A WATCHFUL GAZE: DATA PROTECTION AS THE WIND UNDER THE WINGS OF ARTIFICIAL INTELLIGENCE IN AFRICA

Cybersecurity efforts in Africa for the implementation of AI by Muriuki Wahome

INTRODUCTION

For a wide range of socially important activities, including healthcare research, public health policies, policy coordination and the provision of ICT personalised services, it is necessary to have appropriate information. Sharing that data raises its own risks, but allowing others to use this information could give rise to abuse, which might include manipulation, misuse of publicity, theft, discrimination and risks to national security

In order to reduce the trade-off between privacy and performance in data exchange and analysis, the development of privacy enhancing technologies has made tremendous progress. In the context of managing artificial intelligence, other structured transparency tools could benefit from offering a range of capabilities which include outside scrutiny, auditing and source verification.

In order to avoid partial solutions and significant gaps in governance, it is useful to consider these different AI governance objectives as a system of information flows, as there may be significant overlaps in the software stack needed for AI governance use cases listed in this text.

The importance of interoperability between these different AI governance solutions is clear when one looks at the system as a whole. The problems of AI governance which must be resolved before these standards, auditing procedures, software and norms take effect urgently need to be considered as a system. In doing, an important quandary presents itself to be solved; how can we retain data privacy as well as reap the benefits of systematic data analysis?

AFRICA’S TECHNOLOGICAL LANDSCAPE

A proliferation of AI adoption in Africa similar to the growth of mobile phones has been forecast by some technology experts, who claim that it will help move African development forward at a faster pace. In this context, a key reference point to ensure that critical security arrangements are in place for maximising the benefit of AI deployment on the continent is adoption and efficient implementation of sound protection and privacy policy frameworks. At the moment, these frameworks are severely restricted.

The 2014 African Union Convention on Cyber Security and Personal Data Protection Known as the Malabo Convention is the only policy document in Africa with a focus on these issues. However, the Malabo Convention's support has not come fast enough.

A number of African countries have enacted laws that are unfriendly to privacy. In many countries, such as Ethiopia and Uganda, there is a law on Internet censorship and surveillance. Moreover, some of the measures to protect national security which are largely incontrovertibly and disproportionately discriminatory with respect to privacy rights have been adopted by Tanzania's Prevention of Terrorism Regulations.

No legislation on data protection exists in some countries. This is also a shortcoming of legislation because countries around the world have failed to protect their citizens' privacy through actions such as extensive surveillance without legal basis and actively censoring the Internet, for lack of protection of personal data and digital communications.

Although the Malabo Convention contains fundamental principles and guidelines to ensure that personal data are protected effectively by ensuring a safe digital environment for citizens, safety and privacy of individuals’ information on the Internet, it does not contain institutional strategies aimed at mitigating threats specific to AI deployment in Africa.

Thirty five countries have passed data protection legislation in the last two decades, twenty five have established data protection authorities, and nineteen have not yet passed legislation. In order to protect data, 18 of the 25 authorities have been set up specifically for this purpose and seven additional ones added to an existing government agency with another mandate under a different law. Only ten have laws, but there is no data protection authority. Legislation is also being considered in Nigeria, South Sudan, the Gambia, Ethiopia, and Namibia .

Map of Data Privacy Legislation in Africa

The Kenyan authority (ODPP) has been accepted in the Global Association of Privacy Authorities. The proposal for a Resolution on International Cooperation Capacity Building was jointly sponsored by the Ghanaian authorities in order to improve cyber safety regulation, and understand the harmful consequences of cybercrime. Burkina Faso's Competent Authorities are a cosponsor of resolutions on principles and expectations for the correct use of a person's information in face recognition technology at the Global Privacy Assembly summit hosted in Turkiye.

Niger and the Gambia became the 13th and 14th states to ratify the African Union The International Convention on Cybersecurity and the Protection of Personal Data. Only one more ratification is needed to ensure full implementation of the Convention. Uganda has given notice of its intention to ratify the Convention. The adoption of the Model Data Protection Regulation as a model law by the G.N.M. Ministers has been approved with unanimity.

