The Data Protection Act, 2018 is the first of its kind in Botswana which deals with the protection of personal data. This write-up summarizes some aspects of the law.
- THE SCOPE OF APPLICATION OF THE ACT
The act applies to personal data entered in a file by or for a data controller established in Botswana.
The Act under section 2 defines Personal Data as information relating to an identified or identifiable individual, which individual can be identified directly or indirectly, in particular reference to an identification number, or to one or more factors specific to the individual’s physical, physiological, mental, economic, cultural, or social identity.
- MATERIAL SCOPE OF APPLICATION
The Act applies to personal information, however under Section 3 of the Act the scope of application is limited and the Act provides for instances where the Act shall not apply such as, the processing of such data in the course of a purely personal or household activity.
The State is also exempted to the application of this Act where the processing of personal data relates to the purposes of national security, prevention investigation, proof of offences, the prosecution of offenders and other purposes provided for under the Act.
- ESTABLISHMENT OF INFORMATION AND DATA PROTECTION COMMISION
The Act established a public office termed the Information and Data Protection Commission which its functions under Section 4 of the Act is for the purposes of doing all in their power to ensure that the personal rights of individuals with regards to personal data are protected.
The Act also empowers the Commissioner with the right of access for personal data from the controller upon request that is made in writing.
- DUTIES OF A DATA CONTROLLER
The act provides for the data controller whose duties have been stipulated under section 14 of the Act. Some of the duties of a Data Controller is to ensure that personal data is processed fairly and lawfully, to ensure that personal data is processed for specific, explicitly stated and legitimate purposes. And that the data obtained with the knowledge or consent of the individual whose is the subject of such personal data.
- THE RIGHTS OF A DATA SUBJECT
Under section 30 of the Act individuals are provided with rights relating to their personal data. The rights as provided for by the Act include and are not limited to the right to challenge personal data relating to him or her, the right to receive communication of personal data relating to him or her as a data subject.
- INVESTIGATIONS AND ENFORCEMENT
The Act under section 41 authorises the Commissioner to carry out investigations whenever there is a complaint from any person, that there might be some reasonable suspicion of interference with the protection of personal data or when the rights of a data subject are being infringed upon.
An enforcement notice may also be given under the Act where it has been satisfied that any person has interfered with the protection of personal data and such enforcement notice may require such steps as specified in the enforcement notice to be taken.
- TRANSBORDER FLOW OF PERSONAL DATA
The Act provides that the transfer of personal data from Botswana to another country is prohibited only the Minister may by Order published in the Gazette designate the transfer of personal data to any country listed in such order.
- OFFENCES AND PENALTIES
Under section 51 of the Act penalties are stipulated for any contravention of this Act, with the section providing for a fine not exceeding P300 000 or imprisonment for a term not exceeding seven years to anyone held liable for the contravention of this act.
- COMPENSATION FOR DAMAGES
A data subject may institute an action for damages against a data controller who processes data in contravention of this Act.