Background

Cameroon’s proposed Data Protection Bill reflects the nation’s ambition to transition from being a passive recipient of technology to leveraging its data resources for national development. The bill seeks to protect citizens’ privacy while fostering accountability and data governance in line with global best practices. However, while the initiative is commendable, it raises questions about its potential to safeguard human rights, protect digital freedoms, and avoid misuse in the context of limited press freedom and political dissent.

Key Provisions of the Bill

The bill outlines several foundational elements of data protection, such as:

1. Definition and Scope: Personal data is defined as any information linked to an identified or identifiable individual. It covers data processing within Cameroon, involving its citizens or residents, regardless of geographic location.
2. Individual Rights: Citizens have the right to access, correct, delete, and object to the processing of their personal data, especially sensitive information. Explicit consent is a prerequisite for collecting and processing such data.
3. Data Security and Processing Standards: Data processing must be lawful, transparent, and purpose-specific. Entities handling data are mandated to implement robust security measures and maintain confidentiality.
4. Supervisory Authority: A regulatory body will oversee compliance, with entities required to register and submit periodic reports.
5. Penalties for Violations: Sections 54 to 71 establish penalties ranging from administrative sanctions to criminal fines and imprisonment for non-compliance.
6. Data Transfers: The bill restricts international data transfers, permitting them only when the destination country provides adequate protection.

Digital  Rights Protections in the Bill

From a digital rights perspective, the bill introduces several safeguards. These include Enhanced Privacy, Cybersecurity, Accountability, and Rights Recognition. Sections 37–52 provisions ensure alignment with human rights standards, prohibiting the processing of data linked to sensitive areas like political opinions or ethnic origins. 

The bill provides privacy, safeguards data security, and empowers data subjects. It strengthens the right to privacy by limiting arbitrary data collection and enforcing safeguards against misuse. The bill also introduces measures such as encryption and restricted access, which ensure personal data protection against unauthorised access, bolstering individuals’ cybersecurity. It also enforces agency and autonomy over personal information by enabling individuals to control their data, aligning with international human rights standards. Sections 37 to 47 of the bill specifically speak to the rights of data subjects (The Individual). In addition, Section 29 of the bill mandates data processors to keep a register of their processing operations. This is great for accountability if effectively implemented, including in the activities of security agencies. Section 33 provides for human rights impact assessments. Section 36 provides for data minimisation.

The prohibitions defined in sections 48 – 52 served to protect digital rights. Worthy of note, section 48(a) prohibits data processing relating to religious, philosophical, political, or trade union activities or opinions. The prohibition includes racial, linguistic, regional, or ethnic origins, genetics, and health biometrics. Section 52 requires data processing to respect individual and collective freedoms and human rights in the context of applicable legislation and International human rights instruments.  This includes protection for human dignity and identity. 

These provisions can bolster individual autonomy and align Cameroon with international privacy standards if implemented effectively.

Concerning Provisions in the Bill

Despite its positive aspects, the bill includes vague and potentially exploitable provisions:

1. Broad Definitions: Ambiguously defined terms such as “public interest” could lead to subjective interpretations, allowing authorities to override data rights. Section 51’s reference to public order, morality, or interest allows for vagueness and biased interpretations. Exceptions for national security or public order could be exploited to justify invasive surveillance without adequate checks.
2. The Independence of the Data Protection Authority: Although section 53 of the bill provides for the independence of the data protection authority, the second part of the provision gives the president blanket powers to issue decrees for the establishment and functioning of the data protection authority. This impliedly takes away the independence. If supervisory authority lacks independence, there are legitimate reasons to believe the political authority will abuse it. 
3. Political and Economic Tool: The supervisory Authority’s discretionary powers could serve as a political or economic control tool, undermining its regulatory role.
4. Censorship and Access Restrictions: The bill could be leveraged to justify blocking or filtering online content under the guise of protecting personal data.
5. Chilling Effect on Free Speech: Stringent penalties for non-compliance may discourage individuals and organizations from engaging in open digital discourse or activism.
6. Silencing of Dissent: Activists and opposition figures could be targeted under the pretext of data protection violations, deterring dissenting voices through selective enforcement.
7. Overreach in Data Collection: Government access to personal data for “public order” could enable profiling and suppression of critics.
8. Criminalization of Investigative Journalism: Journalists relying on public records or investigative methods could face accusations of unlawful data processing. Closely related to this is whistleblower exposure. Provisions requiring consent for data sharing could be weaponized to expose whistleblowers, endangering their safety and undermining journalistic integrity.

Conclusion

The initiative itself, although long overdue, is commendable. With this initiative, Cameroon is about to join about 30 other African countries in enacting specific legislation to protect privacy and provide a data governance guideline for the country. While the Data Protection Bill marks a critical step forward for Cameroon, its effectiveness will depend on how it balances privacy protection with safeguarding digital freedoms. Given Cameroon’s political climate and Freedom House’s criticism of its human rights record, concerns about misuse cannot be overlooked. The bill must be insulated from political interference and aligned with democratic principles to ensure it serves the people, not the powerful. The nation must be deliberate in enacting a law that serves the actual interest of the people of Cameroon and positions the nation to leverage the benefits of the digital economy. 

Recommendations for Improvement

By addressing and implementing the following measures, Cameroon can position itself as a leader in Africa’s digital economy while respecting and upholding its citizens’ fundamental rights.

1. Clearer definitions and limits are needed. Narrow definitions of key terms and strict conditions for exceptions are necessary to avoid misuse.
2. The bill’s section 19(3) provision to develop regulations relating to conditions for granting authorisation requires strong advocacy by civic defenders to ensure that such regulations comply with international human rights standards and democratic principles. This should also apply to the regulation implied in section 33. 
3. The bill lacks clauses to protect journalistic activities, whistle-blowing, and legitimate dissent for the sake of public interest. This should be incorporated.
4. The supervisory authority must be independent and transparent, with mechanisms for accountability.
5. Fines and penalties should be proportionate to ensure they deter violations without stifling innovation or expression.
6. Broad consultations with civil society, journalists, and technologists during the bill’s implementation will help safeguard rights and address potential abuses.

Author: Adeboye Adegoke, Senior Manager, Grants and Programmes Strategy – Paradigm Initiative