BY FREDERICO LINKS
Linda Aipinge, the director of information and communication technology (ICT) at the Ministry of Information and Communication Technology, says the data protection bill aims to protect the individual’s fundamental rights, freedoms and privacy.
She said this at a two-day workshop on the bill, which took place on Tuesday, August 22, 2023.
This statement was in keeping with the guiding principles captured in the National Cybersecurity Strategy and Awareness Raising Plan 2022 to 2027, which notes that Namibia is committed to enhancing its obligations to “respect universally agreed fundamental rights, including, but not limited to, the United Nations’ Universal Declaration of Human Rights and International Covenant on Civil and Political Rights, as well as relevant multilateral or regional legal frameworks”.
In this context, the government admits that special “attention should be paid to freedom of expression, privacy of communications and personal data protection”.
Going further, the National Cybersecurity Strategy Framework, consisting of six pillars, positions privacy and personal data protection as pillar one, and prioritises the finalisation of the draft data protection bill under pillar three.
A confidential assessment of the strategy on behalf of the Institute for Public Policy Research (IPPR) by an international human rights organisation in 2022 expressed praise for the high-level statements on privacy and personal data protection.
All this is to note that while the Namibian government, in statement and strategy, has expressed a commitment to upholding, protecting and enhancing individuals’ fundamental rights, freedoms and privacy in the digital and cyber sphere, this commitment falls short in the draft data protection bill which was being validated in August.
MISSING RIGHTS
One of these assessments, done by South Africa-based ALT Advisory in October 2022 for the IPPR and the Access to Information in Namibia (Action) Coalition, found that the current version of the bill severely waters down the rights of data subjects compared to earlier versions of the bill from 2020 and 2021.
In fact, the earlier versions of the bill contained a ‘Part 3’, titled ‘Rights of the Data Subject’, which does not appear in the latest draft bill.
This part contained provisions explicitly speaking to the following rights: the right to know and access, the right to rectification, erasure, restriction of processing, the right to object, the right not to be subjected to automated decision-making, including profiling, the right to obtain assistance from a supervisory authority, representation of the data subject and the right to compensation.
In the 2022 version of the bill ‘Part 3’ has become ‘Obligations of Controllers and Processors’.
Questioning this erasure of the rights of data subjects, ALT Advisory recommended that the bill reintroduce ‘Part 3’.
Other rights the current version of the bill does not take into account are the rights of journalists, writers, academics and artists as data processors.
In this regard, ALT Advisory recommends that an express exemption for journalistic, literary, or artistic purposes should be recognised in the bill.
ADDITIONAL CONCERNS
Another flagged aspect of the current version of the draft data protection bill is that it also erases the independence that was accorded the envisioned data protection supervisory authority in earlier drafts.
In this regard, ALT Advisory recommended: “Part 2 of the bill needs to be substantially redrafted in line with the 2020 version of the bill to ensure that appointments, removals, and the remuneration of board members of the supervisory authority are determined by parliament as opposed to the minister and that board members, including the chairperson and the vice chairperson, are afforded security of tenure and are shielded from undue political influence.
“Additionally, in appointing board members, parliament should be directed to seek public nominations before initiating any appointment processes.”
These spotlighted shortcomings and recommendations of fixes, along with a raft of others, were submitted to the ministry at the end of last year when a call for submissions was made.
Similar and complementary issues were also flagged by the Legal Assistance Centre in a submission around the same time.
Notably, these concerns and issues remained largely unaddressed by the validation exercise that played out on 22 and 23 August, and the question among some following the processes surrounding the draft data protection bill remains whether they were given any fair consideration at all in the intervening months.
* Frederico Links is a Namibian journalist, researcher and presently serves as the chairperson of the ACTION Namibia Coalition which is synonymous with the campaign for access to information in Namibia. This article was commissioned by the Media Policy and Democracy Project, an initiative of the University of Johannesburg’s Department of Journalism, Film and TV, and Unisa’s Department of Communication Science.
