MADLANGA J [105] Section 37(1) also refers back to section 35(1)(f). It provides that the head of an interception centre must keep or cause to be kept proper records of such information as may be prescribed by the director in terms of section 35(1)(f). Obviously, this too does not assist the case of the Minister of State Security. In terms of section 37(2) heads of interception centres must on a quarterly basis or as required by the director submit reports to the director. For present purposes, the reports must deal with the records kept in terms of section 37(1). I need not say what has now become the usual refrain of the inutility of these sections as they all have as their base the deficient section 35(1)(f). [106] Section 42, another section relied upon by the Minister of State Security, contains a blanket prohibition on the disclosure of information obtained through the application of RICA. Absent detail on what information must be kept and how it must be kept, this does not help much. [107] Looked at in their totality, all the sections invoked by the Minister of State Security to meet the applicants’ challenge fail to address the substance of the complaint. And it is a valid complaint. The sections give no clarity or detail on: what must be stored; how and where it must be stored; the security of such storage; precautions around access to the stored data (who may have access and who may not); the purposes for accessing the data; and how and at what point the data may or must be destroyed. Thus there is a real risk that the private information of individuals may land in wrong hands or, even if in the “right” hands, may be used for purposes other than those envisaged in RICA. All this exacerbates the risk of unnecessary intrusions into the privacy of individuals. The minimum standards for the proper management of surveillance data were set out as follows by the European Court of Human Rights (ECHR) in Weber: “[T]he nature of the offences which may give rise to an interception order; a definition of the categories of people liable to have their telephones tapped; a limit on the duration of telephone tapping; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other 58