A BRIEF OVERVIEW OF THE REGULATION OF DATA PROTECTION LAW IN AFRICA

Even though attempts at a continental harmonization of data protection law in Africa have been made, its regulation remains fragmented and falls under the national laws of respective AU member states. The African Union Convention on Cyber Security and Personal Data Protection (the Convention)Footnote ⁷ is the most tangible evidence of a continental attempt to harmonize data protection law across the continent; it acknowledges the necessity of creating uniform commitments for the protection of personal data across the continent.Footnote ⁸ However, the convention is yet to be ratified by a significant number of AU member states,Footnote ⁹ thereby making its coming into force a legal impossibility.Footnote ¹⁰ For the purpose of this article, the legal framework of African data protection can be categorized into the continental, regional and national approaches.

The continental approach manifests in the form of the Convention, yet to come into force. There are also some regional data protection instruments, including the Economic Community of West African States’ Supplementary Act on Personal Data Protection within ECOWAS (2010),Footnote ¹¹ and the Southern African Development Community's Model Act on Data Protection (2013),Footnote ¹² but their actual impact on members can at best be described as persuasive.Footnote ¹³ From the perspective of a national approach and at the time of writing, 32 African countries have enacted national data protection laws; five countries have pending bills before their respective legislative institutions, while 18 countries are yet to enact any data protection regulatory instruments.Footnote ¹⁴ Based on the above information, it would appear that a national approach to data protection regulation is currently favoured across the continent, which means that the requirements for data protection compliance varies across the African continent.

THE AEAFCFTA V (NATIONAL) DATA PROTECTION LAWS: IDENTIFYING POTENTIAL SINGLE MARKET BARRIERS

The AEAfCFTA creates frameworks for the harmonization of potential barriers to the realization of the single market among AU member states. This article argues that some provisions of the AEAfCFTA might suffer implementation setbacks as a result of the diverging approaches in national data protection law among individual AU member states. To consider some relevant examples: firstly, AEAfCFTA, part IV, art 15 provides that subject to non-arbitrariness or unjustified discrimination, states shall be authorized, inter alia, to adopt or enforce measures necessary for “the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts”, so long as such measures are not inconsistent with the AEAfCFTA provisions on the free movement of services.Footnote ¹⁵ This sole reference to privacy in the AEAfCFTA pertains only to trade in services and does not extend to the free movement of persons, capital and goods; it therefore appears that the AEAfCFTA considers only the former privacy considerations as necessary. Alternatively, this provision can be interpreted as reserving legislative sovereignty over the privacy of goods, persons and capital to state parties. This approach poses a potential hinderance to the free movement not only of services but also of persons, capital and goods, owing to state parties’ authorization to draft their own privacy and data protection laws. To take advantage of the single market and carry out services within it, businesses and other relevant stakeholders will necessarily have to process personal data across multiple member state jurisdictions within the AU. Since the AEAfCFTA allows AU member states to adopt their own measures for data protection when it involves the movement of services, service providers will be required to comply with the different data protection instruments in the various jurisdictions of the AU member states they operate in. However, national laws must not be inconsistent with the provisions of the AEAfCFTA – it is yet to be seen how this inconsistency will be avoided. While this provision against inconsistency is laudable, it could be better achieved through a harmonized continental data protection framework. Even though the provision of AEAfCFTA, part IV, art 15 applies expressly to trade in services, the scenario above is expected to apply to trade in persons, capital and goods in practice.

Secondly, AEAfCFTA, part V, art 18 mandates state parties to accord each other (and be able to negotiate) favourable preferences on a reciprocal basis. From a data protection perspective, this implies that state parties, subject to conditions which include reciprocity, can negotiate compliance on various points of divergence in their national data protection laws. This may result in the fragmentation of data protection law compliance across the continent, with different state parties negotiating “favorable preferences” among themselves,Footnote ¹⁶ which will potentially distort the single market and will also contradict the AfCFTA's objective to create a single market and deepen the economic integration of the continent, as stipulated in AEAfCFTA, part II, art 3. If the AfCFTA's aim of creating a single market is to be achieved, the market fragmentation that will arise from its approach to intra-African data protection compliance, as demonstrated by this provision, ought to be addressed.

