Data Protection Legal Regime and Data Governance in Africa: An Overview

Abstract

In its simplest sense, data governance refers to the overall management of (personal and non-personal) data to facilitate organizational goals. Data protection, on the other hand, predominantly regulates the management of personal data for the protection of users’ privacy and other fundamental rights and freedoms. The Fourth Industrial Revolution has greatly increased the processing of personal data for business and social purposes in Africa, hence the imminent need to regulate dealings with such personal information for undesirable purpose(s) by setting up relevant legal framework to address. The research analyses the regional legal framework around data protection in Africa in the light of their salient provisions, adequacy, efficiency and enforceability in relation to data governance.

Barrister and Solicitor of the Supreme Court of Nigeria; Managing Partner, Olumide Babalola LP, Nigeria; Member, International Association of Privacy Professionals (IAPP); Member, International Network of Privacy Law Professionals (INPLP).

4.1 Introduction

Data protection refers to strategies and processes that are applied to provide security to privacy, availability and integrity of data use and production.¹ On the other hand, data governance is defined by the Data Governance Institute² as the ‘system of decision rights and accountabilities for information-related processes, executed according to agreed-upon models which describe who can take what actions with what information, and when, under what circumstances, using what methods.’ Additionally, within the context of data protection and data governance, digital rights are ingrained in production and utilization of the data through digital gadgets. With increased use of digital space to generate data, protection on the rights of the user is vital when formulating the legal framework.

Data protection reportedly surfaced in Europe in 1970 when the German Federal State of Hesse (Mayer-Schonberger, 1997) enacted its data protection law, which was followed by the Swedish national Data Act in 1973 (Oman, 2010). In Africa, the Republic of Cape Verde led the way in 2001 when it enacted the first data protection law in Africa. The Cape Verdean Data Protection Act was passed on the 22nd day of January 2001, to create a legal framework for protection of personal data in the country (Makulilo, 2012).

Unlike in Europe where member states transposed the provisions of the regional international instruments into their various municipal legislation on data protection, Cape Verde heavily relied on Portuguese Data Protection Law, which itself transposed the EU Data Protection Directive 95/46/EC (Wong, 2012)³ before it was replaced by the EU General Data Protection Regulation (GDPR) (Traca & Embry, 2011). Between 2001 and 2014 when the first and only pan-African international treaty on data protection was adopted in Equatorial Guinea,⁴ fourteen African countries⁵ had already enacted their respective data protection laws without the benefit of drawing legislative inspiration from the convention as most of the laws were modelled after European data protection legal framework (Greenleaf & Coltier, 2018; Schwartz, 2019; Mercer, 2020; Scott & Cerulus, 2018).

In the age of digitalization, legal frameworks for data protection are inevitable for Africa. More businesses and government are conducting meetings, transactions and data storage online. African Union has envisioned a digital single market (DSM), with legislation on it started in Tunisia and Senegal to support the business environment. Other policy frameworks such as Declaration of Principles on Freedom of Expression and Access to Information in Africa and the Declarations on Internet Governance are a basis of protection of digital rights and privacy of citizens. However, digital rights are still being violated in terms of Internet shutdowns and social media taxation (Boakye, 2021).

As these data protection legal frameworks are being adopted across Africa and the globe, the increased data produced and utilized in the digital space cannot be ignored. The digital rights of the producers and users are imperative for effective data use for socio-economic and political growth in Africa.

In a description approach, this paper examines the major international instruments regulating data protection in Africa by briefly chronicling the events that culminated in their adoption vis-à-vis their aims and objective. The paper also analyses the salient provisions of the instruments in the light of their applicability and the extent to which they have sharpened data protection compliance on the continent. This paper then analyses the nexus between data protection and data governance in Africa within the context of the regional instruments, and it then concludes with the necessity of legal framework for data protection in relation to data governance in Africa, with some recommendations that could be adopted to either develop new or strengthen the existing data protection framework especially in relation to data governance.

