On 6 May 2021, the Plenary Sitting of the Chamber of Deputies in Rwanda adopted the draft law relating to personal data protection and privacy, with major implications for freedom of expression and media freedom. The draft law still requires further review and approval, before it is enacted as law.
ARTICLE 19 Eastern Africa’s (EAF) preliminary analysis reveals that, while the draft law contains crucial rights enabling individuals’ access to their personal information, there are significant gaps affecting the protection and promotion of freedom of expression and information. Crucially, there are no provisions on the processing of personal data by the media and no further provisions capable of ensuring that the law is consistent with the Access to Information Law and the Media Law. Additionally, the draft law proposes that the National Cyber Security Authority (NCSA) be tasked with overseeing the implementation of the data protection law, despite its lack of independence and its restricted powers and mandate.
International law requires a proper balance be struck between the co-equal rights to freedom of expression and informational privacy through the incorporation of specific exemptions for journalistic, academic, artistic, literary and other cultural purposes in data protection laws. These exemptions allow most substantive data protection provisions limiting the processing of personal data to be waived for those purposes. By not including exemptions, the draft law fails to balance the right to data protection with other rights such as the right to freedom of expression, impairing the ability of journalists to exercise their activities. It also requires that the right of protection of personal data be balanced with the right of persons to be able to obtain information from government bodies, especially about the activities of elected and senior officials.
Commenting on the draft law, Mugambi Kiai, Regional Director at ARTICLE 19 Eastern Africa, said:
“As part of its obligations under Articles 17 and 19 of the ICCPR, Rwanda is mandated to properly balance individuals’ rights to privacy with freedom of expression, access to information and media freedom. The government has a real opportunity to send a clear message that the government is keen on protecting all stakeholders in Rwanda, including those tasked with securing the public interest, such as journalists and media houses. We hope that the draft law will be amended to ensure a proper balancing of these co-equal rights before it is signed into law.”
ARTICLE 19 Eastern Africa also notes that this gap will have a disproportionate impact on digital and print media houses, journalists, and other stakeholders serving the public interest. Where these exemptions are not included, public interest in Rwanda stands to be impacted on three grounds, namely the promotion of the public’s right to know, efforts to ensure government and private sector accountability and transparency, and the maintenance of journalistic archives kept by, maintained or accessed by media houses and journalists.
Further, the failure to include these exemptions means that stakeholders serving the public interest must fully comply with the data protection law, or risk being exposed to the criminal and civil sanctions provided under Section 2. In addition to the penalties provided under Section 2 of the draft law, Section 59 disproportionately provides that the court may ‘order the permanent or temporary closure of the legal entity or the premise in which any of the offences provided for in this Law was committed.’ Additionally, by not being exempted from the registration requirements, journalists and media will be required to inform the NCSA, among other things, about the personal data being processed, for which purpose and the category of data subjects. Such an obligation poses serious risks to whistleblowers and journalists’ sources who prefer to operate under the cloak of anonymity, thereby impacting the journalistic investigation process.
ARTICLE 19 Eastern Africa further notes that the protection of the right to privacy can only be properly safeguarded by an independent body with the appropriate mandate and powers. The proposed supervisory authority, the NCSA, neither possesses the required independence nor the appropriate mandate, given the NCSA’s exclusive cybersecurity mission and powers under Law No. 26/2017 of 31/05/2017 Establishing the National Cyber Security Authority and Determining its Mission, Organisation and Functioning.
Bearing this in mind, we urgently call for revisions to the draft law to ensure the proper protection and balancing of the rights to privacy and freedom of expression and recommend:
- The inclusion of specific exemptions for journalistic, academic, artistic, literary and other cultural purposes which allows for the rules limiting processing to be waived for those purposes.
- A specific recognition of the right of access to publicly held information must be ensured, especially relating to elected and senior officials acting in their official capacities.
- The creation of a stand-alone, independent data protection authority tasked exclusively with the protection of data protection in Rwanda.