In the information era we live in today, and with the proliferation of online platforms, data protection has never been more critical. The digital age is one characterized by the widespread use and integration of digital technologies, such as computers, smartphones, the internet, and social media, whence lots of personal data is generated. This has continually created a hub of online (personal) data that is considered the most valuable commodity in the digital economy. This calls for strict measures in data regulation and protection.
The East African region has had concern about data protection, particularly given the region’s increasing use of technology and the Internet.
Lack of Appropriate Data Protection Laws
One of the main concerns regarding data protection in East Africa is the lack of appropriate data protection laws. The existing laws in the region are often outdated and do not provide adequate protection for personal data. As a result, there is a high risk of data breaches and misuse of personal information.
For example, in Kenya, the existing data protection law, the Data Protection Act of 2019, only came into force in November 2020, leaving a long period where there was no legal framework for data protection in the country.
Their neighbor, Uganda, currently has no specific data protection law. The country is still operating under a legislation known as the Electronic Transactions Act, which does not provide adequate protection for personal data.
“The object of this Act is to provide a legal and regulatory framework to: (a) enable and facilitate electronic communication and transactions; (b) remove and eliminate the legal and operational barriers to electronic transactions; (c) promote technology neutrality…” reads the document in part.
Inadequate Enforcement of Existing Data Protection Laws
In cases where there are existing data protection laws, there is often inadequate enforcement of such laws. This lack of enforcement can be due to a variety of factors, including a lack of resources, corruption and mismanagement of resources, and inadequate expertise among law enforcement officials.
For example, in Tanzania, the Cybercrime Act of 2015 includes provisions for data protection, but there have been few reported cases of enforcement of these provisions. As a result, individuals and companies are not deterred from misusing personal data, leading to a high risk of data breaches and other forms of data misuse.
Lack of Awareness and Education on Data Protection
The other very fundamental issue around data and protection in the region is the lack of awareness and education on data protection. Many individuals and businesses in the region are not aware of the risks associated with sharing personal data, and may not take appropriate measures to protect their data.
For example, in Rwanda, a survey conducted in 2020 found that only 38% of respondents were aware of their right to data protection, highlighting the need for greater education and awareness-raising campaigns on data protection in the country.
Inadequate Cybersecurity Measures
In addition to legal and awareness issues, inadequate cybersecurity measures are also a major concern in East Africa. The region has seen a rise in cybercrime in recent years, including phishing attacks, data breaches, and ransomware attacks. In many cases, these attacks are successful due to a lack of adequate cybersecurity measures.
For example, in 2019, a major data breach occurred in Uganda’s Ministry of Finance, Planning, and Economic Development, which compromised personal data of over 3,000 employees. The breach was attributed to inadequate cybersecurity measures, including weak passwords and lack of encryption.
Data protection is a critical concern in East Africa, and there are several issues and concerns that need to be addressed. Confronting these issues will require a concerted effort from governments, businesses, and individuals in the region to protect personal data and mitigate the risks associated with data breaches and other forms of data misuse.
