Yellow Card: Nigeria, Kenya lead in data privacy enforcement in 2024

Guardian Nigeria

Watch Yellow Card: Nigeria, Kenya lead in data privacy enforcement in 2024 - Guardian Nigeria on Dailymotion

Transcript

00:00Nigeria and Kenya were at the forefront of data privacy enforcement in the year 2024.

00:05That's according to Yellowcard's 2025 report on data protection in Africa, highlighting

00:10that 39 out of 55 African countries have implemented data protection laws, a significant step towards

00:16creating a more secure digital environment.

00:19Looking ahead, the Pan-African FinTech Company notes that the increased focus on cross-border

00:24data flows, along with a concerted effort to protect children's online safety, are

00:29likely to be key areas of growth and transformation this year.

00:32Thelma Okoriye, the Group Data Protection and Privacy Council at Yellowcard, joins me

00:37now to unpack the report and their key predictions for the continent.

00:42Thank you so much for your time today, Thelma.

00:43I hope I did a good job with running through the overview of the key findings there.

00:48But I'd like to get your input here as well and talk about some of the key takeaways from

00:51your research and which trends you would say stand out the most.

00:57Thank you very much.

00:59The report was basically an overview of what we have in the African data protection landscape.

01:05And like you rightly said, about 39 out of 55 have data protection laws, with 34 of those

01:12countries which have enacted data protection authorities.

01:18So over the past decade, data protection has changed significantly as the continent becomes

01:24more connected to the global digital economy.

01:28Countries and individuals have seen the need and the necessity of having privacy laws to

01:33protect data of individuals.

01:37Now because of this connectivity, we have to ensure that there's awareness and the ability

01:42to protect data.

01:44But however, unlike what we find in the European space, which is the GDPR, the General Data

01:51Protection Regulation, that covers the whole of Europe, Africa tends to have a fragmented

01:57approach with each country having its own laws.

02:00So you find that when investors want to come to Africa, or companies that have multiple

02:07branches in different African continents, they have multiple laws to contend with.

02:12So there's the different countries, Nigeria has its own data protection law, Kenya has

02:18its own, South Africa has its own, and you find that there's like slight differences

02:23in these laws, which make it a bit more complex to comply with, as opposed to a company that's

02:30operating in Africa.

02:33And what we also see is things like cross-border data transfers, which means transferring data

02:39from one country to another.

02:42You also find that there's some laws that need, differences in the laws that need to be

02:49complied with, because each country says that you need to only send the law, or send the

02:55data to a country that has similar or adequate laws.

02:58So if a country, if country A has lesser protection for personal data, you find that it's harder

03:06to send data to that country, thereby impeding business flow or flows between the, between

03:15organization or branches of organizations.

03:18Another thing that we noticed in the 2025 report is like you said, sector specific regulations.

03:25Now this means that countries are tending towards bringing out laws for each sector.

03:31So something like the healthcare sector that deals with really sensitive data, they have

03:36higher restrictions and higher compliance levels.

03:40Also finance, financial information are also, they also have a higher threshold of protecting

03:48the data in their, in their records.

03:51Tell me, for the countries that are doing quite well, you mentioned Kenya, Nigeria,

03:56in terms of data privacy enforcement here, what would you say are some of the specific

04:01actions these countries are taking that sets them apart, and what can other countries learn

04:05from that experience?

04:06Sorry, could you repeat that?

04:10What would you say are some of the specific actions countries like Kenya and Nigeria are

04:14taking that sets them apart, and what can other countries learn from their approach?

04:20Okay.

04:21So a big thing that you find with Nigeria and Kenya is enforcement.

04:26Now it's one thing to have the laws, it's another thing to enforce these laws.

04:30And because Nigeria and Kenya and also South Africa have taken the additional step of starting

04:38to enforce the laws.

04:40Like last year, you see that Nigeria fined META for breaching data protection laws of

04:49Nigerian residents.

04:50There was this whole not having consent, and basically not complying with the data protection

04:54laws applicable in Nigeria.

04:57So it was said that META was giving the European nations a higher threshold of protection than

05:02what was applicable in Nigeria, and there was a huge fine on META for that.

05:07But you also see that Kenya also fines companies that also breach data protection laws.

05:12So you find that when there's enforcement in place, it encourages people to comply and

05:19it increases investors' trust in the country that they are working with.

05:25So because if there's no enforcement, there's basically no need for the law because it has

05:29to be in place for people to comply and protect the data of their citizens.

05:33All right, because now my next question to you is a bit tricky, because when you look

05:37at the lay of the land, we're definitely going to see increasing cross-border data flows

05:42happen.

05:43There's no way to stop that.

05:44The world is evolving in that direction.

05:46But how should African regulators on the one hand then balance data sovereignty on one

05:52hand with foster innovation in the midst of cross-border trade?

05:58Yeah, that's definitely a tricky question.

06:02It's even something that is being considered right now in Nigeria and other African countries.

06:07We see countries like Algeria have enacted some similar, some sense of data sovereignty

06:13requiring their laws to remain within their borders.

06:17Now, anything, once you hear data sovereignty, you know it's going to basically seem like

06:24an impediment to the innovation and flow or free flow of business and free flow of information.

06:31Because most companies and most international companies that come to the country or come

06:36to Africa to invest expect to be able to basically process their data in maybe one place for

06:44ease of doing business.

06:46So if you have a country that has multiple branches in different continents or different

06:50regions, most times they have like a dedicated office that processes the data that they use

06:56in the business.

06:57Now, meaning that they need to be able to mine data out of whichever country they're

07:01investing in and take it to where they need to process it.

07:05So for balance, we can say that we understand some data is quite sensitive, maybe things

07:13dealing with national security, things that have to do with government data, things that

07:18have to do with, that will affect the economy of the nation.

07:22So those kind of data can be mandated to be stored within the country.

07:28But when it comes to maybe personal data of customers, that can, now we can strike the

07:34balance and say, okay, that can also leave the borders, but ensure that wherever it's

07:39going to, it has adequate protection and the data will not be subject to unnecessary hacks.

07:45It will be secure, it will be confidential.

07:49So that's a good way of striking a balance between innovation and data sovereignty.

07:53All right.

07:54Thank you so much for that input today.

07:55Thelma Onkori, there's the Group Data Protection and Privacy Council at Yellowcard.

Category

Transcript

Recommended