Data protection is one of the primary ways through which the right to privacy is given effect. At least 36 African states have so far enacted data protection laws, and more are in the process of doing so.[footnote]See https:\/\/dataprotection.africa\/ for more information.[\/footnote] In addition to giving effect to the right to privacy, data protection legislation also facilitates trade among states, as many data protection laws restrict cross-border data transfers in circumstances where the state receiving the information does not provide an adequate level of data protection. Framed more positively, data protection laws enable the regulated transfer of personal information across borders where both jurisdictions have put in place adequate data protection laws and procedures to protect data subjects\u2019 rights.<\/p>\n\n\n\n
Data protection laws are aimed at protecting and safeguarding the processing of personal information (also sometimes called personal data). Personal information is typically defined as any information relating to an identified or identifiable natural person \u2014 i.e. the data subject \u2014 by which the data subject can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural, or social identity. A data controller, also sometimes called the responsible party, can typically be either a public or private body and is the person or entity responsible for processing personal information about the data subject.<\/p>\n\n\n\n
Most comprehensive data protection laws in Africa make provision for a core set of principles which can be summarised as follows:[footnote]Information Commissioner\u2019s Office, \u2018A guide to the data protection principles\u2019 (accessible at https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/data-protection-principles\/).[\/footnote]<\/p>\n\n\n\n
In addition, most data protection laws establish a regulatory body to monitor and enforce the provisions of the law: this type of regulatory body is often referred to as a data protection authority (DPA).<\/p>\n\n\n\n
The United Nations Special Rapporteur (UNSR) on the Right to Privacy released a report in 2022 providing an in-depth analysis of the principles of legality, lawfulness and legitimacy, consent, transparency, purpose, fairness, proportionality, minimisation, quality, responsibility, and security in the context of data protection legislation, which serves as a seminal guide for the development and harmonisation of data protection regulations around the world.[footnote]UNSR on Privacy, \u2018Promotion and protection of human rights: human rights questions, including alternative approaches for improving the effective enjoyment of human rights and fundamental freedoms\u2019 (2022) (accessible at https:\/\/documents.un.org\/doc\/undoc\/gen\/n22\/594\/48\/pdf\/n2259448.pdf?token=u1h0GXrW9xSVX7VFHW&fe=true).[\/footnote]<\/p>\n\n\n\n
In relation to the protection of personal information, General Comment No. 16 on Article 17 of the ICCPR (General Comment No. 16) provides as follows:[footnote]UNHCHR, \u2018CCPR General Comment No. 16: Article 17 (Right to Privacy)\u2019 (1988) (accessible at https:\/\/www.refworld.org\/legal\/general\/hrc\/1988\/en\/27539) at para 10.[\/footnote]<\/p>\n\n\n\n
\n\u201cThe gathering and holding of personal information on computers, data banks and other devices, whether by public authorities or private individuals or bodies, must be regulated by law. Effective measures have to be taken by States to ensure that information concerning a person\u2019s private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant. In order to have the most effective protection of his private life, every individual should have the right to ascertain in an intelligible form, whether, and if so, what personal data is stored in automatic data files, and for what purposes. Every individual should also be able to ascertain which public authorities or private individuals or bodies control or may control their files. If such files contain incorrect personal data or have been collected or processed contrary to the provisions of the law, every individual should have the right to request rectification or elimination.\u201d<\/p>\n<\/blockquote>\n\n\n\n
In 2023, in response to the rapid and widespread collection of personal information ostensibly to combat the COVID-19 pandemic from 2020-2022, the UNSR on Privacy released a report elaborating on the implementation of the principles of purpose limitation, deletion of data and demonstrated or proactive accountability in the processing of personal data collected by public entities in the context of the pandemic.[footnote]UNSR on Privacy, \u2018A\/HRC\/52\/37: Implementation of the principles of purpose limitation, deletion of data and demonstrated or proactive accountability in the processing of personal data collected by public entities in the context of the COVID-19 pandemic – Report of the Special Rapporteur on the right to privacy\u2019 (2023) (accessible at https:\/\/www.ohchr.org\/en\/documents\/thematic-reports\/ahrc5237-implementation-principles-purpose-limitation-deletion-data-and).[\/footnote]<\/p>\n\n\n\n
