Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Privacy in Africa What’s Changing and What Comes Next E163

Transcript

Privacy in Africa What’s Changing and What Comes Next E163 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  The last two decades have been so significant for the
• 0:02
  continent, from 2001 when the first country, Kabul WADA, the
• 0:07
  data protection law. Now we have a list of five
• 0:10
  countries on the continent with, you know, some sort of data
• 0:12
  protection laws. The last two decades has been
• 0:14
  more on countries trying to introduce data protection laws.
• 0:19
  What you've seen in the last five years, three years, two
• 0:22
  years thereabout has been, you know upward the majority of the
• 0:27
  ecosystem in different in some key markets in terms of
• 0:30
  compliance. It's been evolving.
• 0:32
  You see different level of compliance.
• 0:34
  So now we pretty much have an institution where in the past,
• 0:37
  even in countries where there are no laws.
• 0:41
  Hi, my name is Punit Pakia and you're listening to Fit for
• 0:44
  Privacy podcast where AI meets privacy.
• 0:47
  This is not legal advice. Thanks for listening.
• 0:52
  Privacy is complex and it has many dimensions and it varies
• 0:55
  from geography and region. Now how is privacy being
• 0:59
  perceived in Africa? How is it changing and what is
• 1:03
  coming next in privacy landscape of Africa?
• 1:06
  So for that we are going to talk to Ridwan Olado who is going to
• 1:10
  guide us on what's happening in privacy and what's happening in
• 1:14
  Africa. As you do that, do visit growth
• 1:16
  skills dot store and take advantage of ISO standard and EU
• 1:20
  regulation courses. Hello and welcome to the Fit for
• 1:23
  Privacy podcast. And we are with Redmond, Alaido
• 1:26
  Redmond, welcome to the Fit for Privacy podcast.
• 1:29
  Thank you. It's a pleasure to be here and
• 1:32
  joining you today as. Well, it is a pleasure and
• 1:35
  tempted to ask you a question. What is the state of privacy in
• 1:39
  terms of a common man's perspective in Africa?
• 1:43
  Overall oriented one also. OK.
• 1:46
  I mean, in Africa we've seen quite a number of interesting
• 1:50
  things emerging and a lot of developments happening as far
• 1:53
  as, you know, concept of privacy and data protection.
• 1:57
  One fundamental thing, for example, is the last two decades
• 2:00
  have been so significant for the continent from 2001 when the
• 2:05
  first country, Cabo, added the data protection law and
• 2:09
  cascading to this period. Now we have no less than for
• 2:13
  five countries on the continent with, you know, some sort of
• 2:16
  data protection laws. But one key thing you see is
• 2:20
  that even prior to the data protection laws emerging in
• 2:25
  different parts of Africa, you've seen cost The
• 2:28
  constitution in different African countries guarantee the
• 2:31
  right to privacy as a constitutional right.
• 2:34
  And this is pretty much, you know, the language kind of like
• 2:37
  similar when you say privacy, you know, people have a right to
• 2:42
  privacy from their homes, their speech, you know, and basically
• 2:48
  pretty much traditionally it's been defined in other parts of
• 2:51
  the world, but indeed a protection emerging at some
• 2:53
  point later on. It's kind of like, you know,
• 2:56
  we've got like of convergence and divergence in in those data
• 3:01
  protection laws. How many of the concepts have
• 3:03
  been, you know, shaped and all of that.
• 3:06
  But definitely one thing you still find is pretty much, you
• 3:08
  know, the principles are still very similar with what you have
• 3:12
  with other data protection laws across the world.
• 3:15
  So yes, that's how things are, are currently evolving and have
• 3:20
  evolved here in Africa. That's nice.
• 3:23
  And are there any specific laws in different countries or how's
• 3:27
  the situation? Yeah.
• 3:29
  I mean, if you look at many, a lot of African countries and
• 3:33
  maybe you can pick up our countries like you know, Kenya,
• 3:35
  Nigeria, Rwanda where I also live or pretty much pick out so
• 3:41
  many countries. You first have, it's a layer.
• 3:43
  So first you get right to privacy and shrine in the
• 3:47
  Constitution as a you know, as a right guaranteed.
• 3:50
  And what you didn't have is you have omnibus laws like the data
• 3:53
  protection laws, depending on the nomenclature used in
• 3:58
  different countries that says as like the omnibus law.
• 4:01
  And then you have, you know, sector specific laws coming
• 4:04
  right there at some points where you have different regulators
• 4:07
  from the financial systems, capital markets, communication
• 4:11
  authorities also have some sort of data protection laws do miss
• 4:14
  out in their primary laws or sometimes in their secondary
• 4:19
  legislation. Next to that, you also have
• 4:22
  other domain specific laws that also sort of treats, you know,
• 4:26
  data protection some way. And depending on the structure
• 4:29
  of the structure of the country itself, if it's country with
• 4:33
  what I state or regional governments, if those body of
• 4:38
  governments also have like powers to enact laws, you also
• 4:40
  have some of them sometimes also introducing laws.
