• Amanda Manyame

Interview with Ridwan Oloyede

How can the right to privacy in Article 12 of the United Nations Declaration of Human Rights be protected and enforced in countries that do not have national privacy frameworks?

Ridwan Oloyede: That would really be a difficult country to live in. It is quite tricky because privacy ranks high up there with other human rights. It helps safeguard other rights like expression, dignity of human person, association and even movement. Countries without privacy protection, either in their constitution or in a specific law leave their citizens vulnerable to immeasurable levels of risk. Privacy violation exist in countries with strong laws, it gets worse in countries with none. There are, however, situations where the right to privacy is guaranteed in the Constitution of such a country, but they fail to have a specific law or privacy or data protection – which is the case in a number of African countries. The trend observed is that people approach the national court using the constitutional right to privacy broadly or, in the event the country is a party to a regional instrument, approach such regional court to enforce the right.

In light of the track and trace measures being implemented in many countries, how can privacy- respecting track and trace systems be designed and implemented in an African context, considering the lack of access to technological devices?

Ridwan Oloyede: We cannot develop an efficient track and trace ignoring our reality. Wide digital divide and access is still a big problem on the continent. A contact tracing system that ignores that is bound to fail. The next questions will be whether the centralised or decentralised model is best and if it is voluntary. In our context, a decentralised model will come close to taking cognisance of our reality or, a model that could possibly do away with capturing any personal data. The use of the app should be voluntary and the design should acknowledge the principles of data protection and respect human rights. There are African countries that have adopted contract tracing like Ghana and Botswana. In Botswana, the government made it compulsory and uses a centralised model. Botswana has a Data Protection Act but is yet to set up a supervisory authority, it could be dangerous, with limited avenues for transparency and accountability. Finally, I think contact tracing is an important aspect of epidemic responses, but it is not a stand-alone solution, it should be augmented with efficient physical tracing.

To what extent can African privacy-law frameworks be harmonised post COVID-9 to

strengthen the right to privacy on a continental level?

Ridwan Oloyede: There is a case for harmonisation of privacy frameworks on the continent. It becomes more important in order to unlock and harness the digital economy potential of the African Continental Free Trade Agreement, with immense cross-border transfer of personal data. Harmonisation will be close to an ideal solution, but we are currently in a continent divided along the lines of countries with data protection laws and with a data protection authority; those with data protection laws and yet to set up a data protection authority; and those without data protection laws. It is also important to point out that though there are common grounds in these laws, they are different on some material provisions. The conversation around harmonisation will begin from more countries ratifying the African Union Instrument, but we should not also ignore the fact that our law making process is different from the EU, for example and the Convention will not work like the GDPR. In my opinion, the convention is due for a protocol to stay abreast with current trends. Finally, strengthening the right on the continent will be impossible if more countries do not adopt a national law.

Please highlight some of the privacy concerns that have arisen during the COVID-19 pandemic and that have potential to remain post-pandemic without adequate privacy-frameworks.

There is the fear that the data could be stored beyond the pandemic and could be repurposed. Some urgent measures that would be considered intrusive in normal time could remain; one is that voluntary surveillance measures could be made compulsory for public and social engagement. There is also fear around increased health monitoring by employers.

Congratulations on the publication of the Guide on Data Protection by Design. Please share with us why privacy and security by design are important, particularly during a pandemic.

Ridwan Oloyede: They are effective safeguards to protect the rights and freedoms of data subjects. It aids compliance with data protection legal frameworks, reduces possibility of data breaches and its attendant costs which could mean fines, cost of litigation, loss of revenue and trust and reputational damage. Ultimately, it helps in building consumers’ trust.

Ridwan leads the privacy and data protection team at TechHive Advisory, Nigeria and is a

Research Fellow at the African Academic Network on Internet Policy (AANOIP). He also works around technology policy and research, data ethics and cybersecurity. Ridwan advises on aspects of global data protection and privacy laws.