Processes personal data, in Ethiopia

Computer Crime Proclamation No. 958/2016, art. 2(13), art. 2(19), art. 17, art. 27, art. 46 · Read the law's page

• Immediately notify the Information Network Security Agency (now the Information Network Security Administration) and report the crime to the police, and take appropriate measures.
• This binds a service provider, defined as a person who provides technical data-processing or communication service or alternative infrastructure to users by means of a computer system, or a government organ; the trigger is knowledge that a crime under this Proclamation is being committed, or knowledge that a third party is disseminating illegal content through the computer system you administer, which on this definition's own terms reaches an app or platform operator whose product is itself that computer system, not only a network, hosting, or telecommunications intermediary.
• The Agency may issue a directive setting the form and procedure for this report; no such directive is confirmed as a separately published text in the primary sources located here.
• No provision of this Proclamation states a separate penalty for failing this reporting duty. The Article 17 offense for failing to cooperate with an investigation lists five other, unrelated articles on data retention, real-time collection, data preservation orders, data-production orders, and search assistance, and does not include this one.

Proclamation No. 1321/2024 (Federal Negarit Gazette), arts. 1-3, 6-8, 12-17, 33-42 and 45-52 · Read the law's page

• Have a lawful basis for processing personal data before collecting, storing, or otherwise processing it, whether by automated means or in a filing system.
• Register with the Ethiopian Communications Authority before processing personal data, and appoint a data protection officer where the Proclamation requires one.
• Take consent only where it is free, informed, specific and clear and requires an active action from the data subject, request it separately from other terms rather than bundled with them, let the data subject withdraw it at any time, and be able to prove it was given.
• Implement appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage, including pseudonymization and encryption, the ability to restore access to personal data after a physical or technical incident, and a process for regularly testing their effectiveness.
• Maintain a record, including logs, of all processing operations under your responsibility, covering the purposes, the categories of data subjects, personal data and recipients, any transfers to another country and their safeguards, and make it available to the Authority on request.
• Carry out a data protection impact assessment before processing that may risk data subjects' rights and freedoms, including systematic and extensive evaluation based on automated processing, large-scale processing of sensitive personal data, and systematic monitoring of a publicly accessible area on a large scale.
• Obtain the Authority's prior authorization where you cannot provide appropriate safeguards for a transfer to a third-party jurisdiction, and consult the Authority before processing where an impact assessment indicates the operations are likely to present a high risk.
• Destroy personal data as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents its reconstruction in an intelligible form, and tell any data processor holding the data to do the same.

Proclamation No. 1321/2024, arts. 18-22 (cross-border transfer and data sovereignty) · Read the law's page

• Before transferring personal data to a third-party jurisdiction, confirm the jurisdiction ensures an appropriate level of protection, obtain the data subject's informed consent, or meet another condition the Proclamation lists.
• Store personal data collected or obtained in Ethiopia on a server or data center located in Ethiopia, and keep any category of critical personal data the Authority prescribes on a server or data center there.
• Get the Authority's prior approval before any cross-border transfer of sensitive personal data.
• Assess the level of protection in the destination jurisdiction before the transfer, weighing the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the rules of law and security measures in force there.
• Be ready to demonstrate to the Authority the effectiveness of your security safeguards and the existence of compelling legitimate interests for a transfer, and abide by any prohibition, suspension or condition it imposes on one.

Proclamation No. 1321/2024, arts. 24-30, 32 (rights of data subjects) · Read the law's page

• Tell a data subject, when you obtain their personal data, who you are, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, their rights, and whether automated decision-making including profiling is in use; where the data came from elsewhere, add the categories obtained and their source, and give the information within a reasonable period and at the latest one month after obtaining it.
• Answer a request for access at reasonable intervals, free of charge and without excessive delay, with confirmation of processing, the data in an intelligible form, their origin and the storage period, in electronic or hard copy at the data subject's preference, and put any refusal in writing with detailed reasons.
• Correct inaccurate, incomplete, misleading or out-of-date personal data on request, free of charge and without excessive delay, and pass the correction on to every other data controller or third party the data were disclosed to in the year before the request.
• Erase personal data on request, free of charge and without excessive delay, where it is no longer necessary for its purpose, where consent is withdrawn and no other ground applies, where the data subject objects and no overriding legitimate ground exists, or where it was processed unlawfully, and take reasonable steps to tell third parties processing data you made public.
• Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.
• Restrict processing on request in the cases article 30 lists, keep the data stored but otherwise unused without the data subject's consent, and tell the data subject before lifting the restriction.
• Give a data subject their personal data in a structured, commonly used and machine-readable format on request, free of charge and without excessive delay, and transmit it directly to another controller or processor where that is technically possible.

Proclamation No. 1321/2024, arts. 43-44 (personal data breach notification) · Read the law's page

• Notify the Authority of a personal data breach within 72 hours of becoming aware of it, giving reasons for any delay.
• Communicate a personal data breach to the affected data subject within 72 hours of becoming aware of it, in clear language, describing the likely consequences, the contact point for more information and the measures taken to address it.
• As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.
• Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned, and supply information in phases without undue further delay where it cannot all be given at once.
• Document every personal data breach, its facts, its effects and the remedial action taken, so the Authority can assess compliance.

Proclamation No. 1321/2024, arts. 55-64 (enforcement, administrative sanctions and offences) · Read the law's page

• Comply with an enforcement order the Authority serves within the period it specifies, which is never less than twenty-one days, then tell the data subject concerned and, where compliance materially modifies the data, anyone it was disclosed to in the twelve months before the order was served.
• Furnish the Authority with information it requests, in a form that can be taken away and is intelligible and retrievable, and cooperate with it in discharging its powers and functions.
• Expect a data subject to be able to complain to the Authority in writing, and be ready to carry the burden of proving that an exemption applies wherever you refuse a data subject's request.
• Expect administrative penalties for processing in contravention of the Proclamation, reaching four per cent of total worldwide turnover of the preceding financial year where the offender is an institution or the offence concerns sensitive data or a minor's personal data, and criminal liability under article 64 on top of them.

Proclamation No. 1321/2024, arts. 9-11 (sensitive personal data and minors) · Read the law's page

• Do not process sensitive personal data, including genetic or biometric data, unless a listed exception applies, such as the data subject's specific written consent.
• Process a minor's personal data only with the consent or authorization of a parent, guardian, or tutor, or where necessary to the minor's vitally important interest, and never for marketing, profiling, or merging of profiles.
• Do not process sensitive personal data in respect of race or ethnic origin unless the processing ensures justice and equality with regard to race or ethnic origin and is carried out with appropriate safeguards for the data subject's rights and freedoms.
• Where an exception does permit sensitive personal data to be processed, put appropriate technical and security safeguards in place first.
• Make reasonable efforts to verify the age of a data subject, and that consent was given or authorized by the minor's parent or guardian, taking available technology into account.