1 September 2016
The Council of Europe (‘CoE’) announced, on 25 August 2016, that Senegal has become the third non-European state to accede to the Convention for the protection of individuals with regard to the Automatic Processing of Personal Data (‘Convention 108’). Convention 108 is the only international legally binding instrument that grants individuals the right to the protection of their personal data and is open for accession by any country around the globe.
Graham Greenleaf, Professor of Law & Information Systems at the University of New South Wales Australia, told DataGuidance, “Convention 108 accessions are an important aspect of the increasing adoption of global data protection norms that have been occurring in Africa for well over a decade. Convention 108 accessions are not a radical change, but a logical progression for those countries, such as Senegal, with more mature laws.”
Senegal also signed Convention 108’s Additional Protocol (‘the Protocol’) that requires countries to ensure compliance with data protection principles and establish rules on cross-border data transfer. The Senegalese data protection authority (‘CDP’) commented that the adoption of both the Convention and the Protocol strengthens Senegal’s legal framework and makes the country a more attractive market for foreign companies seeking to make investments in digital services.
Leon Patrice Sarr, Managing Partner of LPS Law, informed DataGuidance, “Pursuant to Article 49 of Law no. 2008-12, the transfer of personal data to another country is prohibited unless the receiving country provides sufficient protection to data subjects. The CDP was supposed to issue a green list of countries offering a sufficient protection and data transfer to these listed countries would require only notification to CDP. However, this list has so far not been created by the CDP and consequently all transfers must be authorised by the CDP. Senegal’s accession to Convention 108 means that data transfers to member countries will be easier as these countries are deemed to provide a sufficient level of protection of personal data. As a result, a simple notification to the CDP will now be sufficient to transfer personal data to those countries.”
It is notable that, with the exception of Cape Verde, the African countries involved in Convention 108 accession are all francophone countries (including Mauritius).
Senegal’s accession means that there are now 50 states who are party to Convention 108 including, the 47 Council of Europe Member States, Uruguay and Mauritius. A further three African countries, Cape Verde, Morocco and Tunisia are in the process of acceding to Convention 108.
Greenleaf stated, “It is notable that, with the exception of Cape Verde, the African countries involved in Convention 108 accession are all francophone countries (including Mauritius). One potential reason for this trend is that the Francophone Association of Data Protection Authorities (‘AFAPDP’) and its representatives have been very influential in francophone countries, in advocating and providing expert advice on both the adoption of data protection laws, and on accession to Convention 108. Africa’s position in the same or similar time zones to European countries increases the potential attractiveness of African countries as outsourcing destinations and represents another reason for the number of African countries seeking to accede to Convention 108.”
Convention 108 will enter into force in respect of Senegal on 1 December 2016.
Thomas Brookes | Privacy Analyst