INTERNATIONAL AFRICAN FRAMEWORKS FOR AI DEPLOYMENT

Three key change mechanisms drive the convergence of AI with data: massive computing capacity, complex algorithms and large volumes of both structured and unstructured data derived from a wide variety of sources, including search engines and social media.

These mechanisms, particularly regarding identification, opacity and the unpredictable nature of data outcomes, have fundamentally altered the traditional scope for informed consent as well as access, control and processing of data. In order to meet the realities of AI, traditional data protection and privacy policies need to be modified. It is equally important to regulate effectively data protection, not just for privacy and security but also in order to make it possible to stimulate innovation by ensuring the quality of information.

The number of policy interventions aimed at improving data protection on the African continent increased during the year. The AU published its Data Policy Framework, which applies to data governance.

I. African Union Policy Framework

An amendment to the AU Convention on Cyber Security and Protection of Personal Data is under way. The amendments will, inter alia, revise the definition of terminology and provide particular protection against children, e.g. data protection by design and impact assessment on Data Protection as well as taking an approach to Risk Base Approach in order to establish a Community of Data Protection Authorities. Whether this new council will replace or codify the existing NAPDP is unclear. There is also a current working group focusing on the Malabo Convention's entry into force.

II. Partnerships with Major International Organizations

UNESCO is engaged in a range of activities concerning artificial intelligence, including standard setting, policy advice and capacity building. In this context, UNESCO has launched guidelines for policy makers on artificial intelligence and education, developed training for young people on artificial intelligence and human rights, and will train judicial professionals worldwide on artificial intelligence and the rule of law by 2022. In addition, a recommendation on AI ethics is expected to be adopted in the upcoming session of the General Assembly of UNESCOs 193 Member States.

The Global Privacy Enforcement Network (GPEN) as well as the Global Privacy Assembly (GPA) offer benefits after membership of states, collaboration with other country members, and shared learning experiences.

RECCOMENDATIONS.

A strategy for the implementation, which will include training regulators in dealing with and addressing issues and concerns relating to AI deployment. The implications for the deployment of artificial intelligence across borders and developments in cross sectoral technology also need to be considered. This is to capacitate regional bodies in Africa for innovative, evidence based practices. The implementation of this plan, with the support and participation of all sectors and stakeholders.

To carry out research and build up a knowledge base, it is also possible to assemble teams of AI experts. To help design and develop policies relating to artificial intelligence, it should also include establishing AI knowledge centres throughout the region.

Some of the world's leading private technology firms, like Google and Microsoft, have already set up AI labs in Africa as part of this process: Ghana recently became the first African country to open an Artificial Intelligence Laboratory supported by Facebook and Google; a Master’s degree on machine intelligence was launched in Rwanda.

Similarly, Oxford University supports the development of regional centres around the world in order to build capacity in a wide range of areas such as data protection for artificial intelligence. The development of one or more such regional centres in Africa would need to involve the African Union.

An important way to accelerate engagement with and adoption of data policies related to the information revolution is by identifying AI enabled solutions addressing social economic challenges facing Africa. In order to align policies with economic solutions, a need analysis on the needs of countries in relation to AI technologies will be useful. In order to ensure greater adoption later, it is appropriate that more involvement of Member States in the development of data policies should take place on a continental level.

CONCLUSION

In the area of data protection in Africa, substantial progress has been achieved. Hopefully, more legislation will be enacted and implemented, proposals for amendments adopted as well as the establishment of data protection authorities. It is also our hope that public dissemination and sharing of information on activities undertaken by other authorities will take place. This will ensure that the vision for a better continent, both technologically and as a whole.



The author, Muriuki Wahome, is a Legal Researcher, Writer and a senior year law student at the University of Nairobi with a keen interest in technology use and implementation