For many of us, sharing personal data online whenever we do things like access free software trials, join social networks, sign up for newsletters or even register to attend events has become as natural as inhaling oxygen and exhaling carbon dioxide.
I am seldom conscious of my breathing, and I’m embarrassed to admit that I rarely think twice before giving up my particulars online, unless of course requests are made via a random web-form that pops up while I’m surfing the net, or by way of a dodgy unsolicited e-mail or text message.
That’s why it’s sobering to realise that personal data is at the heart of an international scramble to assert national sovereignty on the internet.
As more of our lives are "lived" online, countries around the world are seeking to protect their citizens against digitally-perpetuated abuse and criminal activity.
In a recent conversation I had with Dr Vukosi Marivate, a data scientist and senior researcher at South Africa’s Council for Scientific and Industrial Research, he highlighted the growing need for South Africa and other African governments to regulate and police the use of personal data in order to defend individual constitutional rights.
Marivate explained that from a public due diligence standpoint, government’s key objective is to provide South Africans with an accessible legal framework for pursuing recourse in the event that they are negatively impacted by the unlawful or negligent use of their personal data.
Meanwhile, according to Alison Treadaway, a director and shareholder of Striata, South Africa needs to enact data protection laws if the country is to remain a viable investment destination in today’s increasingly digital world.
Treadaway reckons the opportunity cost of the country’s legal frameworks failing to adapt to technological innovation and thus falling out of step with data protection regimes of its major trading partners is beyond estimation.
Read also: Online obscurity is big business
One only has to do a quick survey of global headlines over the last year or so to gauge the seriousness of some of the world’s most powerful countries with regards to enforcing data protection laws.
Case in point, Russia’s communications regulator Roskomnadzor shutting down access to LinkedIn in November 2016 when the social media platform failed to comply with regulations requiring them to host the personal data of their Russian subscribers on servers hosted in the country.
Similarly, there are some multi-national corporations that have sought legal relief to prevent governments from violating their customers’ right to privacy.
A case involving Microsoft and the US government that began in 2013 ended in a surprise win for the former back in July 2016, when a federal court ruled that Microsoft would not be required to comply with a warrant to seize users’ e-mails if the data was not stored in the US.
The US government had dragged Microsoft to court to try and force the software giant to hand over e-mails needed to aid national security-related investigations.
The catch was that while Microsoft could easily provide the FBI access to those e-mails, their lawyers successfully argued that because they were stored on Irish servers, they were out of the FBI’s jurisdiction despite Microsoft being an American company.
These are just two of several high-profile international incidents that demonstrate how data protection legislation, when present, serves to regulate the fair and proper use of personal data.
It is in this context that the imminent enaction of South Africa’s ground-breaking Protection of Personal Information Act (PoPI) is to be understood and appreciated.
PoPI will undoubtedly have a substantial economic impact on South Africa’s private and public sectors as they gear up to comply with the new laws, but it will certainly address many pain points that other African countries will likely seek to remedy through the passing of data protection legislation of their own.
Andile Masuku is a Zimbabwean broadcaster, creative strategist and entrepreneur based in Johannesburg.