Introduction
The successful operation of various businesses and day-to-day activities often requires the collection and processing of personal data such as names, postal addresses, and driving licenses. It is important to recognize, however, that the collection and handling of personal data imposes a significant responsibility on the holder, as it pertains to the sensitive and crucial information of individuals. Personal data is defined as information about identifiable persons that is recorded in any form.
The United Republic of Tanzania legally recognizes the right to protection of personal data under Article 16(1) of the Constitution of 1977. This provision guarantees that every person is entitled to respect and protection of their person, the privacy of their person, their family, and matrimonial life, as well as respect and protection of their residence and private communication.
In recognition of the right to privacy and personal security as enshrined in the Constitution of United Republic of Tanzania enacted the Personal Data Protection Act CAP 44 of 2022, which aims to safeguard individual privacy and establish minimum requirements for the collection and processing of personal data. The Act applies to both private and public entities within mainland Tanzania and Tanzania Zanzibar.
Nature of Protected Data
The personal data protected by the Personal Data Protection Act includes information relating to race, national or ethnic origin, religion, age, or marital status of an individual, as well as data relating to an individual’s education, medical, criminal, or employment history. It also includes any identifying number, symbol, or other particulars assigned to an individual, the address, fingerprint, or blood type of the individual, and the name of an individual appearing on the personal data of another person relating to the individual, or where the disclosure of the name itself would reveal personal data about the individual. The Act also protects correspondence between the data controller and the data subject, which is explicitly or implicitly of a private or confidential nature.
The Personal Data Protection Commission
The Personal Data Protection Commission is established under section 6 of the Personal Data Protection Act, with the mandate to oversee the implementation and enforcement of the Act. The Commission is responsible for registering data collectors and processors, investigating personal data protection issues, inquiring into and taking measures against any matter that appears to the Commission to affect the protection of personal data and infringe on the privacy of individuals, advising the government on personal data protection issues, and adjudicating personal data protection disputes. The establishment of the commission is one of the measures taken by Tanzania to ensure that personal data is held in confidence and protected.
Registration of Data Controllers and Data Processors
The Personal Data Protection Act requires any person or organization that intends to collect or process data in Tanzania to be registered by the Commission. Upon registration, a certificate of registration will be issued by the Commission. Registered data controllers and data processors are subject to certain principles and responsibilities when dealing with personal data, including the duty to ensure the accuracy of the information collected and to confirm that the data collected is complete, correct, and consistent with the purpose for which it was collected. The use of personal data for other purposes is authorized if the data subject has given their consent, if the purpose for which the personal data is used is directly related to the purpose upon which the data was collected, or if the use of personal data is authorized or required by law. The data controller is not required to disclose personal data to any other person except the data subject, unless the disclosure complies with the conditions set by the Act.
Disclosure of Personal Data
The Personal Data Protection Act allows for the disclosure of personal data in certain circumstances, including where the data subject has authorized the disclosure, where the disclosure purpose is authorized by law, and where the disclosure purpose is directly related to the purpose for which the personal data was collected. Personal data may also be disclosed if the data controller believes that the disclosure is necessary to protect the public from serious threats to life, health, or safety, or if the disclosure does not identify the subject. Personal data may also be disclosed for statistical research, as long as it is not published in a way that could reasonably identify the subject, or if the disclosure is necessary per the requirement of the law.
Deletion of Personal Data
The law requires that personal data be held for a specified period of time as determined by law.
Rights of Individuals and Enforcement of the law
The Personal Data Protection Act in Tanzania grants individuals the right to access, rectify, and delete their personal data. The act also prohibits the processing of data for direct marketing purposes. The Personal Data Protection Commission resolves disputes and ensures compliance with data protection regulations. If an individual’s data is infringed upon, they can approach the commission for redress. The commission conducts a confidential investigation and can issue an enforcement notice or levy a penalty. If dissatisfied with the decision, an appeal can be made to the High Court.
NB
At Lawfic Attorneys, our team stands ready to provide comprehensive assistance with all aspects of the data protection and enforcement of rights. We invite you to contact us today to learn more about how we can help you navigate the complex and ever-changing landscape of data protection law.