Furthermore, art 16(4) of the Protocol on Rules and Procedures on the Settlement of Disputes in the AEAfCFTA provides, inter alia, that in the settlement of disputes, confidential information that is provided to the dispute settlement panelFootnote ¹⁷ shall not be disclosed without formal authorization from the source providing the information. This means that for state parties to formally authorize the disclosure of confidential information which might include personal data, they will have to comply with the applicable law (including data protection law) governing its disclosure. Since the governance of data protection law is different across the continent, the conditions that have to be met to authorize the disclosure of confidential information will also necessarily vary. It will be interesting to see how dispute resolution mechanisms which are inherent in national data protection legislation(s) will be balanced against the AEAfCFTA's dispute resolution framework.Footnote ¹⁸ This might extend the time frame for authorizing data disclosures across various member states, which might result in potential delays to the decision-making process of the panel. Furthermore, there is the possibility that parties might take advantage of divergences in the governance of data protection law across the continent to delay and frustrate the efforts of the panel to settle disputes.

Another potential single market barrier might be found in AEAfCFTA, part IV, art 8, which provides that each state party may introduce new regulations on services and service suppliers within its territory in order to meet national policy objectives insofar as such regulations do not impair any rights and obligations arising under the Protocol. This clause notwithstanding, state parties are empowered to adopt their own data protection instruments, which might affect the free movement of services anticipated under the AEAfCFTA. Beyond the provision of services, this clause might also be relevant for countries lacking laws which regulate the processing of the personal data of AU residents by businesses located outside the AU, and in such cases, countries can possibly rely on this provision to draft detailed data protection laws.Footnote ¹⁹ Interestingly, this provision also signals the intention of the AU to adopt a synchronization of African data protection laws, rather than their harmonization.Footnote ²⁰ In other words, it would appear that the AU chose to allow state parties to retain their legislative sovereignty to make data protection laws as they deem fit, insofar as such laws remain compliant with the objectives of the single market. This regulatory approach apparently places less burden on the legislative framework of the AU and may also have reduced the chance of debates and disagreements that may have stifled the initial adoption of the AEAfCFTA. However, the problem might only have been deferred, as state parties still have to meet and agree on the applicability of relevant data protection laws; this places the responsibility on state parties to agree on favourable clauses among themselves, which, I argue, will result in the fragmentation of the single market and the eventual contradiction of its objectives. The harmonization of the African single market through the adoption of a uniform African data protection law will therefore be more favourable to the establishment of a truly single market across the continent.

Divergence in national approaches to data protection governance might be seen, for instance, where the processing of personal data by entities located outside the AU is regulated in some countries and unregulated in others. Another instance includes where data localization requirements differ from one jurisdiction to another; for example, while the Nigerian Data Protection Regulation (NDPR) contains no data localization requirements,Footnote ²¹ the Data Protection Act of Kenya provides that “the Cabinet Secretary may prescribe … certain nature of processing that shall only be effected through a server or a data centre located in Kenya”.Footnote ²² This means that entities will have to adopt different approaches to data governance in Nigeria and Kenya. Within the context of the AEAfCFTA, this might potentially hinder the single market because, ordinarily, entities ought to have the freedom to store their data within the market subject to their business needs and convenience, and aimed towards the free movement of persons, capital, goods and services within the AU. Therefore, a divergence of this nature will only create restrictions which will be inimical to the single market objectives of the AfCFTA.

Since entry into the single market will not be limited only to entities domiciled in the AU, the divergence in data protection laws across the continent might particularly restrain free entry for such entities due to conflicting compliance requirements, and this will invariably fetter the freedom of trade which the AfCFTA seeks to establish. Another consequence of regulatory fragmentation is that business entities might find it difficult to pull (personal) data together for achieving a single purpose because each country has different compliance requirements. For instance, section 53 of the Data Protection Act of Kenya provides, inter alia, that further processing of personal data shall be compatible with the purpose of collection if the data is used solely for research purposes and is not published in an identifiable form. Section 39 of the same act also provides, inter alia, that personal data intended for research purposes may be retained even after the purpose for its collection has been satisfied. The data localization possibilities under the Data Protection Act of Kenya would also be a significant consideration for these processing activities. On the other hand, in South Africa the Protection of Personal Information Act (POPIA)Footnote ²³ provides a more detailed framework for the regulation of personal data for research purposes; section 14(2) provides that “personal information”Footnote ²⁴ may be retained for research purposes even after the initial purpose of its collection has been satisfied so long as appropriate safeguards have been taken against the records being used for any other purpose, and section 27(1)(d) provides that the restrictions on processing sensitive personal dataFootnote ²⁵ do not apply where the processing is for research purposes.Footnote ²⁶ Section 35(1)(d) also permits the processing of the personal data of children for research purposes, while section 37(2)(e) provides that the regulator may authorize the processing of personal data in circumstances where such processing activity would ordinarily be unlawful. Based on these provisions, South Africa has a very expansive framework for personal data processing for research purposes.Footnote ²⁷ In Nigeria, section 2(1)(a)(i) of the NDPR, on the other hand, permits, inter alia, further processing of personal data for research purposes. In these three AfCFTA member states, then, businesses will have to meet different standards to be able to conduct research with personal data; the nature of personal data that will be available will also vary, and the possibility of using similar categories of data for research across these jurisdictions stands to be potentially onerous: the options to use personal data for research purposes in South Africa are quite expansive while the possibilities for similar activities in Kenya are more restrictive and might be inhibited by the country's requirement for data localization. This situation will not make intra-African trade any easier and could frustrate the free movement of persons, capital, goods and services sought by the AfCFTA. Furthermore, the process of drafting and signing data protection agreements across the continent will pose another challenge, as businesses will be required to enter into distinct and specially drafted data protection agreements, with divergent obligations subject to the applicable national laws. This will make contracting onerous, particularly from a data protection perspective, while also creating a hurdle which will fetter the single market and make it less attractive.

