IGF 2020 WS #256 Repurposing privacy protections for Africa

Description:

As access to the Internet grows (albeit slowly in some regions), the amount of data that is produced and transferred is also growing. As we work on bridging digital divides and connecting more people, we therefore also have to work on putting the right governance frameworks in place to protect them and uphold their rights once they are able to connect. In most African contexts, however, the ways in which we opt to govern data extraction processes tend to neglect lived African experiences, whilst prioritising governance frameworks developed elsewhere. Domesticated data protection regimes are spreading across the African continent, many of which are significantly influenced by the EU General Data Protection Regulations (currently, 32 African countries have data protection laws, with an additional 5 currently being drafted). The efficacy of standard data protection laws have been questioned, as they focus on individualised forms of protection such as notice and consent (which extends to recourse opportunities, too). In addition, these protections are even more strained in their utility amongst vulnerable groups, which include marginal Internet users. In Africa, strong regional frameworks exist in relation to human rights more broadly, for instance the African Charter on Human and People’s Rights, and the African Declaration of Principles on Freedom of Expression and Access to Information in Africa. These have contributed significantly to the third generation of human rights discussions on collective rights. And it is the nature of communal rights, which also contributed to public and communal benefits of both data access and data protection, that could be extended to consider more context-specific solutions to data privacy. These frameworks provide a useful basis for underscoring governance regimes of data, but can also be used as a normative foundation for exploring alternative solutions to current data protection regimes within the region. This is necessary as the regional context offers some unique lived realities for citizen data protection that did not inform European and American data protection design. In Africa, public sector collection of citizen data is significant (especially in the context of growing calls around Digital ID and other citizen identity programmes). And in relations between the state and citizens, particularly where social provision is at stake, marked incentives are visible that render the ability to consent superfluous (not least of all because many state-centred data collection activities can be outside data protection regimes, or might occur in regional contexts without specific data protection laws). In this session, we adopt a collaborative, multi stakeholder approach and aim to first set the scene by discussing prevailing conditions, before evaluating possible practical solutions to some of these challenges. The proposed Agenda is thus: a) Introductory discussion of context by speakers (10 minutes), b) Define regional singularities (20 minutes), c) Ideate practical interventions on data protection for vulnerable groups (20 minutes), and d) Discussing practical next steps for action (10 minutes).