This paper, in a descriptive and normative manner, poses and analyses a number of questions thus:

• 1.1 What are the laws or quasi-legal guidelines (legal framework) that regulate or support data protection in Africa?

• 1.2 How does this legal framework measure up to international standards?

• 1.3 How enforced or enforceable is the framework on the continent?

• 1.4 In what manner does this framework influence or ought to influence data governance in Africa?

• 1.5 What are the incentives for data protection and data governance on the continent?

4.2 Legal Framework on Data Protection in Africa

Unlike what is obtainable in the European Union (EU) where the General Data Protection Regulation (GDPR) provides some sort of formidable harmonization of the erstwhile irregular data protection laws across the union, its African counterpart does not have a pan-African legislation that is immediately enforceable across board without domestication. This is not however to say that Africa does not have an existing legal framework on data protection; let us just say the elephant in the room remains the institutional capacity and political will to enforce the available instruments. Hereunder, the paper discusses the extant legal framework for data protection on the continent.

4.2.1 African Union Convention on Cyber Security and Personal Data Protection 2014 (Malabo Convention)

Conversations around regulation of the cyberspace effectively began in the late nineties when the committee of the United Nations General Assembly contemplated an instrument on ‘disarmament and international security’ whose deliberations were spearheaded by a draft resolution introduced by Russia in 1998 (Kavanagh, 2017). Upon Russia’s proposal, the United Nations subsequently constituted a Group of Government Experts (GGE) engaged in the developments in the field of information and telecommunications in the context of international security.⁶

In one of its reports (UN General Assembly, 2021), the GGE notes that: ‘The use of ICTs in future conflicts between states is becoming more likely, the risk of harmful ICT attacks against critical infrastructure is both real and serious and states are rightfully concerned about the danger of destabilizing misperceptions, the potential and economy deriving from the difficulty of attributing the source of an ICT incident’ (Tikk & Schia, 2020). However, the UN’s activities around cybersecurity did not spur many African countries into the anticipated regulation of the data protection as only eleven member states⁷ instituted frameworks on data protection as of 2011 (Ball, 2017).

In 2011, the AU took a bold step towards regulating data protection when it published a draft AU Convention on Establishment of a Credible Legal Framework for Cybersecurity in Africa⁸ which sought to, among other objectives, harmonize the laws of member states on data protection and sundry matters (Orji, 2012). In 2013, the draft was however reviewed and renamed the African Union Convention on the Confidence and Security in Cyberspace,⁹ but it was also reviewed and went through another name change that culminated in the AU Convention on Cybersecurity and Personal Data Protection in 2014, which was preceded by a conference of experts from AU member states’ ministry of justice where the content of the convention was thoroughly considered (Abdulrauf & Fombad, 2016).

Ultimately, on the 27th day of June 2014, during the 23rd ordinary session of the AU Summit in Malabo, Equatorial Guinea, the draft Convention on Cybersecurity and Personal Data Protection¹⁰ was adopted by the heads of state to establish a credible framework for cybersecurity in Africa through ‘protection of personal data etc.’¹¹

The Malabo Convention has a total of 38 articles, preceded by a 20-paragraphed preamble. The Convention seeks to encourage member states to create frameworks and mechanisms to protect personal data and fundamental right as well as easing free flow of data within the continent. The first article defines essential data protection terms like consent, data controller, data subject, direct marketing, encryption, health data, personal data processing, recipient, sensitive data, third party and so forth but surprisingly omitted the definitions of equally important concepts like pseudonymization, data processor, data breach, data protection authority or supervisory authority, cross-border processing and so forth. While one may argue that the omission of such term does not superficially appear far-reaching, the convention is meant to be a compass for data protection laws on the continent as gleaned from its Articles 8(1) and (2) which seek to establish a framework for protection of ‘physical’ data and mechanism to ensure data processing guarantees the protection of fundamental rights. Yet even this falls short of the status of a legislative model in such material respect. Hence, it is desirable that the Convention is supplemented by relevant instruments to comprehensively define the omitted regular and fundamental data protection clauses, otherwise its enforcement may engender unimaginable conceptual confusion.

