Impact of the EU-US Data Privacy Framework on African Countries

Overview of the EU-US Data Privacy Framework (DPF)

• The European Commission adopted the DPF on 10 July 2023, offering a framework for personal data transfers between the EU and the US.
• US companies participating in the DPF will provide “adequate protection” under Article 45 of the EU General Data Protection Regulation (GDPR).
• The framework was developed in response to the EU’s Schrems II decision, featuring enhanced privacy protections, especially in the context of government surveillance.

Implications for African Countries

• No African country currently has an adequacy decision from the EU regarding data protection laws.
• African countries like South Africa, Algeria, Eswatini, Tanzania, Botswana, Kenya, and Uganda have enacted privacy laws.
• These laws often draw inspiration from the GDPR, suggesting a growing alignment with EU data protection standards.

Specific Impact on Kenya

• Kenyan data protection laws show some similarities to the GDPR, indicating progress towards EU standards.
• The absence of an EU adequacy decision requires Kenyan entities to implement additional safeguards for data transfers to the EU.
• Kenyan multinationals dealing with EU and US data must navigate these complexities until an adequacy decision is potentially extended to Kenya.

Guidelines and Next Steps for Kenya

1. Strengthening Data Protection Laws: Align national laws more closely with GDPR standards to increase the chances of receiving an EU adequacy decision.
2. Enhanced Compliance Mechanisms: Develop robust mechanisms for compliance with international data protection standards, especially for companies operating transnationally.
3. Data Sovereignty and Localization: Consider policies for data sovereignty and localization to safeguard Kenyan citizens’ data.
4. Capacity Building: Invest in training and resources to build expertise in data protection and privacy, both in the public and private sectors.
5. Public-Private Partnerships: Encourage collaboration between government and industry to harmonize data protection practices.
6. International Cooperation: Engage in dialogues and partnerships with the EU to understand and influence future data privacy frameworks.
7. Awareness Campaigns: Increase public awareness about data privacy and the importance of data protection measures.

Kenya can enhance its data protection landscape by following the above steps and aligning closer with international standards and potentially facilitating smoother data exchange with the EU and other regions.