or the consent of the persons concerned may breach key data protection principles, including lawfulness, fairness and transparency.

Such conduct may therefore give rise to legal consequences under the DPA, particularly where personal information is collected, processed or shared without proper justification and causes harm to the individuals concerned.

 * If the audio is, as alleged, a “deepfake” or a manipulated recording, what are the specific legal steps required to clear one’s name and hold the distributors of such misinformation accountable under both the Data Protection Act and defamation laws?

When dealing with a suspected deepfake audio recording, the person targeted must take appropriate legal and technical steps to protect their reputation and seek accountability. This may include obtaining a professional cybersecurity forensic analysis to establish whether the recording has been manipulated, edited or artificially generated.

The individual may also exercise their rights under data protection legislation, including seeking remedies against the unlawful processing or dissemination of their personal data. Depending on the circumstances, civil and/or criminal remedies under defamation laws may also be pursued against those responsible for creating, publishing or distributing the false content.

* Beyond the individuals directly involved, does the circulation of such recordings raise broader questions about the protection of personal data, the security of communications, and the ability of citizens to enjoy a reasonable expectation of privacy in the digital age?

The circulation of such recordings inevitably raises profound societal, legal and ethical questions regarding the protection of fundamental rights. When unauthorised or leaked recordings are disseminated, their impact extends far beyond the individuals directly involved, giving rise to broader concerns about the protection of personal data and the security of private communications.

The distribution of such material without consent raises serious questions about how personal information is collected, stored, accessed and shared. It also highlights potential vulnerabilities in ensuring compliance with robust data protection frameworks, both locally and internationally, and the need for stronger safeguards to preserve individuals’ right to privacy in the digital age.

 * This incident involving the former CEO of the SIT and the widespread leaks that occurred leading up to the 2024 general elections appear to be part of a broader, deeply concerning pattern regarding surveillance, privacy, and institutional integrity in Mauritius. Does it suggest a systemic vulnerability in the country’s telecommunications infrastructure?

The publication of intercepted communications involving persons occupying important positions raises serious concerns about systemic surveillance, privacy and the protection of confidential communications. Such leaks may point not only to isolated security breaches, but also to potential institutional vulnerabilities within the legal and regulatory frameworks governing lawful interception, including those overseen by the Information and Communication Technologies Authority (ICTA).

Such incidents highlight several broader issues relating to institutional integrity in Mauritius, including the adequacy of safeguards against unlawful surveillance, the protection of personal data, and the ability of regulatory bodies to ensure accountability and public confidence in communications systems.

* Do the Government, the relevant authorities, and regulators such as the Data Protection Office (DPO) and ICTA have a duty to conduct an independent forensic audit of the telecommunications network and ensure adequate safeguards against unlawful interception, data leaks and future breaches?

Under Mauritian law, regulatory bodies such as the DPO and the ICTA have an important statutory responsibility to ensure compliance with data protection, cybersecurity and communications regulations.

In the event of serious allegations involving unlawful interception, data leaks or security breaches, an independent forensic audit of telecommunications systems would be an essential step in identifying vulnerabilities, establishing accountability and restoring public confidence.

Such an assessment would help determine whether existing safeguards are adequate and whether additional measures are required to prevent future breaches and protect citizens’ fundamental right to privacy.

* Should telecommunications operators be required to strengthen transparency mechanisms, such as independent audits, security certifications, or reporting obligations, to reassure the public that communications networks cannot be misused for unlawful surveillance?

Yes. Telecommunications operators should strengthen transparency and security through independent audits, recognised security certifications and appropriate reporting obligations. Such measures enhance accountability, reinforce public confidence and help prevent the unlawful interception or misuse of communications, while maintaining an appropriate balance between cybersecurity, privacy rights and legitimate national security requirements.

* Does Mauritius need stronger legislation specifically addressing AI-generated misinformation, deepfakes, and the malicious use of synthetic media, particularly where such content can damage reputations, influence elections, or undermine public trust?

Yes. Mauritius would benefit from stronger, targeted legislation to address AI-generated misinformation, deepfakes and the malicious use of synthetic media. While existing laws on data protection, cybersecurity and defamation provide a degree of protection, they do not fully address the unique challenges posed by increasingly sophisticated AI-generated content. A dedicated legal framework would help better safeguard individual reputations, electoral integrity and public confidence in the digital age.

* At the end of the day, both the Jooty-Needroo case and the 2024 “Moustass Leaks” raise broader and fundamental questions: Can citizens trust the confidentiality of their communications? Are public institutions adequately equipped to respond to such breaches? And does the law provide sufficient protection to individuals in an era increasingly shaped by AI-generated content?

These events strike at the very foundation of public confidence. The 2024 “Moustass Leaks” and the more recent Jooty-Needroo case illustrate two distinct, yet related, threats to privacy: the risk of unlawful interception of communications and the growing misuse of digital and AI-generated content.

The “Moustass Leaks” exposed alleged large-scale wiretapping and data interception involving politicians, journalists, diplomats and members of civil society, raising serious concerns about the confidentiality of communications and the adequacy of safeguards against unlawful surveillance.

The Jooty-Needroo case, on the other hand, illustrates how leaked—or allegedly manipulated—audio recordings can have immediate and far-reaching consequences for an individual’s reputation and public office before their authenticity has been independently established.

Taken together, these cases highlight the need for stronger legal safeguards, robust cybersecurity measures, effective regulatory oversight and clear rules governing AI-generated content. Ultimately, preserving public confidence requires both secure communications infrastructure and legal frameworks capable of protecting privacy, reputation and due process in the digital age.

Mauritius Times ePaper Friday 10 July 2026