Understanding Ethiopia's Personal Data Protection Proclamation

💡

Filling a Legal Gap: Addresses the absence of comprehensive data protection laws.
Mitigating Breaches: Aims to control and prevent personal data breaches.
Digital Economy: Essential for digital transformation, fostering trust, and economic growth.
Effective Remedies: Provides solutions for data rights violations.
International Alignment: Facilitates cross-border data transfer opportunities.

📜

Personal Data: Any info identifying a natural person (name, ID, location, etc.).
Sensitive Personal Data: Race, health, genetic, religious beliefs, criminal records, etc.
Profiling: Automated processing to evaluate personal aspects (work, health, behavior).
Scope: Applies to automated and non-automated processing by private & public institutions within Ethiopia.
Exemptions: Personal/household activities, government investigations, transit data.

⚖️

✅

🔒

Sensitive Data: Generally prohibited, with strict exceptions (explicit consent, vital interests, legal proceedings).
Racial/Ethnic Data: Only if necessary for fairness/equality with protection.
Minors (Under 16): Requires parent/guardian consent or vital interest; marketing, profiling, or combining profiles of minors is prohibited.

👤

Right to be Informed: Clear info on data processing.
Right of Access: Confirm processing, access data, source, retention.
Right to Rectification: Correct inaccurate/incomplete data.
Right to Erasure ("To be Forgotten"): Request deletion if no longer needed or unlawfully processed.
Right to Object: Oppose processing, especially for direct marketing.
Right to Restriction: Limit processing in certain cases.
Right to Data Portability: Receive data in structured format, transfer to another controller.
Privacy After Death: Rights extend 10 years after death, exercisable by heirs.

👨‍💻

Registration: Must register with the Authority (Ethiopian Communications Authority).
Data Protection Officer (DPO): Required for public authorities, large-scale processing, or sensitive data.
Technical/Organizational Measures: Implement security, record-keeping, DPIAs, etc.
Data Breach Notification:
- To Authority: Within 72 hours of awareness.
- To Data Subject: Within 72 hours, unless exceptions apply.
Data Protection by Design & Default: Process only necessary data; anonymization, pseudonymization.
Data Deletion: Delete data as soon as retention period expires.

🌍

Domestic Storage: Personal data collected in Ethiopia must be stored on local servers/data centers.
Critical Data: Authority identifies "critical personal data" for Ethiopia-only processing.
Sensitive Data Transfer: Requires Authority's prior authorization.
Adequacy of Protection: Transfers to other countries only if they ensure an "adequate level of protection."
Authority's Power: Can prohibit or impose conditions on transfers.

🚨

Authority's Powers: Issue orders, investigate, manage registers, impose administrative penalties.
Complaints: Data subjects can file written complaints.
Administrative Penalties: Up to 4% of institution's total sales turnover for severe/institutional/sensitive data violations.
Criminal Offenses:
- Failure to report breaches/measures: 1-3 years imprisonment or 60,000-100,000 Birr fine.
- Failure to respect rights: 3-5 years imprisonment and 100,000-200,000 Birr fine.
- Unlawful re-identification/sale/transfer: 5-10 years rigorous imprisonment and 200,000-600,000 Birr fine.
Transitional Provisions: Pre-enactment data must comply with new rules.

Cassation Ethiopia