• The right to privacy and data protection is a growing concern due to increasing data flows and the resulting need for the protection of personal information.

• In the African context, there are multiple instruments which govern data protection, notably the AU Convention on Cyber Security and Personal Data Protection (Malabo Convention).

• Importantly, states should ensure that their domestic legislation provides for the lawful processing of personal information and that they keep step with data protection developments.

• Allied with data protection are the concepts of the ‘right to be forgotten,’ encryption, and government-led surveillance.

• Communications surveillance has special risks for freedom of expression in journalistic contexts due to the potential disclosure of confidential sources and the risk of a chilling effect on media freedom.

Introduction

The right to privacy and the concomitant requirement to protect personal information has become increasingly relevant in the information age. As access to the internet has expanded and many parts of public and private life have become increasingly digitised, there has been a sharp increase in online information-sharing and data collection, with the associated risk that this information can be accessed and abused by hostile actors. At the same time, legislative developments have failed to keep pace and adequately protect personal information. However, in recent years, the passing of data protection legislation by many African states, as well as the development of guidelines and instruments by regional and continental bodies, have provided some protections to remedy and vindicate the privacy rights of African peoples.

This module focuses on the right to privacy in the digital age in Africa by evaluating the state of data protection, the related concepts of the ‘right to be forgotten’ and encryption assesses the growing risks of government and commercial surveillance as well as the emerging challenges of the use of artificial intelligence (AI) to perpetrate privacy violations, and sets out emerging principles and safeguards in this rapidly advancing digital environment.

The Right to Privacy

Around the world, there is an increasing recognition that the right to privacy is vital both in itself and due to its role in facilitating the right to freedom of expression. For instance, the right to privacy allows individuals to share views anonymously in circumstances where they may face repression or discrimination for those views; it also allows whistle-blowers to make protected disclosures and enables journalists and activists to communicate securely beyond the reach of unlawful government interception. It is also an inherent part of the right to dignity.

The right to privacy is contained in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), which provides:

¹ No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.

² Everyone has the right to the protection of the law against such interference or attacks.

Although the right to privacy is not explicitly contained in the African Charter on Human and Peoples’ Rights (African Charter), article 9 of the Charter does encode protections for the right to receive information and express opinions:

¹ Every individual shall have the right to receive information. Every individual shall have the right to express and disseminate his opinions within the law.

These, in addition to the African Charter’s protections for freedom against discrimination, liberty and security, freedom of assembly, health, and others, have prompted the argument that the implicit right to privacy should be ‘read into’ the African Charter as an inalienable component of those other rights.¹

The right to privacy of children is, however, explicitly contained in other regional and continental instruments. For example, article 10 of the African Charter on the Rights and Welfare of the Child (ACRWC) provides that:

No child shall be subject to arbitrary or unlawful interference with his privacy, family home or correspondence, or to the attacks upon his honour or reputation, provided that parents or legal guardians shall have the right to exercise reasonable supervision over the conduct of their children. The child has the right to the protection of the law against such interference or attacks.

The revised 2019 Declaration of Principles on Freedom of Expression and Access to Information in Africa, adopted by the African Commission on Human and Peoples’ Rights (ACHPR), also explicitly acknowledges the right to privacy and calls on states to provide extensive protections for privacy and personal information.³ Moreover, all but one African state guarantees this right under their domestic constitutions.⁴

As with the right to freedom of expression, a limitation of the right to privacy must comply with the three-part test for a justifiable limitation. According to the South African Constitutional Court:⁵

A very high level of protection is given to the individual’s intimate personal sphere of life and the maintenance of its basic preconditions and there is a final untouchable sphere of human freedom that is beyond interference from any public authority. So much so that, in regard to this most intimate core of privacy, no justifiable limitation thereof can take place. But this most intimate core is narrowly construed. This inviolable core is left behind once an individual enters into relationships with persons outside this closest intimate sphere; the individual’s activities then acquire a social dimension and the right of privacy in this context becomes subject to limitation.

Set out in the following pages, we consider specific aspects of the right to privacy and the impact of the internet on the enjoyment of this right.

Data Protection

Data protection is one of the primary ways through which the right to privacy is given effect. At least 36 African states have so far enacted data protection laws, and more are in the process of doing so.⁶ In addition to giving effect to the right to privacy, data protection legislation also facilitates trade among states, as many data protection laws restrict cross-border data transfers in circumstances where the state receiving the information does not provide an adequate level of data protection. Framed more positively, data protection laws enable the regulated transfer of personal information across borders where both jurisdictions have put in place adequate data protection laws and procedures to protect data subjects’ rights.