The convention applies to automated or non-automated processing¹² of personal data within the territory of a member state.¹³ Like the GDPR, the Convention does not provide a definition or description of what constitutes ‘automated’ or non-automated processing, but the European law defines ‘profiling’ (Wiedemann, 2018). Automated processing has however been defined as ‘a processing operation that is performed without any human intervention; conversely, non-automated processing is such that it is performed partly or wholly with human intervention.¹⁴ Profiling and automated decision-making within the African context is increasing in the banking sector, especially with the rising development of FinTechs and proliferation of automated teller machines (ATM); however, there exists no pan-African legislation on this.

The convention requires member states to establish independent national authorities assigned with the statutory responsibility of ensuring that personal data within their respective territories are processed in accordance with the provision of the convention while keeping faith with the universal role of Data Protection Authorities (DPAs) (Giugiu & Larsen, 2016). The Convention expects the respective national DPAs to educate the public on their data protection rights within their respective territories¹⁵ while its membership is insulated from government influence, thereby underpinning their independence and impartiality (Greenleaf, 2012). As of June 2021, out of the 30 countries with proper data protection laws in Africa, only 20 have data protection authorities (DPAs),¹⁶ while others are either yet to establish one or constitute its members. The Convention makes provisions for the duties and powers of the DPAs to include informing the public of their rights, issuing opinions, receiving and resolving complaints, data processing audit, imposing administrative sections, maintaining a data processing directory, regulating transborder transfer, establishing cooperation mechanisms with other national DPAs,¹⁷ authorizing certain processing activities,¹⁸ such as data involving genetic information, information on offences, national identification number, biometric data, historical and statistical data and so forth.

In what appears a renaming and rearrangement of the universally recognized principles of data protection, the Convention groups consent together with legitimate processing,¹⁹ separate from the principle of lawfulness and fairness; it then fuses purpose with storage limitation,²⁰ accuracy and transparency as a stand-alone principle while confidentiality is grouped with security of personal data.²¹ In all, the convention recognizes six re-designated principles, none of which contemplates the principle of data minimization or accountability as recognized under European law, even though it provides for specific principle in the event of processing sensitive personal data.²² The consequence of such regrouping and muddling of principles would not only be evident in enforcing the clustered concept, it is potentially capable of confusing data controllers on their obligations thereunder.

The Convention, like most other data protection laws, recognizes data subject’s right to information, right to access, right to object, rectification or erasure, but it again omits right to lodge complaint with regulator, right to data portability, restriction of further processes and so forth.²³ It also mandates data controllers to ensure confidentiality and security of personal data in their custody.²⁴

Although the Convention was adopted in 2014, it is yet to enter force by reason of Article 36 makes it enforceable only thirty days after its ratification by fifteenth member states. As of 20th day of June 2021, only Angola, Ghana, Guinea, Mozambique, Mauritius, Namibia, Rwanda, Senegal and Zambia have ratified the Convention.²⁵ In spite of its limitation, Abdulrauf (2021) however argues in favour of the Convention’s perceived expansive provision and authoritative stance, especially as far as they influence subsequent data protection legislation on the continent.

Though the AU Malabo Convention sought to enhance data protection in both the physical and digital data collection, use and storage, there are no articles which stipulated how to enhance digital rights in utilization and production of data online. There is evidence of digital rights violation in Africa in terms of online users’ arrests and intimidation, Internet blocking and introduction of counterproductive laws and regulations undermine use technology and data generated to drive growth in Africa (CIPESA, 2019). The legal framework does not cover the sale and utilization of the data by third parties. This has seen infringement on privacy and sometimes adversely affects livelihoods of those affected. Furthermore, the issue of cybercrime is a matter of concern as more countries do private and government businesses online (Interpol, 2021).

