Introduction
Cameroon’s enactment of Law No. 2024/017 on the Protection of Personal Data marks a pivotal moment in its legislative evolution. In a digital era where information is a critical asset, safeguarding personal data has become a cornerstone of modern governance. Cameroon’s recent enactment of the Personal Data Protection Act is a bold step forward, reflecting the country’s commitment to aligning with international data privacy standards while addressing unique local challenges and opportunities within its local context. This legislation not only protects individual privacy but also fosters a secure environment for innovation and business growth, ensuring Cameroon’s digital ecosystem remains resilient and trustworthy.
The Legal Context
The new Act affirms Cameroon’s recognition of the right to privacy as a fundamental principle, as enshrined in its Constitution. The preamble of the Constitution explicitly declares that “the privacy of all correspondence is inviolate” and that “no interference may be allowed except by virtue of decisions emanating from the Judicial power.” This constitutional guarantee serves as the foundation for the Act, which addresses the growing prevalence of data breaches globally by establishing a comprehensive legal framework. The Act regulates the collection, processing, storage, and transfer of personal data both within Cameroon and across its borders, ensuring a balance between individual privacy and lawful data use.
Key Provisions of the Personal Data Protection Act
Consent as a Cornerstone (Sections 13-16):
The Act mandates that individuals’ explicit and informed consent must be obtained before their personal data is processed. Exceptions are made only in cases of national security, legal obligations, or the protection of vital interests. Section 13 particularly emphasizes that consent must be freely given, specific, and revocable at any time. For example, a user who no longer wishes to receive marketing emails should be able to easily opt out, ensuring their preference is respected and data processing ceases immediately.
Data Minimization (Sections 17-19):
Entities are required to collect only the personal data necessary for their explicitly stated purposes, as stipulated in Section 17. The law also obliges organizations to implement measures ensuring that data processing remains proportionate and secure. Section 18 outlines the requirements for transparency and accountability in data collection and storage.
Rights of Data Subjects (Sections 20-25):
The Act introduces comprehensive rights for data subjects, including:
Right of Access (Section 20): Individuals have the right to access their personal data and receive information on how it is processed.
Right to Rectification (Section 21): Data subjects can request corrections to inaccurate or incomplete data.
Right to Erasure (“Right to Be Forgotten,” Section 22): Individuals can request the deletion of their data under specific conditions, such as when the data is no longer necessary for the purpose it was collected.
Right to Object (Section 23): Data subjects can object to processing activities, particularly for direct marketing or automated decision-making.
Cross-Border Data Transfer (Sections 26-30):
The Act imposes stringent conditions on the transfer of personal data to countries without adequate data protection laws. Section 26 specifies that such transfers can only occur if safeguards like binding corporate rules or standard contractual clauses are in place. Section 28 emphasizes the role of the regulatory authority in assessing the adequacy of protections in the recipient country.
Opportunities and Challenges
Opportunities:
Global Competitiveness: By embracing data protection standards, Cameroonian businesses enhance their trustworthiness, fostering international trade and partnerships.
Innovation and Growth: Compliance encourages organizations to adopt advanced data management technologies, driving innovation.
Adopting robust data protection practices not only enhances brand loyalty but also fosters long-term customer trust, creating a competitive advantage in the increasingly data-driven global marketplace
Challenges:
Awareness and Compliance: Compliance with the Act may be particularly challenging for small and medium-sized enterprises (SMEs), which often operate with limited financial resources, technical expertise, and awareness of regulatory requirements
Enforcement Mechanisms: Ensuring consistent enforcement and addressing potential abuse of exceptions, particularly those related to national security, will require the establishment of transparent oversight mechanisms and robust checks and balances.
Cost of implementation in appointing DPOs, training and cost of technology upgrades is challenging for most businesses
Strategic Compliance Recommendations
As Cameroon embarks on this transformative journey, legal advisors play a pivotal role in guiding stakeholders toward compliance while fostering a culture of accountability and ethical data use.
Developing Comprehensive Policies: Organizations should draft and implement tailored data protection policies that clearly outline protocols for data collection, processing, and storage, ensuring alignment with the Act’s requirements and fostering transparency.
Investing in Training: Regular training sessions for employees on data privacy principles and the specifics of the law will bolster compliance.
Leveraging Technology: Organizations should invest in cost-effective technologies, such as encryption, anonymization, and secure data management systems, to enhance data security and reduce the risk of breaches.
Appointing Data Protection Officers (DPOs): Designating a DPO to oversee compliance ensures organizations maintain accountability and adapt to evolving regulatory
Conclusion
The enactment of Cameroon’s Personal Data Protection Act represents a landmark achievement after years of negotiations, signalling a new era of accountability and trust in the nation’s digital landscape. The success of this legislation hinges on its effective implementation, which will require coordinated efforts among regulators, businesses, and civil society Building the capacity of data controllers, promoting public awareness through nationwide campaigns, community workshops, and partnerships with educational institutions will be critical in empowering citizens to understand and exercise their data privacy rights effectively.
Collaboration between the government, private sector, and civil society will be indispensable in navigating this transition. For instance, establish a public-private commission to monitor compliance, adopt data protection measures, and conduct nationwide campaigns to educate citizens on their data privacy rights. Such partnerships will ensure that enforcement is consistent, businesses are supported in achieving compliance, and the rights of individuals are safeguarded.
This legislation positions Cameroon to navigate the challenges/ complexities of the digital era with greater resilience and adaptability fostering a more inclusive, secure, and innovative digital ecosystem. By fostering trust, enhancing innovation, and ensuring inclusivity, the Act lays the groundwork for a safer and more equitable digital future. It is now up to all stakeholders to work together to realize the full potential of this transformative framework, creating a thriving ecosystem that benefits everyone.
Author: Achare Mbiwan Takor, Senior Associate, CLG Cameroon.
Do not hesitate to reach out to our team of lawyers and business advisors at CLG for any enquiries. We seamlessly guide our clients through Africa’s abundant investment opportunities and stand ready to assist you in fulfilling your reporting requirements.
[email protected]
[email protected]
