Data protection in Africa is a hot topic. Over the last 12 months there has been a wave of legislation implemented among a number of countries, with much more movement expected over the coming years – including greater harmonisation of data protection regulatory frameworks across countries.
And this movement is extremely important. For a long time, many Africans have had little or no recourse if a data breach occurs because often legal and regulatory safeguards have not existed. Yet the data of citizens across the continent has been big business and a valuable commodity in the global market. Without the protection of safeguards this can and has been abused – one of the most notable cases being the revelation that Cambridge Analytica had misappropriated 87-million Facebook profiles in 2016, including those of citizens in Nigeria and Kenya. Indeed, one of the reasons Cambridge Analytica had assembled such large databases of personal information was the lack of data protection legislation in the countries where they were operating. The scandal exposed the extent to which the African continent had become a testing ground for the worst practices by companies and governments.
The introduction of the General Data Protection Regulation (GDPR) 2016/679 in Europe set a global benchmark for data legislation best practice, whilst also impacting Africa. GDPR protects European Union (EU) residents wherever they reside. If companies are collecting data from European residents and/or citizens or are interacting with citizens in the EU they too will be impacted by said Regulation. For example, a South African web development company based in Johannesburg selling websites to mainly South African businesses will still be subject to GDPR provisions if it is tracking EU visitors on its websites.
Within this context of global shifts and an increasing realisation among consumers in Africa on the importance of protecting their own privacy and data – the recent and significant rise in the number of data protection laws across the continent has been widely welcomed. 26 African countries have recently passed specific data protection laws with at least 10 other countries soon enacting specific data protection legislation. Economic Community of West African States (ECOWAS) has taken the lead with two thirds of countries having passed data protection laws in the region. The regional bloc set a precedent in 2010 having passed the supplementary act on data protection and cyber-crime. And West African countries have marched ahead. Twelve years after being among the first African Countries to enact data protection legislation, Senegal published the Personal Data Protection Bill in 2019. Nigeria’s Data Protection Regulation, 2019 has introduced major compliance obligations on Nigerian companies. It includes provisions on the rules for processing, storing and transferring personal data with severe sanctions now in place. For data controllers dealing with more than 10,000 data subjects: payment of a fine of 2% of the annual gross revenue of the preceding year of up to NGN10 million applies for those who do not comply.
However, the Southern African Development Community (SADC) has been slower to move with only half the countries in these regions with specific laws and some key economies with none in place whatsoever – including Namibia, Zambia and Tanzania. Yet, even in the absence of specific country-level data protection legislation, personal data may enjoy constitutional protection in some African jurisdictions, making its collection without prior consent of data subjects – subject to fines and/or imprisonment.
Overall, countries are getting serious and moving quickly about it – with a plethora of local and regional legislation to navigate and punitive measures taken against companies who are not complying, organisations must keep on top of changes.
At Afriwise, we envisage data protection remaining a key legal topic over the next few years in Africa and the Afriwise Platform provides a perfect solution for organisations wishing to navigate new and changing laws.