Reviewing data protection Act of 2021, by Kenneth Lutena

The rise in internet and social media usage has heightened concerns over personal data protection, making it increasingly difficult to secure data once it is online.

In response, Zambia enacted the Data Protection Act No. 3 of 2021.

This legislation, alongside the Electronic Communications and Transactions Act No. 4 of 2021 (ECT Act) and the Cyber Security and Cyber Crimes Act No. 2 of 2021 (CSCC Act), aims to create a secure environment for electronic data communications in Zambia.

The Data Protection Act establishes the legal framework for collecting, processing and disseminating personal data and outlines penalties for non-compliance.

The Act defines personal data as any information that can identify an individual, including names, identification numbers, location data and online identifiers.

However, stakeholders have raised concerns about the Act’s clarity regarding its territorial and material scope.

The law applies to data processing performed either wholly or partly by automated means, as well as processing not conducted electronically.

Under the Act, data controllers and processors must ensure that personal data is collected and processed fairly, lawfully and transparently.

Data must be collected for specific, legitimate purposes and cannot be further processed in ways that are inconsistent with those purposes.

Additionally, data collected must be relevant, adequate, and limited to what is necessary for the intended purposes, known as data minimization.

The Act also mandated that personal data be kept accurate and up to date, requiring data controllers and processors to rectify or erase inaccurate data without delay.

Personal data should be stored in a format that allows for the identification of data subjects only for as long as necessary.

Stakeholders argue that data must be secured against damage, unauthorized access, loss, or destruction.

“Data controllers and processors are responsible for implementing organizational and technical measures to ensure the security of personal data in their possession,” they emphasize.

The Collaboration on International ICT Policy for East and Southern Africa (CIPESA) recently praised Zambia’s efforts to secure data online.

CIPESA, which promotes effective ICT policy and practice for improved governance and human rights in Africa, noted, “The Zambian Constitution under Article 17 provides for the right to privacy, including protection from searches, seizures, and the unlawful disclosure of personal information.”

CIPESA observed that Zambia’s Data Protection Act, 2021, reflects a commitment to uphold Article 17 of the Constitution.

The Act also establishes the Data Protection Commissioner, regulates data collectors, processors, and controllers, and provides rights to data subjects.

“The Data Protection Act is a sign of commitment by the government to implement Article 17 of the Constitution, which provides for the right to privacy,” CIPESA stated.

Enacting this law positions Zambia among a growing number of African countries with specific data privacy laws.

However, CIPESA also noted potential privacy issues. “While Section 3(1) encompasses all aspects that involve the use of personal data, it potentially raises privacy concerns. Subsection 3(2) excludes personal data processing for personal use, but does not define what constitutes personal use, leaving room for misuse.”

In conclusion, the Data Protection Act of 2021 represents a significant step toward safeguarding personal data in Zambia, though challenges remain in defining and enforcing its scope and applicability.

WARNING! All rights reserved. This material, and other digital content on this website, may not be reproduced, published, broadcast, rewritten or redistributed in whole or in part without prior express permission from ZAMBIA MONITOR.