Key data protection principles

Data protection laws are aimed at protecting and safeguarding the processing of personal information (also sometimes called personal data). Personal information is typically defined as any information relating to an identified or identifiable natural person — i.e. the data subject — by which the data subject can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural, or social identity. A data controller, also sometimes called the responsible party, can typically be either a public or private body and is the person or entity responsible for processing personal information about the data subject.

In addition, most data protection laws establish a regulatory body to monitor and enforce the provisions of the law: this type of regulatory body is often referred to as a data protection authority (DPA).

International law standards

The United Nations Special Rapporteur (UNSR) on the Right to Privacy released a report in 2022 providing an in-depth analysis of the principles of legality, lawfulness and legitimacy, consent, transparency, purpose, fairness, proportionality, minimisation, quality, responsibility, and security in the context of data protection legislation, which serves as a seminal guide for the development and harmonisation of data protection regulations around the world.⁸

In relation to the protection of personal information, General Comment No. 16 on Article 17 of the ICCPR (General Comment No. 16) provides as follows:⁹

The gathering and holding of personal information on computers, data banks and other devices, whether by public authorities or private individuals or bodies, must be regulated by law. Effective measures have to be taken by States to ensure that information concerning a person’s private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant. In order to have the most effective protection of his private life, every individual should have the right to ascertain in an intelligible form, whether, and if so, what personal data is stored in automatic data files, and for what purposes. Every individual should also be able to ascertain which public authorities or private individuals or bodies control or may control their files. If such files contain incorrect personal data or have been collected or processed contrary to the provisions of the law, every individual should have the right to request rectification or elimination.

In 2023, in response to the rapid and widespread collection of personal information ostensibly to combat the COVID-19 pandemic from 2020-2022, the UNSR on Privacy released a report elaborating on the implementation of the principles of purpose limitation, deletion of data and demonstrated or proactive accountability in the processing of personal data collected by public entities in the context of the pandemic.¹⁰

Regional law standards

There are several African regional instruments that deal with data protection:

• The African Union (AU) Convention on Cyber Security and Personal Data Protection 2014¹¹ (the Malabo Convention): This instrument, aimed at a continental level, includes provisions relating to data protection, e-transactions, cybercrimes and cybersecurity. The provisions relating to data protection are contained in Chapter II and contain the conditions for the lawful processing of personal information, as well as the rights afforded to data subjects. After finally receiving ratification from the required 15th state, the Malabo Convention came into force in 2023.¹²

• EAC Legal Framework for Cyberlaws 2008¹³ (EAC Legal Framework): This instrument covers topics relating to data protection, electronic commerce, data security and consumer protection. It is not intended to be a model law but instead provides guidance and recommendations to states to inform the development of their laws. Data protection is dealt with briefly in paragraph 2.5 of the EAC Legal Framework, as part of Phase I which was adopted by the EAC Council of Ministers in 2010.¹⁴

• Supplementary Act on Personal Data Protection within ECOWAS 2010¹⁵ (ECOWAS Supplementary Act): This instrument is designed to be directly transposed into a domestic context among West African states and provides in detail the conditions for the lawful processing of personal information and the rights of data subjects. Importantly, it is also legally binding on ECOWAS States. ECOWAS also adopted the Directive on Fighting Cyber Crime in 2011 in an effort to harmonise member states’ cybercrime legislation.

• SADC Data Protection Model Law 2013¹⁶ (SADC Model Law): This is a model law that can be adapted into domestic contexts among southern African states. It seeks to ensure the harmonisation of information and communications technologies (ICT) policies and recognises that ICT developments impact the protection of personal data, including in government and commercial activities. It also deals with whistle-blowing, by providing that the data protection authority must establish rules to govern the whistleblowing system that preserve data protection principles, including the principles of fairness, lawfulness, purpose specification, proportionality, and openness.

In addition to giving effect to the right to privacy, data protection laws also often further facilitate a right of access to information, by providing for data subjects to request, and be given access to, the information being held about them by a controller. This mechanism can enable data subjects to determine whether their personal information is being processed in line with applicable data protection laws and whether their rights are being upheld.