4.2.2 Supplementary Act on Personal Data Protection Within the ECOWAS (ECOWAS ACT)

The Economic Community of West African States (ECOWAS) was established for the promotion of regional cooperation among member states especially for economic growth, among other objectives (Terwase et al., 2015). Its consequent ECOWAS Treaty mandates the harmonization and coordination of national policies and promotion of integration programmes in science, technology, legal matters and so forth (Ashiru, 2021).²⁶

On the 16th day of February 2010, twelve heads of government within the ECOWAS gathered in Abuja, Nigeria, and adopted the Supplementary Act A/SA.1/01/10 on personal data protection within ECOWAS²⁷ (the Act) which predominantly seeks to regulate data protection within the member states.

The Act defines data protection terms like consent, data protection authority, personal data, sensitive data health data, data subject, data controller, data processor, third party and recipient²⁸ but omits important terminologies like processing, profiling, pseudonymization, anonymization, profiling, personal data breach, cross border and so forth. The consequence of the omission may however come to play when the Act is invoked to settle issues relating to transborder processing of data, especially before the regional courts, when faced with questions of conflict of laws and decision on lead national DPA and so forth (Estadella-Yuste, 1991). The Act applies to processing of personal data by public or private bodies by automated or non-automated means carried out within the ECOWAS, with exceptions.²⁹

The Act mandates each member state to establish its own independent national DPA with parameters guaranteeing their impartiality and professional secrecy³⁰ and highlights the responsibilities of DPAs, their secrecy and powers to impose sanctions on erring parties.³¹ In its own version of seven data protection principles, the Act states that processing is legitimate where it is done with data subject’s consent but gives exception where the requirement of consent can be dispensed with.³²

The second principle of legality and fairness requires processing to be done in a legal, fair and non-fraudulent manner.³³ In what appears a bifurcation of some sort, the Act separates consent, which is a ground of lawful processing, from the principle of legality and fairness, which is fused under the EU principle of lawfulness, fairness and transparency (Kosta, 2013). As its third principle, the Act fuses purpose limitation, data minimization, storage limitation into one principle styled ‘principle of purpose, relevance and preservation’³⁴ which requires data to be obtained for specific purpose, kept adequate and not kept beyond the required period. The principle also imports an element of the lawfulness principle.³⁵ Other principles are accuracy, purpose relevance and preservation, transparency, confidentiality and security and choice of data processor.³⁶

Taking a cue from the European model on transborder transfer of data to third countries, the Act restricts transfer of personal data outside ECOWAS sub-region to only countries where there is an adequate level of protection (Wagner, 2018)³⁷ for fundamental rights and freedoms. Although the Act does not provide elaborate mechanisms for regulating such transfers, it simply mandates data controllers to inform DPAs before the transfers.³⁸ On data subject’s rights, the Act recognizes right to be informed,³⁹ right to access,⁴⁰ right to object⁴¹ and right to rectification and destruction.⁴² Again, the Act omits vital data subject’s right like right to restriction of further processing, right to data portability, right in relation to automated decision-making and so forth. The Act substantially concludes on the obligations of data controller to be confidentiality, security, preservation and durability,⁴³ which however appear similar to data protection principles in their objectives.

4.2.3 Southern African Development Community (SADC) Model Law on Data Protection

In 2009, the imperativeness of creating a harmonized and uniform set of policies for the information communication technology industry for the sub-Saharan countries in the group of African, Caribbean and Pacific states necessitated the enactment and adoption of the Southern African Development Community (SADC) Model Law on Data Protection⁴⁴ which was adopted in 2013. Like many data protection laws, the Model Law defines terminologies such as consent, data controller, processor, data subject, genetic data, child personal data, processing, protection authority, recipient, sensitive data third party and transborder flow. The law however does not define anonymization, pseudonymization, profiling, personal data breach, data subject access request and so forth.

From the wording of Article 2, it appears that the scope of the law is not limited to the SADC sub-region as it only refers to ‘given country’ or ‘territory’—terms which are not even defined therein. Even from the preamble, it does appear that the Model Law is not restricted to any region especially as contained in the concluding paragraph that:

It is with the above in mind that it is acknowledged that the protection of personal data involves the establishment of a specific and adapted regime to the participants of each region as set out in this Model Law.