Regional law standards<\/h2>\n\n\n\n
There are several African regional instruments that deal with data protection:<\/p>\n\n\n\n
\n
- The African Union (AU) Convention on Cyber Security and Personal Data Protection 2014<\/strong>[footnote]AU, \u2018African Union Convention on Cyber Security and Personal Data Protection\u2019 (2014 ) (accessible at https:\/\/au.int\/sites\/default\/files\/treaties\/29560-treaty-0048_-_african_union_convention_on_cyber_security_and_personal_data_protection_e.pdf).[\/footnote] (the Malabo Convention<\/a>): This instrument, aimed at a continental level, includes provisions relating to data protection, e-transactions, cybercrimes and cybersecurity. The provisions relating to data protection are contained in Chapter II and contain the conditions for the lawful processing of personal information, as well as the rights afforded to data subjects. After finally receiving ratification from the required 15th state, the Malabo Convention came into force in 2023.[footnote]ALT Advisory, \u2018Africa: AU\u2019s Malabo Convention set to enter force after nine years\u2019 (2023) (accessible at https:\/\/altadvisory.africa\/2023\/05\/19\/malabo-convention-set-to-enter-force\/).[\/footnote]<\/li>\n\n\n\n
- EAC Legal Framework for Cyberlaws 2008<\/strong>[footnote]EAC, \u2018EAC Legal Framework for Cyberlaws\u2019 (20228) (accessible at http:\/\/repository.eac.int:8080\/bitstream\/handle\/11671\/1815\/EAC Framework for Cyberlaws.pdf?sequence=1&isAllowed=y).[\/footnote] (EAC Legal Framework<\/a>): This instrument covers topics relating to data protection, electronic commerce, data security and consumer protection. It is not intended to be a model law but instead provides guidance and recommendations to states to inform the development of their laws. Data protection is dealt with briefly in paragraph 2.5 of the EAC Legal Framework, as part of Phase I which was adopted by the EAC Council of Ministers in 2010.[footnote]UNCTAD, \u2018Harmonizing Cyberlaws and Regulations: The experience of the East African Community\u2019 (2012) (accessible at https:\/\/au.int\/sites\/default\/files\/newsevents\/workingdocuments\/27223-wd-harmonizing_cyberlaws_regulations_the_experience_of_eac1.pdf).[\/footnote]<\/li>\n<\/ul>\n\n\n\n
\n
- Supplementary Act on Personal Data Protection within ECOWAS 2010<\/strong>[footnote]ECOWAS, \u2018Supplementary Act A\/SA.1\/01\/10 on Personal Data Protection within ECOWS\u2019 (2010) (accessible at http:\/\/www.statewatch.org\/news\/2013\/mar\/ecowas-dp-act.pdf).[\/footnote] (ECOWAS\u00a0Supplementary Act<\/a>): This instrument is designed to be directly transposed into a domestic context among West African states and provides in detail the conditions for the lawful processing of personal information and the rights of data subjects. Importantly, it is also legally binding on ECOWAS States. ECOWAS also adopted the Directive on Fighting Cyber Crime<\/a> in 2011 in an effort to harmonise member states\u2019 cybercrime legislation.<\/li>\n<\/ul>\n\n\n\n
\n
- SADC Data Protection Model Law 2013<\/strong>[footnote]HIPSSA, \u2018Data Protection: SADC Model Law\u2019 (2013) (accessible at https:\/\/www.itu.int\/en\/ITU-D\/Projects\/ITU-EC-ACP\/HIPSSA\/Documents\/FINAL DOCUMENTS\/FINAL DOCS ENGLISH\/sadc_model_law_data_protection.pdf).[\/footnote] (SADC Model Law<\/a>): This is a model law that can be adapted into domestic contexts among southern African states. It seeks to ensure the harmonisation of information and communications technologies (ICT) policies and recognises that ICT developments impact the protection of personal data, including in government and commercial activities. It also deals with whistle-blowing, by providing that the data protection authority must establish rules to govern the whistleblowing system that preserve data protection principles, including the principles of fairness, lawfulness, purpose specification, proportionality, and openness.<\/li>\n<\/ul>\n\n\n\n
In addition to giving effect to the right to privacy, data protection laws also often further facilitate a right of access to information, by providing for data subjects to request, and be given access to, the information being held about them by a controller. This mechanism can enable data subjects to determine whether their personal information is being processed in line with applicable data protection laws and whether their rights are being upheld.<\/p>\n\n\n\n