DataHub Weekly | DataHub has a new Home! 🏡
Apr 30, 2025 4:31 am
Hello,
We’re excited to announce that DataHub.Africa has officially moved to a new domain:
🎉 dataprotectionafrica.com 🎉
This change reflects our growing focus on providing specialized insights, analysis, and legal updates on data protection in Africa.
Why the move?
- Better visibility
- Improved access to our expanding resources and tools
- Support for future features like partner content
What you need to know:
âś… All links from datahub.africa will still work and redirect automatically
âś… No action is needed on your part
âś… Bookmark our new site: dataprotectionafrica.com
----------------------------------------------------------------------------------------------------------
📢 Found DataHub useful?
Share it with your colleagues, legal teams, or anyone interested in data protection in Africa.
----------------------------------------------------------------------------------------------------------
Thank you for being part of our journey. We look forward to continuing to serve you with even more impactful content, research, and resources under our new name.
Warm regards,
Margaret Odhiambo, Founder
Featured Data Protection Determinations
Now back to regular programing! We provide highlights of data protection determinations published by various Data Regulators across Africa.
Kenya
Rose Wambui Muigai filed a complaint against NCBA Bank PLC with the ODPC, alleging unauthorized disclosure of her personal data to former bank employees. The ODPC found that a data breach occurred, the Bank failed to adequately explain how the former employees accessed the Complainant’s data and the Bank failed to report the breach. The Bank was ordered to compensate the Complainant and issued an enforcement notice. Read more in DataHub
Tabitha Mwaniki discovered that her photo, taken during a salon visit, was posted online by the nail spa without her permission. When her request to remove it was ignored, she reported it to the ODPC. The spa claimed implied consent, but the ODPC ruled in Tabitha’s favor and ordered an apology and the creation of a data protection policy. Read more on DataHub.
Eswatini
Liberty Life Swaziland Limited faced an enforcement notice from the Eswatini Data Protection Authority (EDPA) due to a data breach that occurred in November 2023. The incident involved the accidental disclosure of personal information via email, which was sent to an unintended external recipient. The email contained sensitive data related to 4,174 individuals, including names, identity numbers, and other personal details. Read more on DataHub
Ghana
Francis Kwarteng Arthur sued Ghana Telecom, MTN, Kelni GVG, and the National Communications Authority over the President's directive (EI 63) to release personal data for Covid-19 tracing. The High Court awarded Arthur damages for privacy violation and struck down parts of EI 63. The Court of Appeal upheld the damages but overturned the timeline for amending EI 63, affirming separation of powers. Read more on DataHub
Quiz
Under Kenya’s Data Protection Act, which of the following is NOT a lawful basis for processing personal data?
A) Consent of the data subject
B) Performance of a contract
C) Legitimate interests of the data controller
D) Convenience of the data processor
đź”˝
Answer: D) Convenience of the data processor
âś… Explanation:
The Data Protection Act recognizes several lawful bases for data processing—including consent, legal obligation, performance of a contract, public interest, and legitimate interests. However, “convenience” is not a lawful basis—processing must meet specific legal grounds to be valid under the Act.
đź“Š New Feature | The Fines Database is Live!
We’re excited to introduce the Fines Database—a searchable, regularly updated resource tracking data protection enforcement actions across Africa.
Whether you're a lawyer, compliance officer, researcher, or policymaker, the Fines Database helps you:
✅ Track penalties issued by Data Protection Authorities (like Kenya’s ODPC)
âś… Compare enforcement trends across countries
âś… Understand the legal basis for fines and corrective orders
This tool is designed to promote transparency, support compliance strategies, and deepen understanding of enforcement in Africa’s data protection landscape.
The Privacy Lens | Featured Article
Enforcing ODPC Determinations Through the High Court | A Practical Guide
What happens after the Office of the Data Protection Commissioner (ODPC) issues a determination—and the other party fails to comply? This guide breaks down the legal and procedural steps to enforce ODPC decisions through Kenya’s High Court, drawing from a real-world case to illustrate best practices.
âś… Understand the statutory basis for enforcement
âś… Learn the typical execution process
âś… Get practical tips on navigating the courts effectively
---
This is a summary of an article appearing on DataHub | The Privacy Lens, A Blog. You can read the full article for a more detailed analysis by clicking on the link below.
Audio Notes | The Podcast
DataHub now features Audio Notes. This new feature, powered by NotebookLM, aims to make it easier to access and engage with the wealth of information available on the platform | The Audio Notes Podcast
Access Data Protection knowledge & resources, for free
Check out Africa-focused data protection resources: dataprotectionafrica.com which includes:
• AI Policies & Case Tracker
• Country data laws and factsheets
• Data Protection decisions and summaries
• Data Protection Blog & Podcast
Tailored data protection training
Practical, down-to-earth Compliance Workshops to build on your team's knowledge. Look out for our publicly accessible LMS by MZIZI Africa Contact us to find out more.
Email: info@mzizi-africa.com
No-nonsense reviews, advice and support
Like a chat about data protection issues you're facing? Arrange a meeting with Margaret or Isaac
Follow DataHub on LinkedIn, Twitter or check us out online.
DataHub is a free to use to use resource by MZIZI Africa
