Personal privacy and data protection laws exist to prevent the unauthorised collection, processing, storage, use, or dissemination of personal data and to protect you (the data subject/owner) from any breaches to that protection.
There is currently no legislation in Botswana that exclusively deals with protection of personal data. Personal data protection is found in a myriad of legislation such as the Constitution of the Republic of Botswana [Cap 00:00] (the “Constitution”), Financial Intelligence Act,2019 (“FI Act”), Banking Act [Cap 46:04] (the “Banking Act”) and common law (collectively, “Personal Data Protection Laws”).
The Constitution bestows upon every person in Botswana the right to privacy and this right extends to personal information. In the same light, the FI Act as well as the Banking Act impose a duty of confidentiality on authorised data handlers to keep information about their customers confidential at all times, and use it only for the purpose which it is intended. Every person’s right to privacy is also protected by common law.
The unauthorised collection, storage, and processing of a person’s data amounts to intrusion of privacy. The Data Protection Act No. 3 of 2018 (the “Data Protection Act”) which is still on notice, defines personal information as information relating to an identified or identifiable individual, which individual can be identified directly or indirectly, in particular by reference to an identification number, or to one or more factors specific to the individual’s physical, physiological, mental, economic, cultural or social identity; and “data” shall be construed accordingly.
Despite there being no general prohibition in terms of the Data Protection Act and extant Personal Data Protection Laws against the transfer of personal data, there is a requirement that personal data be protected by the data controller and only be shared with the consent of the data subject (the person to whom the data relates) or where authorised/required by law. In terms of the Data Protection Act, the data subject also has the right to instruct a data controller to delete personal data in their possession and to request the data controller to share the data subject’s data in their possession.
It is worth noting that currently there is a grey area and no jurisprudence in our law with regards to the penalties that one may face for unauthorised use or transfer of personal information. Our courts are yet to decide on matters of use and/or transfer of personal information without the data subject’s consent. However, the Data Protection Act, once signed into law, will remedy this grey area in our law and impose stringent penalties to any person who fails to comply with the obligation to protect personal data.
Additionally, the Botswana Communications and Regulatory Authority (“BOCRA”) in December of 2019 published a Code of Advertising for Broadcasting (the “Code”). The Code, though not in effect yet, will apply to advertisements that are aired on broadcasting platforms which are regulated by the Communications Regulatory Authority Act, No. 19 of 2012. The Code provides that “[T]he rights of individuals to privacy must be respected. Pictures, voices and property of individuals should not be used arbitrarily without the prior consent of the rightful owners. Consent must be sought in writing from parents or guardians when dealing with children.”
Failure to protect and honour the privacy rights of a person is a violation. This was seen in a recent case where BOCRA investigated a matter where a local service provider in fast moving consumer goods had sent out a mass short message service (SMS) blast to persons using data acquired from one of the mobile communications services providers. As of the date of this publication, there was no formal decision from BOCRA or the Competition and Consumer Authority with respect to this matter.
In summation, it is important for service providers, data controllers, and advertising and marketing practitioners to understand that personal data relating to individuals, for all material times, remains the property of that individual. It would be a violation of their lawful right to privacy to collect, process, store, use or disseminate that information without their prior consent or where permitted/required by law. Failing to do so could come with a hefty penalty from the relevant authority.
Perhaps, to make service providers, data controllers and advertising and marketing practitioners more astute to the spirit and demands of the law, it would be incumbent on the data subject to be more cognisant of their rights and more vocal when same are not duly respected.
For more information on data protection and privacy please contact Senior Associate Imaan Kader at imaan@bookbinderlaw.co.bw or Associate Gotsilemotho Winnie Phuduhudu at gotsilemotho@bookbinderlaw.co.bw or Candidate Attorney Andile L. Mthupha at andile@bookbinderlaw.co.bw.