• 4:43
  And some of the laws they introduced sometimes also
• 4:46
  includes either right to privacy or right to data protection or
• 4:50
  data protection has a rights within those bucket of laws.
• 4:54
  So again, you have this generically along so many
• 4:59
  countries, but of course, you see, I have countries which, you
• 5:01
  know, they're law making process, for example, is kind of
• 5:03
  like distinct and not necessarily the the generic
• 5:08
  things you see in different parts of the world, but
• 5:12
  generally it's what the story has been in so many, so many
• 5:15
  countries on the continent and. What's the state of compliance?
• 5:20
  I mean do people comply and do is the attitude like ohh it
• 5:24
  doesn't matter they can make a law it doesn't care we don't
• 5:27
  care how how's it? Or maybe big companies think we
• 5:30
  need to comply and smaller one or like they casual about it.
• 5:34
  I mean, we're seeing, we've seen a lot of a lot of changes.
• 5:37
  Like I said, you know, the last two decades have been very
• 5:40
  pivotal, but I don't think the last decade itself has also been
• 5:43
  like super important. So one trend you see in the last
• 5:46
  decade, for example, has been the last two decades has been
• 5:49
  more around countries trying to introduce data protection laws.
• 5:53
  But what you've seen in the last five years, three years, two
• 5:57
  years thereabouts has been, you know, upward the majority of the
• 6:03
  ecosystem in different in some key markets.
• 6:05
  So things South Africa, think Nigeria, think Kenya and those
• 6:09
  are not the only countries, a couple of other countries where
• 6:11
  you're also seeing a lot of interesting things happening.
• 6:14
  So in terms of compliance, you know, it's been it's been
• 6:19
  evolving, you see different level of compliance.
• 6:22
  So now we pretty much have any situation where in the past,
• 6:26
  even in countries where there are no laws, you have countries
• 6:30
  with multi jurisdictional presence, for example, who will
• 6:33
  still manage to still build out their compliance programmes
• 6:36
  modelled after either their compliance framework or
• 6:39
  compliance framework in other parts of the world.
• 6:41
  But now with specific local provisions, you're also seeing
• 6:46
  them trying to comply with those local requirements.
• 6:48
  So think about things like mandatory registration
• 6:51
  requirements. In some countries, you need
• 6:53
  authorization for data processing to transfer data out
• 6:57
  of the country. And what you don't see next to
• 7:01
  that is also now that interesting amount of
• 7:05
  enforcement you're seeing across different countries.
• 7:07
  So again, you can pick up all those key markets.
• 7:10
  You're seeing the data protection authorities.
• 7:14
  They're also kind of like beginning to enforce the laws,
• 7:18
  imposing fines, enforcement notices, using the
• 7:21
  administrative powers for corrective measures.
• 7:24
  Well, it's not just those things that are actually shaping up the
• 7:27
  market and also having direct correlation with compliance.
• 7:32
  We're also beginning to see litigation in different markets,
• 7:35
  also forcing accountability on, you know, companies.
• 7:39
  But then they're like two different models.
• 7:42
  In a country like Kenya, for example, the court have said you
• 7:44
  have to come to the data protection authority had been
• 7:47
  set before you approach the church, before you approach the
• 7:49
  courts. In a country like Nigeria, for
• 7:52
  example, you pretty much don't have to go through the
• 7:54
  administrative body before you can go through the court system.
• 7:56
  So I think summary of what I've been trying to say is that in
• 8:01
  terms of compliance, if evolving, it's getting more
• 8:04
  mature. But of course, when you look at
• 8:07
  our reports of authorities, you know, there's still like the
• 8:10
  reports indicating that compliance is growing.
• 8:13
  But yes, there's so much that needs to be done.
• 8:15
  I think that's like the story in so many different parts of the
• 8:18
  continent where and compliance is still evolving and compliance
• 8:22
  is different things from, I mean a small sized organisation, a
• 8:25
  medium sized organisation, a large size organisation who have
• 8:27
  the resources to, you know, compliance.
• 8:30
  So you're seeing different or different level of compliance
• 8:34
  across different markets and across different strata or level
• 8:36
  or size of organisations as well.
• 8:39
  I think one key thing is it's evolving.