Emerging challenges to data protection

As more states across the continent have passed data protection legislation, so too have the risks and challenges of regulating and protecting privacy in the digital age become more complex. Many states, particularly those in West Africa, passed their laws some time ago,¹⁷ raising concerns that they may no longer be suited to the challenges of the modern age. In South Africa, for example, the Protection of Personal Information Act was passed in 2013 but only came into effect in July 2020 with a further grace period given for full compliance. This has raised concerns among critics that the Act already requires amendments to stay up to date with new issues such as AI.¹⁸

In addition, the enforcement challenges of these many new data protection laws have become increasingly apparent. For example, research has found that 14 countries’ laws provide for the data protection authority to be established within or to receive instructions from another public body, such as a government ministry, raising questions about regulatory independence.¹⁹ 11 countries were found not to have adequate protections in place to prevent the undue removal of members of the Authority for political or other reasons.²⁰

Another barrier to the advancement of data protection on the continent is the limited scope of data protection laws, with many containing extensive national security or private sector exemptions that undermine their efficacy. In this regard, it is also important to note the track record on the continent of national security justifications being abused.

The Right to be Forgotten

The ‘right to be forgotten’²⁵ — which can also be described as ‘the right to erasure’ or ‘the right to be de-listed’ — entails the right of a data subject to request that commercial search engines or other websites that gather or publish personal information remove links to the personal information relating to the subject on request. The issue is highly contextual and often fraught because it usually involves a complicated balancing of public and individual interests. The right to be forgotten progresses from the right of data subjects contained in many data protection laws that personal information held about a person should be erased in circumstances in which it is inadequate, irrelevant, no longer relevant, or excessive in relation to purposes for which it was collected. However, in some cases, there may be a valid justification for keeping the information in the public domain because it is in the public interest.

A growing body of jurisprudence

The right to be forgotten has also been recognised in domestic contexts, although not as yet in sub-Saharan Africa. However, it has been recognised in South America in, for example, the State Court of Appeals of São Paulo, Brazil.³⁵

Of relevance to the media, the Supreme Court of Chile, in 2019, made an order requiring several digital media outlets to update the information they had published about a person involved in a criminal case in order to achieve a balance between the right to information that was in the public interest and the right to honour.³⁶

Non-consensual dissemination of intimate images (NCII)

A growing body of case law is also beginning to recognise the right to be forgotten in cases of the non-consensual sharing of intimate images (NCII), such as X v. Union of India and X v. YouTube, both in the High Court of Delhi in India.

Limits on the right to be forgotten

As jurisprudence around the world has developed, lines have begun to be drawn identifying the limits of the right to be forgotten. In 2017, the CJEU declined to uphold a request to erase, anonymise, or block any data linking the plaintiff to the liquidation of his company contained in the companies register in the case of Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni.(39) The CJEU held that in light of the range of possible legitimate uses for data in company registers and the different limitation periods applicable to such records, it was impossible to identify a suitable maximum retention period. Accordingly, the CJEU declined to find that there is a general right to be forgotten from public company registers.

Furthermore, other jurisdictions have refused to uphold a right to be forgotten against search engines:

• In Brazil, for example, it was held that search engines cannot be compelled to remove search results relating to a specific term or expression.⁴⁰

• Similarly, the Supreme Court of Japan declined to enforce the right to be forgotten against Google, finding that deletion “can be allowed only when the value of privacy protection significantly outweighs that of information disclosure”.⁴¹

According to the Global Principles of Freedom of Expression and Privacy (Global Principles),⁴² the right — to the extent that it is recognised in a particular jurisdiction — should be limited to the right of individuals under data protection law to request search engines to delist inaccurate or out-of-date search results produced on the basis of a search for their name⁴³ and should be limited in scope to the domain name corresponding to the country where the right is recognised and the individual has established substantial damage.⁴⁴

It states further that de-listing requests should be subject to ultimate adjudication by a court or independent adjudicatory body with relevant expertise in freedom of expression and data protection law.⁴⁵

Encryption and Anonymity on the Internet

Encryption refers to a mathematical process of converting messages, information or data into a form unreadable by anyone except the intended recipient, and in doing so protecting the confidentiality and integrity of content against third-party access or manipulation.⁴⁶ With “public key encryption” — the dominant form of end-to-end security for data in transit — the sender uses the recipient’s public key to encrypt the message and its attachments, and the recipient uses her or his own private key to decrypt them.⁴⁷ It is also possible to encrypt data at rest that is stored on one’s device, such as a laptop or hard drive.⁴⁸

Anonymity can be defined either as acting or communicating without using or presenting one’s name or identity, as acting or communicating in a way that protects the determination of one’s name or identity or as using an invented or assumed name that may not necessarily be associated with one’s legal or customary identity.⁴⁹ Anonymity may be distinguished from pseudo‑anonymity: the former refers to taking no name at all, while the latter refers to taking an assumed name.⁵⁰

