1. Johannesburg, South Africa
THE AU (MALABO) CONVENTION ON CYBERSECURITY AND PERSONAL DATA PROTECTION
Capacity Development Workshop for African GAC members, Law Enforcement and Consumer Protection Agencies
23-24 June 2017
Johannesburg, South Africa

2. The Road to the Malabo Convention
2009 O R Tambo Declaration
2010 – AU Summit endorsement
– Abuja Declaration (STC-CICT)
2011 First Draft: “AU Convention on the Confidence and Security in Cyberspace”
2012 – Khartoum Declaration
endorsement of draft by AU STC-CICT)
Stakeholder consultations
2013 online petition against the Convention
2014 Legal Validation by STC on Justice
2014 Adoption: “AU Convention on Cybersecurity and Protection of Personal Data”

3. Malabo Convention Strategic Orientation
Options for an African Union wide cyber security policy;
Foundation for an African Union wide cyber ethics and fundamental principles for cyber security;
Foundation for legal framework for electronic commerce;
Legal and institutional framework for protection of personal data;
Foundation for a penal cyber law and a penal procedure for the treatment of cyber crime.

4. Malabo Convention At-a-glance
Objectives - harmonize e-legislation, protect personal data, promote cyber security, fight cybercrime
Define key cyber terminologies in legislation
Develop general principles and specific provisions related to cyber legislation
Outline cyber legislative measures required at Member State level
Develop general principles and specific provision on international cooperation

5. Malabo Convention At-a-glance
Electronic transactions,
Personal data protection,
Cyber security and cybercrime
Requires member states to:
develop national cyber security policy
develop legislation on cybercrime
ensure the protection of critical information infrastructure
enact personal data protection laws

6. PDP in the Malabo Convention
Establish a mechanism which shall ensure that any form of data processing respects the fundamental freedoms and rights of natural persons while recognizing the prerogatives of the State.
Each Member State shall commit itself to develop a legal and institutional framework for the protection of personal data and establish the national protection authority
Establish mechanisms for cooperation with the personal data protection authorities of third countries and participate in international negotiations on personal data protection

7. PDP Provisions of the Malabo Convention
Section 1: Personal Data Protection  
Objective of this Convention with respect to personal data
Scope of application of the Convention
Preliminary personal data processing formalities 
Section 2: Institutional framework for the protection of personal data 
Status, composition and organization of National PDP Authorities
Duties and Powers of National PDP Authorities 
Section 3: Obligations relating to conditions governing PD data processing 
Basic principles governing the processing of PD (6 principles)
Specific principles for the processing of sensitive data
Interconnection of personal data files

8. PDP Provisions of the Malabo convention
Section 4: The Data Subjects’ Rights
Right to information
Right to access
Right to object
Right to rectification and erasure
Section 5: Obligations of the Personal Data Controller
Confidentiality obligations
Security obligations
Storage obligations
Sustainability obligations

9. Malabo Convention – What is at Stake?
African countries with legislation
Electronic Transactions:  28 (51%)
Consumer Protection:  18 (33%)
Privacy and Data Protection:  22 (40%)
Cybercrime:  27 (49%)
(Source: UNCTAD)

10. E-Commerce
Source: UNCTAD

11. E-transactions
Source: UNCTAD

12. Data Protection & Privacy
Source: UNCTAD

13. Cybercrime
Source: UNCTAD

14. Consumer Protection
Source: UNCTAD

15. Current status and Way Forward
15 Ratifications required for entry into force
Signatures: Benin, Cape Verde, Comoros, Congo, Guinea Bissau, Mauritania, Sierra Leone, Sao Tome and Principe, and Zambia have signed the convention
2 Ratifications: (Sénégal 3/8/2016, Guinea 1/06/17)

16. Recommendations Development of national cybersecurity legislation
Training of stakeholders (magistrates, law enforcement officers, prosecutors, investigation officers, etc.)
Technical and institutional capacity building
Awareness programs on Cybercrime and PDP
Public-private partnerships (PPPs) for cybersecurity and combating cybercrime

17. Recommendations
Cooperation between national authorities & stakeholders
Coordination and communication at national and regional level
Inclusiveness - need for all stakeholders (civil society, government, private sector, academic) to be involved in national and regional processes.
Financial resources – setting up of institutions, capacity building, monitoring and enforcement

18. THANK YOU FOR YOUR ATTENTION
***
AU Information Society Division:
Malabo Convention: