<div dir="ltr">
<p class="MsoNormal">Dear Dr. Matiangi and Listers,</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">Please find the comments by DotConnectAfrica on the entire Draft
African Union Convention on the establishment of a Credible Legal Framework for
Cyber Security in Africa.</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">DotConnectAfrica took initiative, analyzed and published these
comments to the draft convention over a month ago in October 2013 and
circulated it to interested stakeholders.</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">We appreciate the multistakeholder efforts in preparing this
convention and look forward to work with everyone in this worthy course.</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">Link to our comments:</p>
<p class="" style><span style><span style>1.<span style="font:7pt "Times New Roman"">
</span></span></span><a href="http://dotafrica.blogspot.com/2013/10/dotconnectafrica-comments-to-draft.html">http://dotafrica.blogspot.com/2013/10/dotconnectafrica-comments-to-draft.html</a></p>
<p class="" style><span style><span style>2.<span style="font:7pt "Times New Roman"">
</span></span></span><a href="http://www.dotconnectafrica.org/wp-content/uploads/2013/10/DotConnectAfrica-Comments-to-the-Draft-African-Union-Convention-on-the-Establishment-of-A-Credible-Legal-Framework-For-Cyber-Security-In-Africa-October-2013.pdf">http://www.dotconnectafrica.org/wp-content/uploads/2013/10/DotConnectAfrica-Comments-to-the-Draft-African-Union-Convention-on-the-Establishment-of-A-Credible-Legal-Framework-For-Cyber-Security-In-Africa-October-2013.pdf</a></p>
<p class="MsoNormal"><br>
<b>Article II – 2:</b><br>
With respect to personal data, state prerogatives must be well defined so as
not to breach the rights of a private life online or offline.</p><p class="MsoNormal"><br> </p>
<p class="MsoNormal">All activities that arise from the gathering, processing,
transmission, storage and use of personal data should be well defined and
levels of acceptable access and permissions by individual users properly laid
out so as not to create a door for perceived surveillance or activities that
take away the personal right of a user <br></p><p class="MsoNormal"><br></p>
<p class="MsoNormal" style="text-align:justify;line-height:normal"><b>Article II-6, II-7, 11-8, II-11,
II-12, II-13 refer to a Protection Authority</b><b style><i style><span style="font-size:12pt;font-family:"Times New Roman","serif";background:none repeat scroll 0% 0% silver"></span></i></b></p>
<p class="MsoNormal">Comment 12: These articles define the membership and the
constituting mandates of the said ‘Protection authority’ however it should be
left to the countries to define the authorities under inbuilt country
contributions/laws or bylaws so as not to create a different center of power or
parallel agency.</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">Also the selection of the membership to the protection authority
should allow composition from all stakeholders and not only government. ‘Sworn
Agents’ should be well defined and described, their mode of selection, duties, responsibilities
should be open to public accountability and transparency.</p><p class="MsoNormal"><br></p>
<p class="MsoNormal">Regards<br>
DotConnectAfrica Trust.</p><p class="MsoNormal"><br></p>
<div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Message: 1<br>
Date: Wed, 27 Nov 2013 02:34:09 +0000<br>
From: Fred Matiangi <<a href="mailto:fredmatiangi@gmail.com" target="_blank">fredmatiangi@gmail.com</a>><br>
To: Grace Githaiga <<a href="mailto:ggithaiga@hotmail.com" target="_blank">ggithaiga@hotmail.com</a>><br>
Cc: KICTAnet ICT Policy Discussions <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>><br>
Subject: Re: [kictanet] Day 3: Personal Data Protection<br>
Message-ID:<br>
<<a href="mailto:CAHqF9HaFpZiNfA8OqedHxn7BN1C0bdzSrXZCo%2BMbT9TEdR2NKA@mail.gmail.com" target="_blank">CAHqF9HaFpZiNfA8OqedHxn7BN1C0bdzSrXZCo+MbT9TEdR2NKA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="windows-1252"<br>
<br>
Good morning Listers,<br>
<br>
I have been following the on-going discussion of the proposed AU<br>
convention with keen interest and excitement, especially because this is<br>
precisely how we will end up enriching and strengthening it. I pumped into<br>
John Walubengo last evening and proposed that perhaps in a week or two we<br>
should have a brief brainstorm bringing together all interested parties so<br>
we can concretise our 'Kenya Position' on this convention. Further to this<br>
conversation, I asked my colleagues Victor and Eunice at the ICTA and<br>
Francis Wangusi at CCK to explore possibilities of collating all the ideas<br>
emanating from this forum and setting up a sit down to tie up our<br>
discussions a head of the Heads of State Summit in January.<br>
<br>
Grace- I very sincerely appreciate the initiative to drive this discussion<br>
and look forward to further engagement.<br>