Importance of freedom of expression

Encryption and anonymity are necessary tools for the full enjoyment of digital rights and deserve protection by virtue of the critical role that they play in securing the rights to freedom of expression and privacy. As described by the UNSR on FreeEX:⁵¹

Encryption and anonymity, separately or together, create a zone of privacy to protect opinion and belief. For instance, they enable private communications and can shield an opinion from outside scrutiny, particularly important in hostile political, social, religious and legal environments. Where States impose unlawful censorship through filtering and other technologies, the use of encryption and anonymity may empower individuals to circumvent barriers and access information and ideas without the intrusion of authorities. Journalists, researchers, lawyers and civil society rely on encryption and anonymity to shield themselves (and their sources, clients and partners) from surveillance and harassment. The ability to search the web, develop ideas and communicate securely may be the only way in which many can explore basic aspects of identity, such as one’s gender, religion, ethnicity, national origin or sexuality. Artists rely on encryption and anonymity to safeguard and protect their right to expression, especially in situations where it is not only the State creating limitations but also a society that does not tolerate unconventional opinions or expression.

Encryption and anonymity are especially useful for the development and sharing of opinions online, particularly in circumstances where a person fears that their communications may be subject to interference or attack by state or non-state actors. These are therefore specific technologies through which individuals may exercise their rights, and are particularly important for journalists communicating online to be protected from surveillance and to maintain the confidentiality of journalistic sources. Accordingly, under international human rights law, restrictions on encryption and anonymity must meet the three-part test to justify the restriction.

Balancing security with freedom of expression

According to the UNSR on FreeEX, while encryption and anonymity may have the potential to frustrate law enforcement and counter-terrorism officials and complicate surveillance, state authorities have generally failed to provide appropriate public safety justifications to support any restrictions or to identify situations where the restriction has been necessary to achieve a legitimate goal.⁵² Outright prohibitions on the individual use of encryption technology disproportionately restrict the right to freedom of expression as they deprive all online users in a particular jurisdiction of the right to carve out a space for opinion and expression, without any particular claim of the use of encryption being for unlawful ends.⁵³

Likewise, state regulation of encryption may be tantamount to a ban, for example, through requiring licences for encryption use, setting weak technical standards for encryption, or controlling the import and export of encryption tools.⁵⁴

The UNSR on FreeEX has, therefore, called on states to promote strong encryption and anonymity, and noted that decryption orders should only be permissible when they result from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals (not to a mass of people), and subject to a judicial warrant and the protection of due process rights.⁵⁷

The 2019 ACHPR Declaration of Principles on Freedom of Expression and Access to Information likewise provides that states should not adopt laws or other measures prohibiting or weakening encryption, including backdoors or key escrows unless such measures are justifiable and compatible with international human rights law and standards.⁵⁸

Despite this clear mandate, many countries in sub-Saharan Africa continue to regulate or limit the use of encryption. For example, some require the registration and licensing of encryption service providers or have laws that compel service providers to hand over secret codes to state authorities.⁵⁹ According to the Global Partners Digital World Map of Encryption, at least 27 countries in Africa have laws and policies enabling widespread restrictions on the use of encryption tools.⁶⁰

Government & Corporate Surveillance

Communications surveillance encompasses the monitoring, intercepting, collecting, analysing, retention, or similar actions, of a person’s communications in the past, present, or future.⁶² This relates to both the content of communications and communication metadata – which is information about a communication, such as the identities of the parties, the time or duration or location of the communication, and technical services used. It has been noted that even communication metadata can give detailed insights into an individual’s behaviour, social relationships, private preferences and identity. Taken as a whole, it may allow very precise conclusions to be drawn concerning the private life of the person.⁶³

In recent years, the use of sophisticated surveillance technology on mobile phones has gained increasing prominence amidst concerns about its extensive abuse to monitor political opponents and activists.

International law position

General Comment No. 16 provides that “[s]urveillance, whether electronic or otherwise, interceptions of telephonic, telegraphic and other forms of communication, wire-tapping and recording of conversations should be prohibited.”⁷⁰ Surveillance — both bulk (or mass) collection of data⁷¹ or targeted collection of data — interferes directly with the privacy and security necessary for freedom of opinion and expression, and must be considered against the three-part test to assess the permissibility of the restriction.

In the digital age, ICTs have enhanced the capacity of governments, corporations, and individuals to conduct surveillance, interception and data collection, and have meant that the effectiveness of conducting such surveillance is no longer limited by scale or duration.

