International transfers of personal data and international co-operation

Common to every country in the world, is the flow of personal data across borders. Data flows have a vital role in modern digitally connected societies helping to foster social and economic progress, from eCommerce and finance, to health care, to social media and instant messaging services, to apps for news and apps just for fun. It is vital that while data flows support innovation and progress, risks to the fundamental rights and freedoms of individuals are appropriately considered and safeguarded.

While 145 countries have adopted data protection laws not all of these provide for their territorial scope, international transfers of personal data, adequacy of other countries data protection laws, or international co-operation in an equivalent or interoperable manner. Moreover, not every country that has adopted a data protection law has established an independent data protection authority.

32 African countries have so far adopted data protection laws with at least currently five further countries progressing draft data protection bills. These developments are shaped by national, regional and international data protection frameworks and by digital economy policy objectives and initiatives, including the African Continental Free Trade Area (AfCFTA) agreement. Cross border transfers are of vital importance in many ways across the continent of Africa and beyond.

This workshop seeks to explore key challenges, issues and considerations related to the transfers of personal data between African countries and beyond the continent of Africa. The workshop will also explore the status of co-operation between African data protection authorities (DPAs) and between those authorities and DPAs in other regions.

The workshop will ask what is working well? How can key concerns and challenges be best addressed? For example, are there opportunities for strengthening co-operation on developing best practice on international transfers - from risk-based criteria and standards to tools for ensuring transfers achieve an appropriate level of protection (through model contracts or risk assessments and audit mechanisms?). Can and should African DPAs rely on the cross-border transfer standards of other regions? How can DPAs best co-operate on enforcing rights and freedoms across borders? These are some of the topics the workshop will explore.

Speakers for this workshop include:

Olufemi Daniel is a lawyer and desk officer and head of Regulations Monitoring and Compliance at the National Information Technology Agency, Nigeria. He is also Vice Chair of the African Union's technical working group on Data Protection Laws Harmonisation under the AU Policy and Regulatory Initiative for Digital Africa (PRIDA). Olufemi will speak on a harmonisation framework developed under PRIDA and which was tested in Ghana, Morocco, Zambia, Mauritius and Gabon and will in particular, relate the initiative to cross border transfers and regulatory co-operation within and outside of Africa.

Grace Githaiga is a respected advocate for data protection and privacy and broader human rights, and is a convenor at the multi-stakeholder ICT Policy and Regulation advocacy think tank, KICTANet. Grace is also host and moderator of Take on Tech, a weekly TV talk show at the Kenya Broadcasting Corporation. Grace will speak on the regulation of cross border transfers in the context of Kenyan data protection law and the realities of digital services such as fintech apps for example and that test cross border provisions and international co-operation.

Prof. Alex B. Makulilo is a Postdoctoral Research Fellow at the Institute for Information, Health and Medical Law (IGMR), Faculty of Law at the University of Bremen in Germany. Prior to that Prof. Makulilo worked as a Senior Lecturer of Information and Communications Law at the Open University of Tanzania, an academic rank he still holds today. Prof. Makulilo has written extensively on data protection law in Africa and is editor of the book 'African Data Privacy Laws' (2016). Prof. Makulilo will speak on the status of International transfer provisions in African data protection laws and the criteria by which cross border transfers of personal data might be considered to provide an appropriate level of protection for privacy and other fundamental rights and freedoms of individuals.