<br>
Good day.<br>
<br>
Fred<br>
<br>
<br>
On Tue, Nov 26, 2013 at 9:23 PM, Grace Githaiga <<a href="mailto:ggithaiga@hotmail.com" target="_blank">ggithaiga@hotmail.com</a>>wrote:<br>
<br>
> *Good morning Listers*<br>
><br>
><br>
> *Today, we move onto PART II: PERSONAL DATA PROTECTION and will tackle<br>
> four questions.*<br>
><br>
><br>
> *Objectives of this Convention with respect to personal data*<br>
><br>
><br>
><br>
> *Article II ? 2:*<br>
><br>
> *Each Member State of the African Union shall put in place a legal<br>
> framework with a view to establishing a mechanism to combat breaches of<br>
> private life likely to arise from the gathering, processing, transmission,<br>
> storage and use of personal data.*<br>
><br>
> *The mechanism so established shall ensure that any data processing, in<br>
> whatsoever form, respects the freedoms and fundamental rights of physical<br>
> persons while recognizing the prerogatives of the State, the rights of<br>
> local communities and the target for which the businesses were established.*<br>
><br>
><br>
> *Question:* *What is the relevance of this article? What are these state<br>
> prerogatives? And given the increased interest of state surveillance, how<br>
> can states balance respect of FOE while recognising state prerogatives? *<br>
><br>
><br>
> *Article II-6, II-7, 11-8, II-11, II-12, II-13 refer to a Protection<br>
> Authority* which is meant to establish standards for data protection.<br>
> Article II ? 14 *provides for each Member State of the African Union to<br>
> establish an authority with responsibility to protect personal data. It* *shall<br>
> be an independent administrative authority with the task of ensuring that<br>
> the processing of personal data is conducted in accordance with domestic<br>
> legislations.*<br>
><br>
> Further, article II-17 states that ?*Sworn agents may be invited to<br>
> participate in audit missions in accordance with extant provisions in<br>
> Member States of the African Union?.*<br>
><br>
><br>
> *Question:* *Considering that this article seems to be tied to the<br>
> Protection Authority, what is its relevance? And who is a ?sworn<br>
> agent?? What should this authority look like in terms of its composition? *<br>
><br>
><br>
> *Article II ? 20:*<br>
><br>
> *?Members of the protection authority shall not receive instructions from<br>
> any authority in the exercise of their functions. *<br>
><br>
> *Article II ? 21:*<br>
><br>
> *Member States are engaged to provide the national protection authority<br>
> human, technical and financial resources necessary to accomplish their<br>
> mission.*<br>
><br>
><br>
> *Question:* *It appears that this Data Protection Authority is envisaged<br>
> to be fully government supported. Therefore, should we be talking of its<br>
> independence? In what way should this article be framed so that it ensures<br>
> independence of the Authority?*<br>
><br>
><br>
> *Article II ? 28 to II-34 *outlines six principles governing the<br>
> processing of personal data namely:<br>
><br>
> Consent and of legitimacy,<br>
><br>
> Honesty,<br>
><br>
> Objective, relevance and conservation of processed personal data,<br>
><br>
> Accuracy,<br>
><br>
> Transparency and<br>
><br>
> Confidentiality and security of personal data.<br>
><br>
> Under each of the specific principles, detailed explanation of how each<br>
> should be undertaken is offered.<br>
><br>
><br>
> *Question:* *Is this explanation and detailing of how to undertake each<br>
> necessary in an international (regional) law necessary or needed? Is this<br>
> legislation overkill?*<br>
><br>
><br>
> *Lets get your views on data protection concerns.*<br>
><br>
><br>
> Rgds<br>
><br>
> GG<br>
><br>
><br>
><br>
> _______________________________________________<br>
> kictanet mailing list<br>
> <a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
> <a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
><br>
> Unsubscribe or change your options at<br>
> <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/fredmatiangi%40gmail.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/fredmatiangi%40gmail.com</a><br>
><br>
> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform<br>
> for people and institutions interested and involved in ICT policy and<br>
> regulation. The network aims to act as a catalyst for reform in the ICT<br>
> sector in support of the national aim of ICT enabled growth and development.<br>
><br>
> KICTANetiquette : Adhere to the same standards of acceptable behaviors<br>
> online that you follow in real life: respect people's times and bandwidth,<br>
> share knowledge, don't flame or abuse or personalize, respect privacy, do<br>
> not spam, do not market your wares or qualifications.<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20131127/52739627/attachment-0001.html" target="_blank">https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20131127/52739627/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 27 Nov 2013 05:41:08 +0300<br>
