Data Protection Law as a Contested Space - Nelson Otieno

Henrick Ibsen’s play, Enemy of the People, presents Dr Stockmann as a character. Dr Stockmann, my favourite character, is not only a medical doctor, a critical thinker, and a challenger of the status quo. At Act number 4 of the play, Dr Stockman informed a gathering at a large Hall in Captain Horster’s house that the ‘eyes of his mind’ opened and, through it, he saw the ‘colossal stupidity of the authorities’.

This play has been on my mind as I have examined my data protection practice. Data protection practitioners often go through a reality check at some point - something akin to the infamous midlife crisis. When the check occurs, the eyes of their minds open, through which they reconsider some social justice questions. They wonder whose power influences the categories of data to be protected and making of the data protection law? They also ask what forces are behind the ‘when’ and ‘why’ of the law? They further question if the law is ready to tackle the past and present injustices people experience in their social contexts?

Answering these questions effectively, requires, as a Kenyan activist Miguna Miguna suggests, ‘peel[ing] back the mask’ of the data protection law in Africa. So what are these masks?

False allure of the foreign

The clamour for enacting data protection in Africa may be long overdue, considering that the right to privacy has a documented history in the International Bill of Rights. However, there is a catch, a big one at it. For a long time, the agenda of setting the law and its standards has been kept in the cabins of a locomotive, whose driver is foreign.

There is nothing outrightly wrong with foreign things. However, there is no doubt that what is foreign comes with the baggage of importing templates which are out of touch with the realities of the people in any receiving country. Relatedly, the imported regulatory standards come with a somewhat tenuous presumption that the populations receiving the laws do not have privacy conceptions and experiences in their contexts. And that such conceptions, in the unlikely event that they exist, are illegitimate or irrelevant.

Reputation of stupidity

Once the data protection laws have been adopted, what nature do they take? Again, it is undeniable that data protection laws across Africa have been adopted to address the rising violations of privacy and related rights in the digital age.

One must consider whether data protection law aligns with Charles Dickens’ verdict on legal systems. While speaking broadly about jurisprudence, Dickens notably observed that ‘the law can be stupid’.

In my view, data protection law cannot escape being ‘stupid’ at times. That stupid and emotionless tool can be used by the industry to achieve what they want. It is, therefore, no surprise to read news on e-commerce, telecoms and tech firms that violate privacy rights, but still comfortably rely on exceptions, turning data protection obligations into exceptions, rather than the general rule.

The ‘stupid’ character of data protection law may be worsened by the emerging trend of using lobbyists to influence the text of data protection legislation, ostensibly to come up with something ‘more stupid’. In effect, industry lobbying has emboldened the instrumental character of data protection laws, especially those that are passed in the independent African states.

The instrumental character of law is shown when it is used as a tool to secure and preserve the interests of the dominant social class - while downplaying the interests of the marginalized. This occurs when political and economic elites dominate law-making and when parliaments go about their law-making business on data protection legislation without the meaningful participation of the people. Furthermore, the creeping acts of elitism in some activities of civil society organizations that should represent the interests marginalized does not help to settle the already troubled waters.

Pipedream in the Courts of ‘black letter’ law

How about setting aside all the above concerns and instead shift our hope to the courts, and their supposed liberative power. After all, courts ordinarily promise to mediate interests of the elite and the marginalized. Well, these hopes of mediating the interests fade when one considers that the institutions are just that – courts of law. The courts only apply the law. Therefore, their role is limited to applying the law which already manifests as an idiotic and instrumental tool. As such, the judicial application of the data protection law cannot rise above the idiocy of the law, without more.

Data protection law is just one of the artefacts of realizing an ideal. Currently, data protection law is a sleeping giant that can deliver justice only if awakened through reflective consciousness that removes its camouflage and opens its eyes to the experiences and lived realities of the people. The awakening starts from the humble point of recognizing that data protection laws are made by non-neutral lawmakers. They are made in contested spaces. So unless the ‘eyes of the data protection law are open’, the law will remain ‘stupid’. African peoples, the very subjects of these law, cannot afford this.