VPNs with servers in Mauritius

On application to the Judge in Chambers, an investigatory authority can obtain an order that a service provider offering services in Mauritius submit subscriber information (s. 27), an order for real-time collection of traffic data (s. 29) and an order for real-time collection of content data (s. 30).

The provider may be compelled to keep such an order confidential. The Act, in force since its proclamation on 10 December 2021, sets no standing retention period, and whether it reaches a VPN operator is not established.

Section 18(1)(m) of the Information and Communication Technologies Act 2001 makes it a function of the regulator to take steps to regulate or curtail harmful and illegal content on the internet. On that footing, Telecommunication Directive 1 of 2024, issued on 5 February 2024, requires every licensed internet service provider to run, at its own cost, an on-premises filtering set-up without deep packet inspection, operational by 4 May 2024.

The set-up blocks the sites on a list supplied by a rights holder in audiovisual content. For HTTPS traffic, blocking is at website level only. The directive recites that it follows a determination of the ICT Appeal Tribunal upheld by the Supreme Court (2022 SCJ 362).

Section 23 of the 2021 Act makes the administrator of an online account responsible for moderating “undesirable content” once an investigatory authority brings it to his attention. That covers content that is deceptive or inaccurate and posted with intent to defame, threaten, abuse or mislead the public, that threatens public health, public safety or national security, or that promotes racism.

A failure is punishable by a fine of up to one million rupees and penal servitude of up to 20 years. Misuse of a fake profile to cause harm (s. 16) and cyberbullying (s. 17) carry the same maximum penalties.

The account behind a post is identified through the provider: the production order of section 27 reaches subscriber information, and the notice of section 26 can require disclosure of the traffic data that shows the path of a communication.

The Constitution protects a person against search of person or property and entry on premises without consent, but a law made in the interests of defence, public safety, public order and similar aims does not contravene that protection unless shown not to be reasonably justifiable in a democratic society (s. 9). A person charged with an offence is entitled to a fair hearing by an independent and impartial court established by law (s. 10(1)).

The Judicial and Legal Service Commission appoints, disciplines and removes judicial officers (s. 86(1)).

The order of the rows is the security score, and a server’s location is not a recommendation.