From: Ali Hussein <<a href="mailto:ali@hussein.me.ke" target="_blank">ali@hussein.me.ke</a>><br>
To: Kivuva <<a href="mailto:Kivuva@transworldafrica.com" target="_blank">Kivuva@transworldafrica.com</a>><br>
Cc: "<a href="mailto:isoc@orion.my.co.ke" target="_blank">isoc@orion.my.co.ke</a>" <<a href="mailto:isoc@orion.my.co.ke" target="_blank">isoc@orion.my.co.ke</a>>,<br>
"<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>" <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>><br>
Subject: Re: [kictanet] [ISOC_KE] Day 2: On-line debate on African<br>
Union Convention on Cyber Security (AUCC)<br>
Message-ID: <<a href="mailto:99C7B20A-95D4-437B-93EA-434790F2CF5F@hussein.me.ke" target="_blank">99C7B20A-95D4-437B-93EA-434790F2CF5F@hussein.me.ke</a>><br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
True that. But how many of us actually read the fine print? Of course you,would say that the onus is on us to read...:)<br>
<br>
Ali Hussein<br>
<br>
<a href="tel:%2B254%200770%20906375" value="+254770906375" target="_blank">+254 0770 906375</a> / <a href="tel:0713%20601113" value="+254713601113" target="_blank">0713 601113</a><br>
<br>
"I fear the day technology will surpass human interaction. The world will have a generation of idiots". ~ Albert Einstein<br>
<br>
Sent from my iPad<br>
<br>
> On Nov 26, 2013, at 11:01 PM, Kivuva <<a href="mailto:Kivuva@transworldafrica.com" target="_blank">Kivuva@transworldafrica.com</a>> wrote:<br>
><br>
><br>
>> 'Buyers who bought this item also bought these items' and a list of recommended items similar to what you bought appears under your shopping cart. How would we categories this? Some may say that this is smart coming from Amazon. Some may consider it spooky and border line privacy issues. The point I'm making is that I don't want some 'Smart Alec' government functionary deciding for me what I should see or not see online (or off line for that matter). That is a personal choice and of course we have plenty of tools to stop some of these 'intrusive' online practices.<br>
><br>
> I feel you Ali, But Amazon can claim that their business intelligence is in their terms of service<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20131127/3862b042/attachment-0001.html" target="_blank">https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20131127/3862b042/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Wed, 27 Nov 2013 05:57:29 +0300<br>
From: Ali Hussein <<a href="mailto:ali@hussein.me.ke" target="_blank">ali@hussein.me.ke</a>><br>
To: Fred Matiangi <<a href="mailto:fredmatiangi@gmail.com" target="_blank">fredmatiangi@gmail.com</a>><br>
Cc: KICTAnet ICT Policy Discussions <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>><br>
Subject: Re: [kictanet] Day 3: Personal Data Protection<br>
Message-ID: <<a href="mailto:64590323-2FAD-4BF8-9E1F-CC8F4C0ABC1E@hussein.me.ke" target="_blank">64590323-2FAD-4BF8-9E1F-CC8F4C0ABC1E@hussein.me.ke</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Listers<br>
<br>
The link below gives a good overview of how the global online digital industry is at the forefront of policy and (self) regulation emanating from the many issues that arise online:- from personal data protection, tracking, disclosures etc. The local industry is in the process of setting up a local chapter of the IAB to ensure that we stay updated and ahead of the curve.<br>
<br>
<a href="http://www.iab.net/public_policy/self_regulation" target="_blank">http://www.iab.net/public_policy/self_regulation</a><br>
<br>
Ali Hussein<br>
<br>
<a href="tel:%2B254%200770%20906375" value="+254770906375" target="_blank">+254 0770 906375</a> / <a href="tel:0713%20601113" value="+254713601113" target="_blank">0713 601113</a><br>
<br>
"I fear the day technology will surpass human interaction. The world will have a generation of idiots". ~ Albert Einstein<br>
<br>
Sent from my iPad<br>
<br>
> On Nov 27, 2013, at 5:34 AM, Fred Matiangi <<a href="mailto:fredmatiangi@gmail.com" target="_blank">fredmatiangi@gmail.com</a>> wrote:<br>
><br>
> Good morning Listers,<br>
><br>
> I have been following the on-going discussion of the proposed AU convention with keen interest and excitement, especially because this is precisely how we will end up enriching and strengthening it. I pumped into John Walubengo last evening and proposed that perhaps in a week or two we should have a brief brainstorm bringing together all interested parties so we can concretise our 'Kenya Position' on this convention. Further to this conversation, I asked my colleagues Victor and Eunice at the ICTA and Francis Wangusi at CCK to explore possibilities of collating all the ideas emanating from this forum and setting up a sit down to tie up our discussions a head of the Heads of State Summit in January.<br>
><br>
> Grace- I very sincerely appreciate the initiative to drive this discussion and look forward to further engagement.<br>
