Data Protection Regimes in Africa: too far from the European ‘adequacy’ standard?

Over four decades of the development of data protection laws, the world has witnessed data protection regimes finally arriving in Africa. At present, there are eleven African countries out of 54 with comprehensive data protection legislation. These are Cape Verde (22 January 2001), Seychelles (24 December 2003), Burkina Faso (20 April 2004), Mauritius (17 June 2004), Tunisia (27 July 2004), Senegal (15 January 2008), Morocco (18 February 2009), Benin (27 April 2009), Angola (17 June 2011), Gabon (25 September 2011), and Ghana (10 February 2012). At the same time, in an attempt to harmonize the emerging national data protection legislation and perhaps to prevent disruption of flow of personal data, in 2010 the Economic Community of West African States (ECOWAS) adopted a sub-regional framework for its member states. In contrast, in the same year the East African Community (EAC) adopted data privacy recommendations for its members. While these recommendations do not stipulate substantive data protection principles as is the case with most other sub-regional and regional codes of data protection, they intend to encourage the member states to align with the international best practices. The Southern African Development Community (SADC) and the African Union (AU) are still considering drafts of data privacy instruments. As is the case elsewhere, the emerging data protection regime in Africa is partly influenced by the European Union Data Protection Directive 95/46/EC. The international regime for the transfer of personal data contained in the Directive 95/46/EC, particularly Articles 25–26, is most frequently cited by commentators as one of the forces behind this development. Article 25 of the EU Directive restricts the transfer of personal data to third countries, that is non EU/EEA countries, unless such countries afford an ‘adequate’ level of data protection. However, under Article 26 of Directive 95/ 46/EC personal data may still be transferred from EU/ EEA to third countries even if such countries fail to pass the ‘adequacy’ test. Yet, this is only a limited option as it is a derogation from the main rule in Article 25 of the Directive. Undoubtedly, the requirements of Article 25 of Directive 95/46/EC necessitated the above four African