In Africa, some countries have even passed legislation enabling digital surveillance of targeted groups; for example, the United Nations Special Rapporteur on Privacy has noted with concern the Anti-Cybercrime Law enacted in Egypt in 2018 which reportedly enables surveillance of the LGBTQI community.⁷²

In a resolution adopted by the UN General Assembly (UNGA) on the right to privacy in the digital age, the UNGA emphasised that unlawful or arbitrary surveillance and/or interception of communications, as well as the unlawful or arbitrary collection of personal data, are highly intrusive acts, violate the right to privacy, can interfere with the right to freedom of expression, and may contradict the tenets of a democratic society, including when undertaken on a mass scale.⁷³ It noted further that surveillance of digital communications must be consistent with international human rights obligations and must be conducted on the basis of a legal framework, which must be publicly accessible, clear, precise, comprehensive and non-discriminatory.

In order to meet the condition of legality, many states have taken steps to reform their surveillance laws to allow for the powers required to conduct surveillance activities. According to the Necessary and Proportionate Principles, a civil society initiative to document the principles that apply to any limitation on freedom of expression, communications surveillance should be regarded as a highly intrusive act, and in order to meet the threshold of proportionality, the state should be required at a minimum to establish the following information to a competent judicial authority prior to conducting any communications surveillance:⁷⁴

• There is a high degree of probability that a serious crime or specific threat to a legitimate aim has been or will be carried out.

• There is a high degree of probability that evidence relevant and material to such a serious crime or specific threat to a legitimate aim would be obtained by accessing the protected information sought.

• Other less invasive techniques have been exhausted or would be futile, such that the technique used is the least invasive option.

• Information accessed will be confined to that which is relevant and material to the serious crime or specific threat to a legitimate aim alleged.

• Any excess information collected will not be retained but instead will be promptly destroyed or returned.

• Information will be accessed only by the specified authority and used only for the purpose and duration for which authorisation was given.

• The surveillance activities requested, and techniques proposed do not undermine the essence of the right to privacy or of fundamental freedoms.

Surveillance constitutes an obvious interference with the right to privacy. Further, it also constitutes an interference with the right to hold opinions without interference and the right to freedom of expression. With particular reference to the right to hold opinions without interference, surveillance systems, both targeted and mass, may undermine the right to form an opinion, as the fear of unwilling disclosure of online activity, such as search and browsing, likely deters individuals from accessing information, particularly where such surveillance leads to repressive outcomes.⁷⁵

As emphasised in the amaBhungane case, the interference with the right to freedom of expression is particularly apparent in the context of journalists who may be placed under surveillance as a result of their journalistic activities. The disclosure or surveillance of journalistic sources can have negative consequences for the right to freedom of expression due to a breach of an individual’s confidentiality in their communications.⁷⁶

This is the same for cases concerning the disclosure of anonymous user data. Once confidentiality is undermined, it cannot be restored. It is therefore of utmost importance that measures that undermine confidentiality are not taken arbitrarily.

The importance of source protection has been well-established. For example, in Bosasa Operation (Pty) Ltd v Basson and Another, the South Africa High Court held that journalists are not required to reveal their sources, subject to certain exceptions.⁷⁷ The court stated in this regard that:

If indeed freedom of the press is fundamental and sine qua non for democracy, it is essential that in carrying out this public duty for the public good, the identity of their sources should not be revealed, particularly, when the information so revealed, would not have been publicly known. This essential and critical role of the media, which is more pronounced in our nascent democracy, founded on openness, where corruption has become cancerous, needs to be fostered rather than denuded.

Surveillance activities carried out against journalists have the risk of fundamentally undermining the source protection to which journalists are otherwise entitled.

Jurisprudence on journalism and the right to privacy

The linkages between journalistic freedoms and the right to privacy are a common theme in emerging litigation and jurisprudence against unlawful or abusive surveillance. For example:

• In two cases both dealing with the planned roll-out by the Communications Authority of Kenya of a system to provide it with access to mobile service subscribers’ data, the High Court of Kenya held that the system was “a threat to subscribers’ privacy,” that there were fewer restriction measures to implement the Authority’s goals of identifying illicit devices, and that the system was unlawful, unreasonable, and disproportionate.⁷⁸

• In ordering the independent inquiry into allegations that the government deployed the Pegasus spyware against various journalists, politicians and dissidents, the Supreme Court of India found that the free press’s democratic function was at stake, and that “such chilling effect on the freedom of speech is an assault on the vital public watchdog role of the press, which may undermine the ability of the press to provide accurate and reliable information.”⁷⁹

