Raging Security and Privacy Concerns Despite the Cyber and Data Protection Act in Zimbabwe.

 In 2021, Zimbabwe became one of many African countries that have enacted a Cyber and Data Protection Act [Chapter 12:07] ‘hereinafter referred to as the Act’. The object of the Act which is set out in section 2 is to “increase cyber security in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives, and data subjects”. Data that has been considered by various people to be the new gold brings to the fore issues associated with personal security and privacy. Understandably so for obvious reasons.

On a daily basis, we share personal data and at times without understanding the implications of our actions. For example, social media applications like Twitter, Facebook, and Linkedin may request access to one’s personal data as a precondition to accessing certain features of the application. Likewise, our growing appetite to advance personal security measures has seen a gradual increase in the use of voice recognition, fingerprint locks, scans, etc, all of which result in sharing sensitive biometric data with companies/organizations. And just when you think it’s enough, the supermarkets are also requesting you to provide personal details to be considered for promotions. Resultantly, users find themselves often bombarded with spam messages, emails, text messages, and customized advertisements from companies and organizations.

It is in light of the foregoing, that pertinent questions must be asked. Who keeps our personal information and where? For how long? How does a person know if their information has been shared with a third party without their consent? And if such information is compromised, how does one redress the situation? These valid questions are borne out of practical considerations of data protection issues. In 2021,A rape victim whose DNA from her sexual assault case was used by San Francisco police to arrest her in an unrelated property crime on Monday filed a lawsuit against the City[1]. And what guarantee is there that government institutions and other parties will not inappropriately use people’s sensitive and non-sensitive data?

The Act attempts to curb the risk of such violations by creating obligations on data controllers when collecting data. These obligations include taking all necessary steps to extract informed consent from a data subject. This means before collecting personal information, the data controller should give the data subject sufficient information to make an informed decision. This information includes the purpose for which that information will be used, and which purpose must be lawful and in pursuit of legitimate interests.

The Act then attempts to empower data subjects by creating rights such as the right to withdraw consent without giving a reason and at no cost, the right to have one’s information deleted from a database, the right to alter information, and the right to be forgotten.

The question still lingers on whether the safeguards created by the Act against violations of the right to security and privacy are enough. Well, the honest truth is that even with a beautiful piece of legislation, if people don’t appreciate the law, we run the risk of having a law that doesn’t fulfill its purpose. Hence, there is a need to sensitize more people about data and privacy issues to generate more informed consent when faced with data issues. Only then can we start discussing the issue of whether the safeguards in the Act are sufficient.



[1] https://www.npr.org/2022/09/13/1122670742/rape-dna-san-francisco-lawsuit

Comments

Popular posts from this blog

Navigating the complexities of the sole responsibility requirement in UK visa applications by Lincoln Majogo.

PSG’s Hakimi Achraf’s ‘genius’ claims ignite discussion on property rights upon divorce in Zimbabwe.

High Court Judgment pits Children's Rights Activists against Parents over Corporal Punishment.