Another possible consequence of the application of divergent national data protection laws is the fact that some countries will adopt stricter laws than others. In such cases, one can expect that data controllers and processors will be more inclined to comply with stricter data protection laws, as this will consequently help them comply with weaker data protection laws as a matter of course. In such a situation, data controllers and processors might also be inclined to engage in “forum shopping”, which might even influence their business’ choice of countries of domicile if this helps them avoid a requirement of compliance with stricter data protection laws. The implication of this will likely be inconsistent rights to data protection, with data subjects resident in countries with stricter data protection laws enjoying a better level of protection than others. The fragmentation of African data protection law, with some state parties affording data subjects a higher standard of protection than others, means that persons trading across the single market will be subject to varying levels of protection as they carry out transactions across the continent, which, depending on the nature of the business, might be a deterrent for some companies.Footnote ²⁸

TOWARDS A TRULY UNHINDERED AFRICAN SINGLE MARKET

The concerns pertaining to the potential inhibition of the single market because of divergent national approaches to the regulation of data protection law can be resolved if the continent adopts a uniform regulatory approach. The effect of the initial fragmentation of data protection law within the EU provides some context to what can be expected from a data protection-induced fragmentation of the African single market.

The EU framework on data protection law was previously governed by the Data Protection Directive (DPD),Footnote ²⁹ which established the data protection objectives sought in the EU while allowing member states to determine how best to achieve those objectives.Footnote ³⁰ This legislative approach meant that different EU member states devised their own means of achieving the goals sought by the DPD, thereby resulting in the fragmentation of the framework. The effect of this fragmentation on the EU single market included inconsistent data protection requirements for businesses across the EU, the non-regulation of data controllers or processors domiciled outside the EU, etc.Footnote ³¹ As a result of these shortcomings, the General Data Protection Regulation (GDPR)Footnote ³² was conceived as a regulatory instrument aimed at creating a uniform regime for the governance of data protection law in the EU. The GDPR sought to (and does) achieve this through three steps: the establishment of a (more) coherent legal framework that enhances legal certainty in the development of the digital economy in the EU;Footnote ³³ ensuring the free flow of personal data within the EU to support the functioning digital single market;Footnote ³⁴ and the establishment of uniformity in the regulation of data protection law across the EU. By adopting this approach, fair competition is achieved because both European and non-European businessesFootnote ³⁵ are bound by the same rules, irrespective of where in the EU they engage in business.Footnote ³⁶

It is reasonable to expect that the African single market will be confronted with challenges similar to those that faced the EU single market before the GDPR came into force.Footnote ³⁷ To prevent this, I would recommend that a uniform African data protection law be adopted to ensure a consistent application of data protection law within the jurisdiction of AU member states. So far, the Convention is the closest attempt at a uniform continental approach to the regulation of African data protection law. Though the Convention might be lacking in fundamental provisions which are necessary for the effective regulation of data protection,Footnote ³⁸ it is a decent start towards achieving continental standardization that facilitates the foundational growth of the African single market. A preferrable and more progressive approach would be amending the Convention, thereby plugging the gaps I have identified. The adoption of a uniform regulatory approach to data protection across the African continent means that companies will be spared the cost and resources (including their capital, workforce, time, etc.) which would otherwise have been invested towards complying with the divergent requirements of the various national data protection laws of AU state parties.

The importance of data protection law to global trade cannot be overemphasized. As earlier highlighted with the example of data localization laws,Footnote ³⁹ data protection restrictions can delegitimize ordinarily justifiable trade relationships. This possibility, and other trade restrictions not related to data protection, ought to be eliminated in a truly single market. However, without a uniform approach to the regulation of data protection law across the continent, this might just end up being another lofty and unimplementable African aspiration.