• The European Court of Human Rights (ECtHR) found some aspects of the United Kingdom’s mass surveillance regime to be in violation of the right to privacy and the right to freedom of expression under the European Convention on Human Rights, holding that although bulk interception regimes are not in themselves incompatible with those rights, the lack of independent oversight and the fact that the regime’s use was not limited to combatting “serious crime” and did not sufficiently protect journalists’ confidential communication resulted in it constituting a violation.⁸⁰

Privacy & Artificial Intelligence

The privacy risks of AI

As the sophistication and usage of artificial intelligence (AI) has increased rapidly in recent years, concerns about both the use of personal information in the development of such tools as well as the ability of such tools to implement privacy violations have become more prominent. In particular, the launch of the public ChatGPT, alongside similar models, has raised alarm bells on several fronts.

• First, because such systems rely on vast quantities of information to train their algorithms and continuously improve performance, particularly information scraped from the internet, critics have highlighted that even publicly-available information, such as posts on social media, was never posted with the intent, and hence consent, of the data subjects for its usage by large-language models.

• Second, the collection and storage of such large quantities of information, including personal information, raise concerns about storage security and the implications if such data were to be accessed by unauthorised parties through hacking or other security breaches. Facial recognition technology, which also often relies on sophisticated algorithms to process large quantities of data, is increasingly in use across the continent by governments ostensibly for law enforcement and security purposes, but they also have the potential to be used for real-time, intrusive tracking and surveillance that risks several human rights including the rights to privacy, freedom of movement, and freedom of association.

• Third, AI tools such as these are able to rapidly generate images and content about a person based on its training data that may have little correlation to the truth, raising concerns about mis- and disinformation and the portrayal of personal information in the online ecosystem. AI’s ability to rapidly analyse and make sense of large quantities of data can lead to the ability to infer personal information about a person that they never provided themselves, beyond the scope of consent requirements set out in data protection laws.

Developing international standards

As a result of these risks, AI has recently garnered increased attention from international and regional human rights bodies seeking to provide guidance and standards to protect the affected rights and ensure the responsible development of these new technologies. For example:

• In 2021 the UN Special Rapporteur on the Right to Privacy published a report on AI and privacy and children’s privacy that provides guidance on data protection standards for AI at the domestic level as well as calls on states and companies to develop AI solutions ethically and responsibly within a human rights framework.⁸¹

• Also in 2021, the UN High Commissioner for Human Rights released a report on the right to privacy in the digital age that analysed how the widespread use of AI affects the right to privacy and other fundamental rights, noting that issued a set of recommendations for states and businesses to design and implement rights safeguards.⁸² The report notes that AI systems “[incentivise] widespread data collection, storage, and processing,” contrary to the principle of data minimisation, and highlights concerns in the sectors of law enforcement, public services, employment, and online information management systems.

• Building on this, in 2023 the new Special Rapporteur submitted her report to the United Nations General Assembly (UNGA) that highlighted the need for transparency and explainability in the use of AI in order for data subjects to be able to exercise their rights over the use of their personal information in such systems.⁸³

Notably, the African Union Commission on Human and Peoples’ Rights (ACHPR) has also taken steps to interrogate the risks of AI by passing Resolution ACHPR/Res. 473 (EXT.OS/ XXXI) 2021: on the need to undertake a Study on human and peoples’ rights and artificial intelligence (AI), robotics and other new and emerging technologies in Africa in 2021.⁸⁴ In it, the ACHPR—

• acknowledges the myriad risks for human rights not limited to privacy;

• calls on states to put in place mechanisms to ensure the rights-respecting development and use of such technologies in Africa, including by working towards a comprehensive legal and ethical governance framework for AI; and

• commits to undertake a study to develop guidelines on AI.

The study officially began in June 2023.⁸⁵

Conclusion

As more of the world moves online and increasingly sophisticated new tools for processing personal information become more widely available, data protection is becoming ever more necessary. In the African context, some headway has been made in the passing of 36 data protection laws as well as the coming into force of the Malabo Convention in 2023.⁸⁶ However, with the growth and increasing sophistication of technologies and practices related to data harvesting and profiling, legislators are some way behind in fully protecting and promoting data privacy and data protection. As we move forward, digital rights activists have a significant role to play in ensuring that states keep step with data protection developments and enact legislative frameworks that fully protect and promote people’s rights to privacy.