The proposed data protection bill is not up to standard concerning fundamental rights, freedoms, as well as privacy
Addressing the room early on 22 August 2023 on behalf of the Ministry of Information, Communication and Technology (MICT), as she opened what was called a validation workshop for the latest version of the data protection bill, Linda Aipinge, director of ICT Development, stated:
“[The bill] aims to protect the individuals’ fundamental rights, freedoms, as well as privacy.”
This statement was in keeping with the guiding principles captured in the National Cybersecurity Strategy and Awareness Raising Plan 2022 – 2027, which notes that Namibia is committed to enhancing its obligations to “respect universally agreed fundamental rights, including, but not limited to, the United Nations’ Universal Declaration of Human Rights and International Covenant on Civil and Political Rights, as well as relevant multilateral or regional legal frameworks”.
In this context, the government admits that special “attention should be paid to freedom of expression, privacy of communications and personal data protection”.
Going further, the National Cybersecurity Strategy Framework, consisting of six pillars, positions “Privacy and Personal Data Protection” as pillar one, and prioritises the finalisation of the draft data protection bill under pillar three (Enabling Legal Framework and Enforcement).
A confidential assessment of the strategy done for the Institute for Public Policy Research (IPPR) by an international human rights organisation in 2022 expressed praise for the high level statements on privacy and personal data protection.
All this is to note that while the Namibian government, in statement and strategy, has expressed a commitment to upholding, protecting and enhancing “individuals’ fundamental rights, freedoms, as well as privacy” in the digital and cyber sphere, according to critical assessments this commitment falls short in the draft data protection bill that was being validated in August 2023.
Missing rights
One of these assessments, done by South Africa-based ALT Advisory in October 2022 for the IPPR and the Access to Information in Namibia (ACTION) Coalition, found that the current version of the bill, still dated 2022, severely waters down the rights of data subjects in comparison to earlier versions of the bill from 2020 and 2021.
In fact, the earlier versions of the bill contained a Part 3 titled “Rights of the Data Subject”, which does not appear in the latest draft bill.
This Part 3 contained provisions explicitly speaking to the following rights: Right to know and access; Right to rectification, erasure, restriction of processing; Right to object; Right not to be subject to automated decision making, including profiling; Right to obtain assistance from a supervisory authority; Representation of the data subject; and, right to compensation.
In the 2022 version of the bill Part 3 has become “Obligations of Controllers and Processors”.
Questioning this erasure of the rights of data subjects, ALT Advisory recommended: “The Bill should reintroduce Part 3 of the 2020 version of the Bill as a new Part 2 in the present Bill, with the “Data Protection Supervisory Authority” part becoming a new Part 3. This will correctly give prominence to the primary rights holders in the Bill: data subjects.”
Here it should be pointed out that the ALT Advisory recommendation was in line with a 2020 “Statement of Intent on the development of a Data Protection Act” for Namibia that preceded and informed the current drafting process.
This statement of intent clearly states that the objective was “to inform the development of a Data Protection and Privacy Act (“Data Protection Act”) to protect the fundamental rights and freedoms of natural persons, and in particular, their right to privacy with respect to the processing of their personal data”.
Other rights that the current version of the bill does not take into account are the rights of journalists, writers, academics and artists as data processors, and in this regard ALT Advisory recommends: “An express exemption for journalistic, literary, or artistic purposes should be recognised in the Bill, either in section 34(1)(f) or section 43, and should provide that “The Act does not apply to the processing of personal data solely for the purpose of journalistic, literary, or artistic expression to the extent that such an exclusion is necessary to reconcile, as a matter of public interest, the right to privacy with the right to freedom of expression, including press freedom.” (Additionally, an express exemption for processing personal data for academic purposes, with sufficient safeguards, should be considered by MICT)”
Additional concerns
Another flagged aspect of the current version of the draft data protection bill is that it also erases the independence that was accorded the envisioned Data Protection Supervisory Authority in earlier drafts.
In this regard, ALT Advisory recommended: “Part 2 of the Bill needs to be substantially redrafted in line with the 2020 version of the Bill to ensure that appointments, removals, and the remuneration of board members of the Supervisory Authority are determined by Parliament as opposed to the Minister, and that board members, including the chairperson and the vice-chairperson, are afforded security of tenure and are shielded from undue political influence.”
“Additionally, in appointing board members, Parliament should be directed to seek public nominations before initiating any appointment processes.”
These spotlighted shortcomings and recommendations of fixes, along with a raft of others, were submitted to MICT at the end of last year when a call for submissions was made. Similar and complementary issues were also flagged by the Legal Assistance Centre (LAC) in a submission around the same time.
Notably, these concerns and issues remained largely unaddressed by the validation exercise that played out on 22 and 23 August, and the question among some following the processes surrounding the draft data protection bill remains whether they were given any fair consideration at all in the intervening months.
– Frederico Links is a Namibian journalist and researcher. This article was commissioned by the Media Policy and Democracy Project (MPDP), an initiative of the University of Johannesburg’s department of journalism, film and TV, and Unisa’s department of communication science.
– A shorter version of this article appeared in The Namibian newspaper on 25 August 2024.