• 8:41
  The incentives and the prerogative to do the right
• 8:43
  thing is also increasing. And essentially, of course, that
• 8:47
  doesn't take away the fact that, you know, there's still like,
• 8:49
  you know, organisations who don't try to complain and all of
• 8:52
  that. But the generic field of the
• 8:54
  ecosystem is that as far as compliance is concerned, is
• 8:57
  evolving. And of course, there's so much
• 8:59
  work that needs to be done. And we these days see a lot of
• 9:05
  AI talk and AI coming up. Is this bringing a change in the
• 9:11
  mindset? Is this bringing a change in the
• 9:13
  landscape of legislations? How is it happening?
• 9:17
  How? What are the changes you're
• 9:18
  seeing? Absolutely.
• 9:21
  When it comes to AI governance, there's been like, you know, an
• 9:23
  interesting amount of activities on the continent.
• 9:26
  So primarily you look at, I mean no less than two of countries
• 9:32
  that have like specific strategies, no less than three
• 9:34
  have like national policies. We're seeing countries
• 9:38
  introducing things like AI charters, policies, plan
• 9:40
  frameworks, so many also on the pipeline.
• 9:44
  But beyond that we're also seeing countries take the hard
• 9:47
  law approach. So think Angola, Morocco, Egypt,
• 9:52
  Nigeria, these countries at different points have different
• 9:56
  iterations of AI specific laws. And if you also look at a
• 10:00
  country like Ghana, for example, instead of AI specific law, what
• 10:03
  he has, it's what you call like an imagine technologies bill,
• 10:07
  which is imagining imagining technologies more broadly rather
• 10:11
  than zeroing in on AI. And I think it's also like an
• 10:13
  interesting approach because what a country is basically
• 10:17
  doing is you know what it could be AI today, in the next 10
• 10:21
  years, for example, it's probably council computing.
• 10:23
  So rather than coming back here to start going through the racks
• 10:27
  of trying to introduce another technology specific law, how
• 10:30
  come we don't just look at the emerging technologies more
• 10:33
  broadly and then just try to set the principles, set the
• 10:37
  governance framework, which is very close to like a digital
• 10:40
  clearing house model in place before the regulation.
• 10:43
  So we've seen a lot of proposed initiatives to have like an AI
• 10:47
  or an emerging technology specific legislation in
• 10:50
  different African countries and more countries have also
• 10:53
  announced plans like Kenya and Zimbabwe, Uganda, quite a number
• 10:57
  of countries are also announcing plans to sort of deal with AI in
• 11:01
  their own different ways to announce, I'm sorry, to, to, to
• 11:04
  introduce AI laws. But beyond that, you're also
• 11:07
  seeing, you know, efforts to amend existing laws, which means
• 11:14
  basically in some markets and in some of these countries where
• 11:16
  you also have like proposed laws, they're basically not
• 11:18
  waiting for any specific laws. So you're looking at amend the
• 11:22
  expensive video. So Angola is an interesting
• 11:24
  example where the data protection law, for example, is
• 11:27
  being amended and includes specific provisions on AI, like
• 11:32
  what are prohibited AI activities that you can do, What
• 11:35
  are the safeguards, data protection safeguards that you
• 11:37
  need to bake into AI considerations.
• 11:40
  So the proposed amendment includes all of those things,
• 11:43
  but another interesting thing we're also seeing away from, you
• 11:45
  know, trying to go through the hard law is also how existing
• 11:49
  authorities are also doing things around addressing
• 11:52
  different things around AI, whether it's the risk or whether
• 11:55
  it's just issuing warning and safeguard.
• 11:57
  So if you look at sector specific regulators like capital
• 12:00
  market authorities in Nigeria, Mauritius, they have a robo
• 12:04
  advisory guidelines and regulation which is meant to
• 12:08
  specifically deal with instances of companies using the robo
• 12:11
  advisors. And then you have data
• 12:14
  protection authorities who are pretty much playing the role of
• 12:18
  what you call like a de facto regulator in that domain as
• 12:21
  well. We've seen moratoriums imposed.
• 12:24
  We've seen, we've seen a moratorium imposed in Morocco,
• 12:26
  for example against Fisher recognition technology.
• 12:28
  We've seen Senegal deny use of Fisher recognition in workplace.
• 12:32
  You've seen that Kenya suspend a company using yeah, that's,
• 12:38
  that's an AI company, you know, using iris of people biometrics.
• 12:44
  You've seen some DPS issue advisories, published
• 12:49
  guidelines, you've seen them doing public consultation.
• 12:52
  We've seen in Senegal and Cote d'Ivoire.
• 12:55
  So data protection authorities are playing different role and
• 12:57
  the same thing, you know, competition authorities, Product
• 13:00
  Safety regulators in Tanzania, Kenya, Human Rights Commission
• 13:06
  in Nigeria, for example, talking about introducing the guidelines
• 13:08
  and also setting up a desk office to do with the area.