It is however worthy of note that, in spite of its pan-African scope, the Model Law is a soft law without a legally binding effect on member states, but like the OECD Guidelines in Europe, it only provides a guide to member states on the approach to law-making on the data protection as well as an attempt at harmonizing the laws in the region (Shumba, 2015; Makulilo & Mophethe, 2016).⁴⁵

The Law envisages the establishment of independent regulator for member states to be constituted by judges appointed by the executive and non-governmental organizations with competent and requisite knowledge of data protection and the benefit of immunity.⁴⁶ Unlike other regional instruments in Africa, the Model Law provides the most comprehensive provisions on the nature, independence duties and powers of national DPAs, but it unfortunately contemplates the DPA reports to an undefined institution instead of the parliament⁴⁷ and thereby erodes its independence (Greenleaf, 2012). The Model Law recognizes the principle of data quality, lawfulness and purpose limitation, and it makes copious provisions on processing of sensitive and non-sensitive data, children’s data and data relating to litigation,⁴⁸ but it however omits principles like data minimization, storage limitation accuracy, accountability, integrity and confidentiality and so forth. The Law outlines the duties of controllers in cases where personal data are collected directly from data subjects and otherwise, duty to ensure data security and accountability for third parties that access data through them, data breach or incident notification.⁴⁹

The law recognizes the following data subject’s rights: access, objection, automated decision-making right of representation and right to judicial redress.⁵⁰ Under the law, members of DPAs are meant to be administered to oath of secrecy⁵¹ as they are empowered to impose fines on controllers for violation as well as prosecution of offenders in the law court.⁵² The law subjects cross-border transfer of data to the relevant provisions of the national law adopted for the implementation of the Model Law, and this appears as the only provision that is fixated on member states of the SADC as it requires adequate level of protection before personal data can be transferred to non-member states.⁵³ Although the law references adequacy level, unlike the EU GDPR, it does not provide the parameters for determination of such level of protection (Wagner, 2018).

Despite the laudable provisions of the Model Law, it merely serves as an advisory framework for the enactment of national laws as opposed to a legally binding instrument that can be ratified.⁵⁴

4.2.4 East African Community (EAC) Legal Framework for Cyberlaws 2008

In its strides to deepen East Africa’s regional integration via digital interconnectivity for the seamless provision of services, the East African Community constituted a Task Force which recommended a legal framework for cyberlaws⁵⁵ with the main objective of developing policies facilitating cooperation between member states (Mwiburi, 2019).

The Framework defines ‘data protection’ as the obligations assigned to entities processing personal data. It also recognizes that a data protection regime ought to guarantee certain data subjects rights.⁵⁶ Thereunder, data controllers are duty-bound to comply with muddled principles of accountability, transparency, fairness, lawfulness data accuracy, data security and processing limitation.⁵⁷ The Framework omits data minimization, purpose limitation and accountability but suggests a self-regulatory system to minimize the cost associated with conventional compliance enforcement approach.⁵⁸

Without prejudice to Legal Framework’s progressive but brief provisions on data protection, they are mere guides for member states but not legally binding on them until they transpose the provisions into their respective national laws (Greenleaf & Georges, 2014). It is worthy of note that the legal framework remotely or otherwise influenced the data protection legislation in Kenya, Uganda and Rwanda which passed the legislation afterwards.

4.3 Interplay Between Data Governance and Data Protection in Africa

Data governance (DG) is the ‘exercise of authority and control over the management of data’ (Abraham et al., 2019). It also entails the trust reposed in data and its accountability for any adverse result occasioned by its poor quality. The whole gamut of data governance as a concept speaks to the data processing principle of accountability (Weber et al., 2009). Otto et al. (2007) define the concept as a ‘companywide framework for assigning decision related rights and duties to be able to adequately handle data as a company asset’. It is the ‘formal orchestration of people, process and technology to enable an organization to leverage data as an enterprise asset’ (Zornes, 2006).

