Privacy and Personal Data Protection in Africa; a Rights-Based Survey Of
Total Page:16
File Type:pdf, Size:1020Kb
Privacy and personal data protection in Africa A rights-based survey of legislation in eight countries 1 Privacy and personal data protection in Africa: A rights-based survey of legislation in eight countries Coordination team Koliwe Majama (APC) Janny Montinat (APC) Anriette Esterhuysen (APC) Compiled by Hlengiwe Dube, University of Pretoria, Centre for Human Rights Avani Singh, ALT Advisory Copy editing and proofreading Lynne Stuart (Idea in a Forest) Lori Nordstrom (APC) Lynn Welburn Publication production and support Cathy Chen (APC) Graphic design Monocromo Published by the African Declaration on Internet Rights and Freedoms Coalition https://africaninternetrights.org May 2021 Creative Commons Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0 ISBN 978-92-95113-39-8 APC-202103-CIPP-T-EN-DIGITAL-329 Supported by the Deutsche Gesellschaft für Internationale Zusammenarbeit GmbH Table of contents Introduction and overview 5 Alan Finlay Introduction et vue d’ensemble 15 Alan Finlay Ethiopia 26 Dr. Kinfe Micheal Yilma Addis Ababa University Law School Kenya 78 Sigi Waigumo Mwanzia Namibia 115 Pria Chetty and Alon Alkalay EndCode Nigeria 180 Fola Odufuwa South Africa 212 Gabriella Razzano Tanzania 268 Rebecca Ryakitimbo Togo 304 Emmanuel Agbenonwossi Executive director, Afrotribune Uganda 340 Paul Kimumwe Collaboration on International ICT Policy in East and Southern Africa (CIPESA) Abbreviations and acronyms ACHPR African Commission on Human and Peoples’ Rights AfCTFA African Continental Free Trade Area AfDec African Declaration on Internet Rights and Freedoms AU African Union ccTLD Country code top-level domain CSO Civil society organisation DPA Data protection authority EAC East African Community ECOWAS Economic Community of West Africa States GDPR General Data Protection Regulation HRBA Human rights-based approach ICCPR International Covenant on Civil and Political Rights ICT Information and communications technology ISP Internet service provider SADC Southern African Development Community SDGs Sustainable Development Goals UDHR Universal Declaration of Human Rights UNHRC United Nations Human Rights Committee UPR Universal Periodic Review Please note that these are the abbreviations and acronyms most frequently used throughout this publication. This list is not exhaustive, as there are also numerous country-specific abbreviations and acronyms that are only used in the chapters from those particular countries. Introduction and overview Alan Finlay Research coordinator Of the eight countries surveyed here, only four have comprehensive data protection privacy acts in place: Kenya, South Africa, Togo and Uganda. But as these research reports suggest, this is not necessarily a strong indicator of whether a country is committed to privacy rights, or of the efficacy of a country’s legislative environment in ensuring the right to privacy and data protection. Instead, reading across the reports, what can be described as an asymmetry between legislation and practice is evident at different levels. This asymmetry can be political – for example, Togo, an effective constitutional dictatorship marked by fierce government crackdowns on opposition and recent reports of 5 surveillance of religious and political leaders, enacted a data protection law in 2019, and is one of the few countries in Africa to have ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention). Yet, as the country author suggests, “This interest [by policy makers in digital rights] is not necessarily to protect the citizens but rather out of concern to adapt state policies to the global digital situation.” This asymmetry also concerns the regulatory framework for the implementation of a data protection act. Amongst the countries surveyed here, South Africa was the first to pass a protection of personal information act (in 2013), but still has not implemented the necessary regulations to give practical force to the law. In contrast, while Nigeria’s privacy law is still in draft form, it already has what the country author describes as “watershed” privacy regulations. There is a different kind of asymmetry between many of the regional instruments that provide obligations on countries to develop corresponding legislation, with the suggestion that inter-regional laws, such as the European Union’s General Data Protection Regulation (GDPR), are more effective in shaping national legislation than instruments and conventions developed in Africa. Global conventions and instruments provide a relatively stable framework of commitments for signatory governments to enact privacy legislation. These include the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights, as well as sister conventions such as the Convention on the Rights of the Child (UNCRC) and the Convention on the Rights of Persons with Disabilities. States are 6 also party to the United Nation’s 2013 resolution on the right to privacy in the digital age, which asserts that the ordinary rights to privacy must also be protected online. Regional instruments and laws, particularly from the European Union (EU), also shape national privacy legislation in Africa. For example, the Council of Europe’s Modernised Convention for the Protection of Individuals with regard to the Processing of Personal Data has been used in developing a draft privacy law in Namibia, while the GDPR is used as model privacy legislation and provides a necessary reference for legislative alignment – it is applicable to all EU entities, even if they are based outside of the EU. While umbrella charters such as the African Union’s Banjul Charter make no explicit mention of the right to privacy, a matrix of regional instruments on the continent can be read in the context of privacy. These include the Southern African Development Community Model Law on Data Protection, the African Commission on Human and Peoples’ Rights new Declaration of Principles on Freedom of Expression and Access to Information in Africa, the African Charter on the Rights and Welfare of the Child, which uses similar but modified language to the UNCRC, the East African Community’s Framework for Cyberlaws, and the African Continental Free Trade Agreement, which requires states to protect the personal data of individuals and the confidentiality of their records in the processing and dissemination of that data. However, there is an uneven sense of the efficacy of these regional instruments in encouraging states to adopt progressive privacy legislation. For example, Ethiopia has yet to accede to any of the continent’s data protection instruments but has published a Draft Personal Data Protection Proclamation. In Kenya, the 7 privacy rights of children are not properly legislated, despite the country’s regional and global commitments. Of the countries surveyed, only Togo has ratified the Malabo Convention. Yet South Africa, as mentioned, has had a data protection law in place since 2013. Although Nigeria signed the communique adopting the Convention in 2014, it has yet to ratify it. As the country author argues: “The Convention does not have the force of law both within the country and on the continent, [and] nevertheless the national government has been taking steps towards privacy and data protection prior to and since the adoption of the Convention.” The purpose of the country reports collected here was to offer an in-depth rights-based analysis of the status of privacy and data protection legislation in the countries surveyed. The reports were part of a project by the African Declaration on Internet Rights and Freedom (AfDec) Coalition, “Strengthening a rights- based approach to data protection in Africa”, whose objective was to foster a rights-based approach to the adoption and implementation of this legislation. In assessing country contexts, the authors responded to a detailed research template. This involved an analysis of a state’s regional and global commitments to privacy, and of the country’s legislative environment impacting on privacy, a specific analysis of the comprehensive data protection law as it exists in each country, and the identification of key privacy rights actors and institutions, including an evaluation of the data protection practices in internet country code top level domain name (ccTLD) registration and the status of the country’s data protection authority. Two key frameworks used for analysis for this research were Principle 8 of the African Declaration on Internet Rights and Freedoms, which deals with privacy and personal data protection, and the human rights- based approach (HRBA) to policy and legislative development, 8 whose basic principles include participation, accountability, non- discrimination and equality, empowerment and legality. The country reports offer the necessary specifics of country-level analysis which this introductory overview can merely suggest. Table 1 summarises the status of comprehensive data privacy laws in the countries surveyed. As all country report authors point out, there is, besides this law, a mix of country-level legislation that impacts on the right to privacy. These include penal codes, competition and consumer acts, cybercrime and communications laws, health acts, freedom of information laws, and specific legislation such as those dealing with biometrics and identity documents or the registration of SIM cards. The table needs to be read in this context. Table 1. Status of data protection legislation