The past two months have witnessed notable milestones in data protection and AI governance at regional and national levels. There has been progress with the development of data protection laws, the creation of new authorities, the publication of regulations, and enforcement actions. On the AI governance front, more countries have initiated processes to develop AI strategies and specific laws.
Here are some notable developments across the region:
- There is a new law on the block. On October 29, 2024, Botswana’s National Assembly enacted
a new Data Protection Act, which repeals and amends the 2018 Act.??The Act aims to regulate the processing of personal data and provides for the continuation of the Information and Data Protection Commission (ICDC) as the data protection authority. The Act will come into effect on the date specified by the Minister by an order published in the Government Gazette.
- In Namibia, the Minister of Information, Communication, and Technology announced that the country is finalising
its data protection and cybercrime bills. Both bills aim to protect citizens' personal information amid rapid technological advancement. It is anticipated that this move will conclude the draft of the data protection bill.
- Efforts to harmonise data protection frameworks have intensified. On a regional level, the Economic Community of West African States (ECOWAS) published
the first draft of its revised Supplementary Data Protection Act for stakeholder input. The draft Act aims to protect the rights and freedoms of individuals regarding the processing of their personal data and establish rules for maintaining a secure and free flow of data within the region. Stakeholder consultations have been held to refine the draft. Similarly, stakeholders from the East African Community (EAC) deliberated
on the East Africa Data Governance Policy Framework at the East African Data Protection Exchange, held from October 16–18, 2024. The Framework aims to harmonise data governance practices and support digital integration in the region.
- The number of data protection authorities (DPAs) increased this period. The Democratic Republic of Congo (DRC) designated
the Regulatory Authority for Posts, Telecommunications, and Information and Communication Technologies (ARPTIC) as the data protection authority. Similarly,??on October 21, 2024, Togo appointed
the President of the Personal Data Protection Authority (IPDCP), marking the commencement of the IPDCP's activities.??Likewise, the Republic of Congo’s Council of Ministers approved
the legislation establishing the National Commission for the Protection of Personal Data as the data protection authority.??
- There have been more international commitments to data protection and cybersecurity at global and regional levels. On a global level, Mauritius joined
the Global Cross-Border Privacy Rules (CBPR) Forum?
as an associate. Seychelles' Cabinet of Ministers approved
the necessary steps for the country’s accession to the Budapest Convention on Cybercrime. On a regional level, Sao Tome and Principe ratified
the African Union Convention on Cybersecurity and Personal Data Protection (Malabo Convention), while Gabon's Council of Ministers approved
the draft law to ratify the Malabo Convention to address digital security challenges within the country.
- On proposed amendments, the Chairperson of??South Africa's Information Regulator (IR) disclosed
the IR's intention to propose an amendment to the Protection of Personal Information Act (POPIA) to allow for imposing immediate sanctions on entities and to align the POPIA more closely with the General Data Protection Regulation (GDPR). Similarly, Morocco's data protection authority disclosed
ongoing stakeholder engagements to review the data protection law, which will be presented to parliament by 2025. Also, Senegal has commenced
the review of its 2008 data protection law to strengthen digital regulation and align
the provisions with the GDPR.
- On September 13, 2024, Zimbabwe's Regulations
on the Licensing of Data Controllers and Appointment of Data Protection Officers came
into force. The regulation establishes the framework for appointing Data Protection Officers (DPOs) and licensing entities that process personal data. To comply, entities are required to register with the authority, appoint DPOs that possess relevant skills, develop data protection policies, conduct regular audits, and ensure the security of their systems. There have been several discussions about the adverse implications of the regulations on entities within its scope.
Enforcement and Sanctions?
- The Nigeria Data Protection Commission (NDPC) has?announced
the commencement of an investigation into the processing activities of a digital finance platform. The investigation was triggered by the company's non-compliance with the Data Protection Act through the deployment of "privacy-invading" technologies to facilitate marketing, credit scoring, and other financial solutions.
- Kenya's Office of the Data Protection Commissioner (ODPC) continued its enforcement of the Data Protection Act. Notably, an insurance company was fined
for the unauthorised disclosure of a party’s data; a commercial bank was fined
for not ensuring the accuracy of its customers' details; a digital lending platform faced
a fine for violating a data subject's rights to be informed and to object to unlawful data processing; the ODPC also fined
a company for processing a complainant’s data for commercial purposes without obtaining consent; an enforcement notice was issued
against the National Health Insurance Fund (NHIF) for failing to rectify inaccurate user information; and a hospital was fined
for using an individual’s image without obtaining their consent.
- In Ghana, a Circuit Court issued
a fine of 1,900,000 GHC against a ride-hailing company for failing to prevent identity theft. The court ruled that the company’s failure to conduct a thorough identification verification was negligent and violated the Ghana Data Protection Act. The ODPC also fined
the same company in June 2024 for violating the access and rectification rights of the complainant and failing to fulfil its obligations under the law.
- The Constitutional Court of South Africa ruled
that an individual's right to privacy can outweigh another’s right to freedom of expression, particularly when privacy expectations are reasonable. The court emphasised that assessing privacy rights involves evaluating both the individual's subjective expectation of privacy and whether this expectation is objectively reasonable. Here, despite the claimant initially sharing his information on a social platform, the court found that he maintained a reasonable expectation of privacy. Further dissemination of this information was deemed a privacy violation, as it could lead to potential harassment, underscoring the court's protection of privacy even in cases involving prior public disclosure.
- On September 5, 2024, Mali's Personal Data Protection Authority (APDP) warned
against the sharing of personal data, including sensitive personal data, on digital platforms except for journalistic purposes or based on prior authorisation of the APDP. Violations could result in fines of up to $33,300 or criminal prosecution.
Partnerships and Collaboration?
- On October 3, 2024, the National Commissioner of the NDPC and the Privacy Commissioner of Canada (OPCC) signed
a memorandum of understanding (MoU) to further strengthen their collaboration. A task team was also set up to discuss other areas of collaboration, including training for the High Commission's staff in Canada.
- On September 30, 2024, the Ministry of Digital Transition and Digitalisation officially launched
the process to develop Cote d’Ivoire’s National AI Strategy and National Data Management Strategy.??According to the Minister, the strategies aim to promote the responsible and ethical use of AI and data to drive innovation, research, and economic competitiveness and improve quality of life. The strategies will also address key concerns, including protecting citizens' rights and addressing biases.
- As part of the effort to develop its National AI Policy, the Mauritius Emerging Technology Council called
for stakeholders to contribute to the policy. All contributions can be made through a document that will be uploaded on the council's website
. Similarly, from September 24-26, 2024, Kenya hosted
the National AI Strategy Proceedings to gather stakeholder input on the development of its AI Strategy.
- In Nigeria, the National Artificial Intelligence Regulatory Authority Bill 2024 was presented
before the House of Representatives for its first reading. This is the third AI-specific legislation to be presented to the National Assembly in the past two years.
- In the coming months, we anticipate considerable progress with the ECOWAS Supplementary??Data Protection Act, the conclusion of Namibia’s data protection bill, and the progress with the amendment of Senegal’s law and decree on data protection. We also anticipate progress with the ongoing AI governance initiatives in Cote d’Ivoire, Mauritius, Kenya, Nigeria, and South Africa.