DG is concerned with the apportionment of responsibilities and liabilities among the various players in a data management system with respect to the decision-makers’ rights and accountability over an entity’s data assets. While data governance principally relates to collection and management of data that ensures effective and efficient use for the overall productivity of an entity (Cheong & Chang, 2007), data protection, on the other hand, safeguards the collected personal data⁵⁹ from misuse, compromise and/or corruption within the confines of certain principles. It is instructive that data governance is not restricted to personal data, but data protection in this context only protects the personal data managed alongside the big data (Elgendy & Elraga, 2014)⁶⁰ under the data governance framework. Hence, certain principles of data processing significantly impart data governance as far as personal data handled by the legal entity is concerned.⁶¹ Unlike in Europe where the principles of data processing are uniformly provided by the GDPR (Bygrave, 2014), in Africa, the only readily binding and enforceable regional instrument is the ECOWAS Supplementary Act on Data Protection (Greenleaf & Coltier, 2020); the AU Convention on Cybersecurity is not yet in force as its commencement provision has not been activated since less than 15 members have signed it.⁶²

Notwithstanding its comatose state, the Convention provides for the principles of accuracy and storage limitation,⁶³ but it does not expressly provide for accountability.⁶⁴ However, this principle is an offshoot of the transparency principle (Alhadeff et al., 2021), hence since the convention provides for the latter, accountability can be discussed thereunder in relation to data governance. Since the Malabo Convention is pan-African in its coverage, I will discuss some of its principles which interplay with data governance in Africa albeit in its current unenforceable predicament.

4.3.1 Accuracy Principle

Accuracy is one of the components of data quality (Cong et al., 2017). The principle of accuracy entails the accuracy, completeness and consistency of data, and it goes without saying that organizations require the highest quality of data for them to function optimally (Joshi, 2020). In an entity’s use of (personal) data, privacy issues like transparency, security and compromise of (personal data) are always thrown up and sometimes the relevant questions are left unanswered. Bair notes that data quality is defined by ‘data type and domain, completeness, uniqueness, and referential integrity, consistency across all data bases, freshness and timeliness and business rules conformance’ (Bair, 2004).

On the relationship between the principle of accuracy and data governance, Cohn argues that ‘data governance is a catalyst for quality and value is derived from well governed quality data. Relevant, timely, consistent, reliable and accurate data is an expectation, and it is not achieved serendipitously’ (Cohn, 2015). In data protection parlance, the principle of data quality (Hoeren, 2018) requires personal data to be effective, fit, relevant and all-embracing for its intended purpose of processing.⁶⁵ The principle stipulates that, when organizations collects data for decision-making, they must ensure that such personal information is not only utilized in a manner that is relevant to the purpose of collection, but it must also be accurate, wholesome and regularly updated. This will ensure that personal information used for critical organizational decisions is accurate to prevent undue violation of fundamental rights and freedoms of data subjects (Bygrave, 2002).

Under this principle, organizations (private and public) are duty-bound to ensure the accuracy of information they keep and the opinions that they express regarding data subjects, especially when decisions affecting the latter are made (Hallinan & Borbesius, 2020). It mandates data controllers to take reasonable steps to ascertain aptitude of personal information processed within the context of their organizational activities. As a representation of this principle, Article 13, Principle 3 of the Malabo Convention mandates data collection to be adequate, relevant and not excessive in relation to the purposes for which they there collected.⁶⁶ Ultimately, legal entities must set up mechanisms to ensure the validity and quality of personal data in their custody by imbibing a business culture of periodic updates and timely deletion of the outdated or irrelevant ones.

