The Personal Data Protection Law In Tanzania : Good Or Bad For Investors?

• Published date: 02 February 2023
• Subject Matter: Privacy, Data Protection
• Law Firm: Shikana Group
• Author: Shikana Law Group

Data privacy has increasingly become important both for investors and advertisers but also for the regulators. Data protection is made to be taken seriously now and companies are paying hefty fines from British Airways who was fined USD 230 million for a data breach which affected information of 500,000 people. Google faced a GBP 44 million fine for non-compliance with FDPR and we all remember the Cambridge Analytica scandal where Facebook had to pay a fine of USD 5 billion.

Tanzania decided to join the ranks of its fellow EAC Members namely Kenya, Rwanda, and Uganda and enact the Personal Data Protection Law. Prior to this legislation, the protection of data was found in various pieces of legislations such as the Electronic Postal Communication Act of 2010, Cyber Crimes Act of 2015, Banking and Financial Services Act of 2006, etc and of course the guarantee of the right of privacy under Article 16 of the Constitution of the United Republic of Tanzania.

This is good news for Tanzania as increasingly consumers in Tanzania have been complaining of the lack of robust rules protecting their data, particularly when it comes to telecommunication companies or gaming companies who are known to trade this data at the detriment of the customer.

For companies or individuals processing personal data, the law contains a host of requirements namely being registered as a data processor but also a directive for data processors to appoint a personal data protection officer.

The law is applicable in both Tanzania and Zanzibar, save for non-union matters. The law creates a Data Protection Commission which constitutes of board members appointed by the President of the United Republic of Tanzania Furthermore, the Commission is designated as the registrar of data collectors and processors; the investigator into personal data matters; the advisor to the Government of Tanzania and the adjudicator of data protection disputes. This all brings into question the independence and impartiality of this authority.

On the question of data transfer, which is a big one for companies like gaming and technology that trade and monetise the database of personal information collected through the life of a business, the Act is silent on the question of data owner and subjects granting their consent to bodies that collect, process, store, or use personal data outside Tanzania's borders. Therefore, since the power of consent is not clearly stipulated, we may interpret this that data transfer is...