• 13:11
  So just to cap cap it up, a lot of things are actually
• 13:15
  happening, but it's just been shipped in different ways due to
• 13:19
  national priorities and also different countries are taking
• 13:22
  different approach. But definitely we're seeing, you
• 13:26
  know, specific EI regulation coming up or legislation
• 13:30
  proposed EI legislation coming up.
• 13:31
  In addition to that authorities domain regulators, sector
• 13:36
  speculators are doing, you know, different things at different on
• 13:41
  different level. 1. Of course there are also like
• 13:43
  continental initiatives like the African Continental Free Trade
• 13:47
  Agreement, Digital trade Protocol that also has now like
• 13:49
  an emerging technologies and nature which will also be
• 13:53
  enforced alongside which also be key component about the digital
• 13:56
  trade protocol will be enforced. So yeah, a whole lot is actually
• 13:59
  happening on the continent as far as the governance is
• 14:01
  concerned. OK.
• 14:04
  And when you look forward in your work, you're also helping
• 14:10
  people in privacy compliance. What are you seeing in the next
• 14:14
  five to seven years happening in the African privacy space?
• 14:20
  Yeah. I mean, I think well, one
• 14:21
  critical thing in terms of projection definitely will be
• 14:24
  like we'll have and we've seen it already, you're going to
• 14:27
  have, you know, more professionals in the space, in
• 14:29
  the ecosystem, but you know, expertise we also deepen over
• 14:33
  time market to balance out. But beyond that, in terms of,
• 14:37
  you know, as a service provider, what we are also seeing is, you
• 14:41
  know, people, some little few companies already start talking
• 14:45
  about, you know, they've built their privacy programme, they've
• 14:48
  built their security programme, now they're talking about AI
• 14:51
  governance programme frameworks. So we're going to see a lot of
• 14:54
  that. So a lot from some companies are
• 14:56
  actually not waiting for an AI specific law as a key driver or
• 15:00
  as an incentive to start building an AI governance
• 15:03
  framework within their within their organisation.
• 15:06
  So we're seeing that conversations come up.
• 15:08
  And I think in the next 7 years, that's also going to be very
• 15:10
  pivotal. Another thing I think I see is
• 15:14
  we're going to see a lot of, you know, data protection
• 15:16
  authorities getting more mature, computer is growing, but also
• 15:20
  newer challenges evolving which they will have to then deal with
• 15:23
  these newer problems. And you know, you can think
• 15:26
  about more complicated use cases of some of these emerging
• 15:29
  technologies that we probably can anticipate or we're getting
• 15:32
  a little few of them right now. They definitely have to deal
• 15:36
  with those situations, but I think on the on the, on the, on
• 15:42
  the, on the brighter side, it's going to be an interesting one.
• 15:45
  There will be, you know, more interesting problems to solve.
• 15:48
  There are more interesting challenges to deal with.
• 15:51
  But yeah, the ecosystem would definitely get mature.
• 15:54
  We're going to see a whole lot of cross-border collaborations.
• 15:58
  We're seeing a lot of cross-border investigations
• 16:00
  already happening between authorities.
• 16:02
  I mean, it's gradually evolving. We had like a use case of a very
• 16:07
  prominent one between Ghana and I'm sorry we didn't get, we've
• 16:10
  seen Uganda and Kenya last year and we expect to see more of
• 16:12
  this thing. So I think the next 5-7 years
• 16:15
  will be a very interesting one for the continent.
• 16:19
  And what do you tell our listeners?
• 16:22
  Maybe you want to share what exactly do you do and how can
• 16:25
  they reach you or contact you if they want to reach out to you.
• 16:30
  OK, my name is Redwan again. I lead the emerging technologies
• 16:34
  and technology policy team at Tech Advisory Africa.
• 16:38
  Tech Advisories, technology Policy Research firm based out
• 16:42
  of Africa will presence in Estonia, US, Rwanda, Nigeria and
• 16:46
  Kenya. You can check out our websites
• 16:50
  Tech Advisory dot Africa and I'm available on LinkedIn Regional
• 16:54
  lady. We can connect, we can get the
• 16:56
  conversation going. That's wonderful to hear.
• 17:01
  Thank you so much, Arco. It was a pleasure to have you.
• 17:04
  And absolutely, thank you so much for your.
• 17:07
  Business. All right.
• 17:12
  Thank you for joining us on the Fit for Privacy podcast.
• 17:15
  We hope you found today's conversation valuable and
• 17:17
  thought provoking. Subscribe for more insights like
• 17:20
  this. If you enjoyed this episode,
• 17:22
  we'd appreciate that you'd share it and write us a review.
• 17:25
  For consulting, visit www.fitforprivacy.com.
• 17:29
  For certifications and training on ISO standards, visit
• 17:32
  www.growskills.store. You can also contact us for
• 17:37
  bespoke training for your staff and management.
• 17:40
  Until next time, stay safe, stay compliant, and grow your skills.