4.3.2 Storage Limitation

Storage of data is one of the main components of data governance. Sometimes, they are stored indefinitely in unregulated and unguarded databases for the controllers’ whimsical analyses and/or utility, oftentimes without the consent of data subjects (Pike, 2020).⁶⁷ The passage of data protection legislation in Europe, for example, threw many organizations into panic mode, especially when auditing the legal bases for collecting and/or storing online visitors’ data through their digital platforms without necessarily fixing the mechanisms for obtaining informed consent (Francesco et al., 2021). On the other hand, while businesses are not precluded from storing customers’ personal data, such storage must be within the confines of the applicable data protection laws and its exceptions (Duceto, 2020). For example, data processing for research purposes constitutes one of the exceptions to the principle of storage limitation, since data can be kept for longer than necessary, especially for verification of research results (Pormeister, 2017).

The indiscriminate and indefinite storage of customers and other data subjects’ personal data by organizations poses unimaginable privacy risks attributable to unregulated and, most times, insufficient and inadequate technical and organization security measures (if any) by data controllers (Biega & Finick, 2021). Essentially, personal data must not be kept in a form that identifies data subjects for longer than is justifiable by law. Where personal data are no longer needed or have become irrelevant or out of date, data controllers can either outrightly delete, anonymize or pseudonymize them in certain cases (Mourby et al., 2018).

Under the AU Malabo Convention, the storage limitation is however not a principle but an obligation on the data controllers. Article 22 emphatically prohibits personal data from being kept for longer than necessary for its purpose of collection, but the provision is of exceptions or parameters for the applicable retention period. The principle interplays with data subject’s right to be forgotten or deletion or erasure of personal data which is no longer relevant or up to date. Without prejudice to the circumstances surrounding an organization’s collection of personal data, this principle still operates to provide them from keeping and/or storing the data for longer period than reasonably necessary. Hence, once data have been used for the purpose of collection, it behoves the organization to immediately delete or anonymize such personal data to reduce the risk of violating the principles of data minimization and accuracy when they become irrelevant, surplus to requirement, inaccurate or outdated. There are no specific retention periods in the regional instruments; however, resort should be had to the relevant national laws on data retention limits, but ultimately a formidable data governance policy ought to be devised to plug the legislative gaps in this regard.

Legislative and stakeholder’s engagement for data governance however becomes very important when it is considered that out of 55 African countries, at least 49 have (or about to) enacted laws or regulations requiring prospective subscribers to provide personal data as conditions to own telephone lines (Donovan & Martyin, 2013), but sadly, only about 19 of those countries have established Data Protection Authorities⁶⁸ to enforce compliance with relevant data protection laws.

4.3.3 Accountability

This principle originated from the OECD Guidelines⁶⁹ of 1980 and repeated in its revised version of 2013. The principle principally requires legal entities to acknowledge and assume liability for their operations on personal data in the course of the organizational activities. Data controllers have the bounden duty of demonstrating adequate technical and organizational measures to secure data in compliance with the relevant data protection legislation for the ultimate protection of data subjects’ rights (de Hert et al., 2012). In compliance with this principle, legal entities are obliged to document the observance of their obligations under the relevant data protection legislation (Becker, 2019).

Accountability is not expressly provided under the Malabo Convention, but the principle is closely linked to the principle of transparency, and it has been regarded as a privacy and data protection—enhancing principle (Guagnin & Leon, 2012; Zimnerman & Cabinakova, 2015). In demonstrating their accountability, organizations must take hands-on approach to data protection and privacy issues by adopting effective and contemporary measures, which are not only discernable at a glance but transparently demonstrable upon regulatory request or audit (Falk, 2016).

Data controllers must take full responsibility for how they directly or indirectly deal with data and implement appropriate measures and documentation in proof of their compliance with applicable laws (Bennet, 2021). They are responsible and must demonstrate data quality.

4.3.4 Confidentiality and Integrity

This is recognized under Principle 6 of the Malabo Convention. This principle simply mandates organizations processing personal data to employ appropriate organizational and technical measures to protect such personal information from misappropriation, corruption, theft and/or destruction. Confidentiality in this sense speaks to the duty of the organization handling data to ensure that such information is not shared or exposed to unintended persons while keeping it as safe and secret as technically possible.

