Jean-Francois’s career in ICT spans 20 years mostly in international roles with a focus on public policies and regulatory affairs.

Before joining GSMA as Policy Director for Sub-Saharan Africa in November 2017, Jean-Francois was Regulatory Affairs Director for Africa at Millicom supporting all its Tigo operations across the continentsince 2015.

He shares his thoughts with UgoOnwuaso on the data protection laws in Africa and a whole lot on issues affecting national privacy legislations

You were in Mauritius recently for the Data protection summit; could you tell us the relevance of this summit viz-a-viz absence of data protection law in some African countries?

I think that a fair majority of the African population are concerned that more than 50% of African countries do not have national privacy legislation in place. We are witnessing several governments from around the continent rallying to put such legislation in place with Nigeria, Kenya, Tanzania and Rwanda either amending or seeking to implement the much needed legislation.  We foresee a trend over the next 12 months whereby more African governments will follow suit as data protection laws play a vital role in the safety and security of our continent.

This is important because cross border data flow internationally has a direct impact on GDP growth.  Furthermore, Africa’s digital future will depend on countries that are taking action in order to avoid any violations in data protection laws that could hinder trade or innovation.

About cross border data flow, what arethe challenges of cross border data transfer?

Cross border data transfer has some inherent challenges including the lack of uniform standards and legislationspertaining to protection. Consent would also need to be sought by the person sending the data so that it can be utilized as intended andthe same levels of data protection applied in the countries in question.

This is wherelegal provisionsthat ensure uniform level of protection to the consumerwhen data is transferred within and outside of the country come into play. Regional frameworks are useful for this, and ECOWAS for example, has a supplementary act on data protectionfor this type of transaction.

Could you explain the role of data protection in facilitating the African Single Digit Market?

Data protection is vital in facilitating the African Single Digital Market.If the objective is to have services addressing a variety of African markets at the same time, one needs to make sure that digital services are able to share data across borders.Cross border data costs are really critical to establish the African single digital market and that is where the importance of data protection comes into play.

Looking at GDPR, how would you assess African data protection landscape in view of implementations of European Union Data Protection Regulation (GDPR)?

I believethat the focus on protection and privacy legislation today in Africa is thanks to the external push that we’ve seen through the enforcement and enactment of GDPR. It’s important for African countries to take what is good from GDPR and also pass a solution that’s robust enough to work intheir realities.

Today what’s interesting with the enforcement and enactment of GDPR is that a lot of African governments realize they need to close the gap; equip themselves with national legislation if they haven’t done so and strike a balance between the burdens put on SMEs to register with personal dataregistrars.  This iscompared tothe industryapproach being enforced by theGDPR sothat if a data breach occurs, companies are able to document the level of protection they had in place.

There are also other regional frameworks that are interesting, such as the Asian circular framework which supports cross border privacy rules to enable uniform level of protection in the regions that have privacy legislation in place. There are different models and it’s important for Africa to identify and utilize what is relevant.

Is Africa ripe for continental data protection regulation?

I will defer the question to you as a Nigerian citizen and consumer, are you ready to have your personal data protected? I’m sure your answer will be yes. I imagine the judiciary has embarked on a project to pass a national legislation on data protection. I think it’s in the interest of consumers, businesses, companies, and individuals. Mobile network operators are also keen to have clear rules to abide by.The worst thing that can happen for businesses is when the rules of the game are not clear, orthere is a legal vacuum.So, I think there is a call for the adoption ofgood, smart national privacy legislation and options to make sure that data can flow and fuel the digital economy.

Today there’s a mobile economy in sub-Saharan Africa made up of 440 million unique mobile subscribers. This is larger than $10 billion in terms of economic value last year and its 7.1% of sub-Sahara Africa’s GDP.

The mobile and digital economies haveanopportunity to play a strong role in our region. Internet subscribers have quadrupled in the region since 2010so mobile is really transforming lives in an increasingly connected world.

Looking more specifically at what it means for the data economy, and international data flows have increased the global GDP by 10% and if we  consider their contribution to a new global GDP which is expected to be around 2.8 Trillion, it’s a larger share than the global trade in goods.

Coming back to your question about the African single market, its digital dimension has a high probability to groweven quicker than the physical goods component which has been historically low in Africa.

You talked about data privacy, what should we do in order to create data management framework that will protect citizen’s privacy?  

On one hand, we havethe legislation and the regulatory framework but another important factor is the actual data management and how companies go about it.

I will go back to the Asian model I was referring to earlier. The cross border privacy rule is a model or approach where companies can commit to each other, even though there is no national legislation on what level of protection they will give to data protection.The data management framework which you’re referring to, can be set up in the private sector in practical ways.

I think it’s also important for governments and we usually insist that the rules of data protection are the same for private businesses and government alike.  This is because we see in some legislative projects different sets of obligations applicable to private and public sectors. Itneeds to be a cross cutting, andoverarching approachwith rules applicable to both because I forecast that data management frameworks will have to talk to each other.

What are some of the adverse effects, if Africa does not create a strong data protection landscape?

Absence of a conducive and smart data privacy law implemented ora protectionframework will hinder trade and innovation. Mobile and digital technology presents a lot of opportunity for growth across the African continent. It is providing a platform for innovation, creating new companies, new services and providing employment opportunities.So in order to be able to join the fourth industrial revolution data protection needs to become a reality.Furthermore, we need to be able to leverage the economic power with reference to data growth.Regulating people’s informationwith a patchwork of geographically born privacy laws will only restrict how African companies can innovate and bring better products and services to consumers in the future.

It’s an important time for all countries to take actions to bridge the differences in their privacy regulations if any, and to acknowledge the fact that a regional approach is important in the process to equip themselves with national legislation. So embracing the existing regional privacy framework is very important and working towards a Pan African approach to data privacy is critical to protecting the rights of individuals and unlocking their economic potential.

Where do you see Africa in the next few years with regards to data privacy policies?

I wish to see all African countries havingtheir data privacylegislationsenforcedand I’m confident that we will see in the very near future, a significant number of African countries passing privacy legislations.

There is a need to update data frameworks, as some of them have remained in use for over 10 years.

Regional economic communities will also have an opportunity to review those frameworks and provide a new template for the remaining countries to adopt national legislation.

There is anongoing discussion around which level of data localization should be implemented and the value of cross border data flows. I think it’s easier for neighboring countries to recognize the value of those cross border data flows, so ECOWAS started it and we hope that in otherAfrican countries where no regional framework has been adopted yet, one will be put into place soon.

The question has also been raised as to the slow pace of signatories joining the African Union core convention on cyber security and professional data protection.Whether International public law instruments are the right solution because of the heavy processfor adoption, what opportunities exist for more modern legislations orfast law approaches to supplement at aPan- African level and what can be done to speed up the process?The right answers to these questions canbe explored by the network of African data protection authorities and these answers couldshape discussions moving forward.

In Nigeria, there is a litany of information silos here and there, they not harmonized. How can all of these data sets be harmonized and protected?

I think you are referring to data collected by multiple agencies. The general challenge in data protection and privacy is that when you interconnect different data sets, the rule that’s applicable to one data set is sometimes not sufficient to guarantee the interconnection of a variety of data sets. Therefore, for data sets to be combined,  it’s important to review the situation for the data subject – the owners of the personal data – and it’s important that they are aware,so that there will be a more general approach to the pursuit. This is why those principles need to be enshrined in national legislation.