><br>
> Good day.<br>
><br>
> Fred<br>
><br>
><br>
>> On Tue, Nov 26, 2013 at 9:23 PM, Grace Githaiga <<a href="mailto:ggithaiga@hotmail.com" target="_blank">ggithaiga@hotmail.com</a>> wrote:<br>
>> Good morning Listers<br>
>><br>
>><br>
>><br>
>> Today, we move onto PART II: PERSONAL DATA PROTECTION and will tackle four questions.<br>
>><br>
>><br>
>><br>
>> Objectives of this Convention with respect to personal data<br>
>><br>
>><br>
>><br>
>> Article II ? 2:<br>
>><br>
>> Each Member State of the African Union shall put in place a legal framework with a view to establishing a mechanism to combat breaches of private life likely to arise from the gathering, processing, transmission, storage and use of personal data.<br>
>><br>
>> The mechanism so established shall ensure that any data processing, in whatsoever form, respects the freedoms and fundamental rights of physical persons while recognizing the prerogatives of the State, the rights of local communities and the target for which the businesses were established.<br>
>><br>
>><br>
>><br>
>> Question: What is the relevance of this article? What are these state prerogatives? And given the increased interest of state surveillance, how can states balance respect of FOE while recognising state prerogatives?<br>
>><br>
>><br>
>><br>
>> Article II-6, II-7, 11-8, II-11, II-12, II-13 refer to a Protection Authority which is meant to establish standards for data protection. Article II ? 14 provides for each Member State of the African Union to establish an authority with responsibility to protect personal data. It shall be an independent administrative authority with the task of ensuring that the processing of personal data is conducted in accordance with domestic legislations.<br>
>><br>
>> Further, article II-17 states that ?Sworn agents may be invited to participate in audit missions in accordance with extant provisions in Member States of the African Union?.<br>
>><br>
>><br>
>><br>
>> Question: Considering that this article seems to be tied to the Protection Authority, what is its relevance? And who is a ?sworn agent?? What should this authority look like in terms of its composition?<br>
>><br>
>><br>
>><br>
>> Article II ? 20:<br>
>><br>
>> ?Members of the protection authority shall not receive instructions from any authority in the exercise of their functions.<br>
>><br>
>> Article II ? 21:<br>
>><br>
>><br>
>> Member States are engaged to provide the national protection authority human, technical and financial resources necessary to accomplish their mission.<br>
>><br>
>><br>
>><br>
>> Question: It appears that this Data Protection Authority is envisaged to be fully government supported. Therefore, should we be talking of its independence? In what way should this article be framed so that it ensures independence of the Authority?<br>
>><br>
>><br>
>> Article II ? 28 to II-34 outlines six principles governing the processing of personal data namely:<br>
>> Consent and of legitimacy,<br>
>><br>
>> Honesty,<br>
>><br>
>> Objective, relevance and conservation of processed personal data,<br>
>><br>
>> Accuracy,<br>
>><br>
>> Transparency and<br>
>><br>
>> Confidentiality and security of personal data.<br>
>><br>
>> Under each of the specific principles, detailed explanation of how each should be undertaken is offered.<br>
>><br>
>><br>
>><br>
>> Question: Is this explanation and detailing of how to undertake each necessary in an international (regional) law necessary or needed? Is this legislation overkill?<br>
>><br>
>><br>
>><br>
>> Lets get your views on data protection concerns.<br>
>><br>
>><br>
>><br>
>> Rgds<br>
>><br>
>> GG<br>
>><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> kictanet mailing list<br>
>> <a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
>> <a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
>><br>
>> Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/fredmatiangi%40gmail.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/fredmatiangi%40gmail.com</a><br>
>><br>
>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
>><br>
>> KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
><br>
> _______________________________________________<br>
> kictanet mailing list<br>
> <a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
> <a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
><br>
> Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com</a><br>
><br>
> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
><br>
> KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20131127/cbd88e94/attachment.html" target="_blank">https://lists.kictanet.or.ke/pipermail/kictanet/attachments/20131127/cbd88e94/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
kictanet mailing list<br>
<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
<br>
<br>
------------------------------<br>
<br>
End of kictanet Digest, Vol 78, Issue 88<br>
****************************************<br>
</blockquote></div><br></div></div>