4.4 Incentives of Legal Framework for Data Protection/Data Governance in Africa

The benefits of data protection to data governance are numerous. However, for the purpose of this paper, I shall briefly discuss the incentives from the rights protection and economic gains for organizations and governments.

4.4.1 Privacy Right Guarantees

Even though the African Charter does not expressly recognize privacy as a fundamental right, it does not rule out African’s entitlement to enjoy private family life.⁷⁰ This idea of a privacy entitlement for individuals is what also underpins the notion of data protection. In fact, data protection originated from the right to privacy, hence a proper and formidable legal framework for data protection would not only guarantee certain data subjects rights, but it would also ensure considerable control over their personal information and ultimately repose consumers’ trust in the processing activities.

4.4.2 Healthy Democracy

A healthy democratic state is one in which its citizens can make informed and autonomous choices (Forde, 2016). Yet processing data without consideration for the impact it may have on individuals may have the effect of limiting the ability of individuals to make choices or limit the choices available to such individuals in a way that limits their autonomy (Feldman, 1994). This is even more crucial in today’s world of technological reliance where automated processing and digital identities are gradually becoming more significant determinants of an individual’s real-life choices. Data protection laws militate against this. The idea that when consent is relied upon as the legal basis for processing, it must be informed and must not be obtained using coercive tactics echoes these concerns for democratic autonomy. Furthermore, even in instances where data are processed without consent, the notion of data subjects’ rights and the transparency, fairness and accountability obligations grant the much-needed controls individuals need to maintain their ability to make truly free choices. Thus, it is safe to conclude that a world where data protection is respected is one in which the seeds of corporate or governmental totalitarianism cannot flourish.

4.4.3 Economic Gains from Free Flow of Data

The concept of free flow is not merely one where there are no legal barriers to cross-jurisdictional data transfers. Instead, it entails that where these legal barriers exist, they do not impose data localization requirements Data localization requirements have the direct effect of raising the costs for doing business across jurisdictions. Particularly for data-driven businesses such as cloud service providers, these costs have the added effects of posing significant barriers for entry into new markets within the continent. This disincentivizes the creation of such businesses and creates an environment that limits the growth of African start-ups and SMEs. Furthermore, the free flow of personal data would ease information dissemination and beneficial collaboration of businesses and corporate entities within the region. However, these benefits extend to collaboration opportunities outside the region. The European Data Protection framework is setting the global trend for technological collaborations across the world. Implementing and initiating an African data protection framework may create an opportunity for the recognition of African countries as having an adequate level of data protection. This has the potential to facilitate more cross-border collaboration and even non-data-driven businesses looking to partner with African businesses in a capacity.

4.5 Conclusion

Data governance predominantly speaks to the management of data for organizational growth. Experience has shown that the management of big data would always involve the handling of personal data, hence the activation of data protection principles.

African currently has only one binding regional instrument—ECOWAs Supplementary Act on Data Protection—among other international instruments with provisions on various principles that persuasively impart data governance on the continent. Out of 55 African countries, only 30 have fully dedicated data protection laws and 19 of them have established DPAs to enforce compliance with the laws; hence, it is crystal clear that data governance on the continent remains largely unsupported by legislative and enforcement framework.

With the magnitude of personal data exchanged, stored or transmitted within the data governance system in Africa, an appropriate and formidable data protection legal framework becomes essential to guarantee users of control over their personal information, on the one hand, and to regulate the data controllers’ processing/management of such information against misuse, compromise, theft or other untoward dealings with personal data, on the other hand.

For a properly regulated data governance, it is hoped that African countries would evenly ratify the Malabo Convention and strengthen their respective municipal data protection legal frameworks to complement public and private organizational management of personal data not only within their respective territories but also across the continent.

The transborder cooperation of national DPAs envisaged by the regional treaties ought to be encouraged and strengthened to boost enforcement of regional and municipal data protection laws with the aim of enhancing trans-border flow of data and international data governance within the confines of uniform cross-border data protection rules.