Ethiopia

Article 43(1) requires a data controller, where there is a personal data breach, to notify the breach to the Authority within 72 hours after having become aware of it, and article 43(2) requires a notification made outside that period to be accompanied by reasons for the delay. Article 43(3) requires a data processor to notify the data controller without undue delay after becoming aware of a personal data breach.

Article 43(4) fixes what the notification to the Authority must contain: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its adverse effects, with information supplied in phases without undue further delay where it cannot all be given at once.

Article 43(6) requires the data controller to document every personal data breach, its facts, effects and remedial action, so that the Authority can assess compliance.

Article 44(1) requires the controller to communicate the personal data breach to the data subject within 72 hours after having become aware of it, in clear language and with the article 43(4) information on contact point, consequences and measures, and article 44(3) excuses that communication only where the affected data were protected by measures such as encryption that render them unintelligible, where subsequent measures have made the high risk no longer likely to materialize, or where direct communication would involve disproportionate effort and a public communication of equal effect has been made; article 44(4) lets the Authority require the communication anyway.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

Article 3 applies the Proclamation to processing personal data wholly or partly by automated means, and to other processing where the data form part of a filing system, by a data controller or data processor established in Ethiopia or using equipment in Ethiopia and represented there; it reaches private and public institutions of the federal and regional governments alike, and its exceptions are exhaustive, covering only an individual's purely personal or household activity, need-to-know exchange between government agencies, restricted application, and data merely transiting Ethiopia.

Article 7 bars processing unless one of the listed conditions is met, beginning with the data subject's consent and running through contractual necessity, a legal obligation, vital interests, a public health crisis or national emergency, and legitimate interests that the data subject's fundamental rights do not override.

Article 8 requires consent to be free, informed, specific and clear, to be requested separately from other terms rather than bundled with them, and to be withdrawable at any time, with the burden of proving consent on the data controller.

Articles 12 to 15 carry the fairness, transparency, purpose-limitation, accuracy and storage-limitation principles, and articles 16 and 17 require appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage, including pseudonymization and encryption, the ability to restore access after a physical or technical incident, and regular testing of those measures.

Article 33 makes registration with the Authority a precondition of processing personal data, articles 34 to 39 govern refusal, effects, change, removal and cancellation of that registration, and article 40 requires a data protection officer where processing is carried out by a government body, where core activities require regular and systematic monitoring of data subjects on a large scale, or where core activities involve large-scale processing of sensitive personal data.

Article 46 requires a record, including logs, of all processing operations, article 47 requires a data protection impact assessment before processing that may risk data subjects' rights and freedoms, article 48 requires prior authorization from or consultation with the Authority in the cases it lists, article 49 requires data protection by design and by default, and article 50 requires personal data to be destroyed as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents reconstruction.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

Article 18 permits the transfer of personal data to a third-party jurisdiction only subject to the Proclamation and only where that jurisdiction ensures appropriate levels of protection.

Article 19 requires that level to be assessed before the transfer in the light of all the circumstances, with particular regard to the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the rules of law, professional rules and security measures in force in the third-party jurisdiction; where protection is absent the Authority may still authorize a limited form of transfer, provided the data subject's rights are not violated, the data subject consents and those aspects of the data the Authority deems appropriate are severed or reduced, and otherwise the transfer is prohibited.

Article 20 lets a data controller or data processor transfer personal data where it has proved appropriate protection to the Authority and the Authority has so determined, where the data subject has given explicit consent after being informed of the possible risks, where the transfer is necessary in one of the listed senses, or where the transfer is made from a register intended by law to inform the public.

Article 21 lets the Authority require a transferor to demonstrate the effectiveness of its security safeguards and the existence of compelling legitimate interests, and lets it prohibit, suspend or condition the transfer to protect data subjects.

Article 22 requires every data controller and data processor to store personal data collected or obtained locally on a server or data center located in Ethiopia, lets the Authority prescribe categories of critical personal data that may be processed only on a server or data center in Ethiopia, and makes cross-border transfer of sensitive personal data subject to the Authority's prior approval.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

Article 31(1) gives every data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them, the right to obtain human intervention from the data controller, and the right to express their views on the matter.

Article 31(2) lifts that right where the decision is necessary for a contract with the data subject, is authorized by a law that lays down suitable safeguards, or is based on the data subject's explicit consent. Article 31(3) bars an automated evaluation of personal aspects relating to an individual from being based on sensitive personal data.

Where a decision rests on a contract or on explicit consent, article 31(5) requires the controller to put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.

Article 24 gives a data subject the right to be told the controller's and any representative's name and contact details, the data protection officer's contact details, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, the rights available including withdrawal of consent and complaint to the Authority, the existence of automated decision-making including profiling, and the categories of personal data processed; where the data were not obtained from the data subject the categories obtained and their source are added, and the information is due when the data are obtained, or otherwise within a reasonable period and at the latest within one month, or by the first communication or first disclosure if either comes sooner.

Article 25 gives a right of access, at reasonable intervals, free of charge and without excessive delay, to confirmation of processing, the data in an intelligible form, their origin, the storage period and the article 24 transparency information, in electronic or hard copy at the data subject's preference, and article 26 lists the narrow grounds on which access may be refused, each refusal to be given in writing with detailed reasons.

Article 27 gives a right to rectification and requires the controller to pass a correction on to anyone the data were disclosed to in the year before the request, article 28 gives a right to erasure on the listed grounds, article 29 gives a right to object, including an unqualified stop to direct marketing and the profiling related to it, article 30 gives a right to restriction of processing, and article 32 gives a right to data portability in a structured, commonly used and machine-readable format, free of charge and without excessive delay.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

Article 55 lets the Ethiopian Communications Authority serve an enforcement order on a data controller or data processor that has contravened, is contravening or is about to contravene the Proclamation, specifying the provision at issue, the measures to be taken, a period of not less than twenty-one days in which to take them, and the right of appeal; on complying, the recipient must tell the data subject concerned and, where compliance materially modifies the data, anyone the data were disclosed to in the twelve months before the order.

Article 56 lets the Authority request information from anyone, in a form that can be taken away and is intelligible and retrievable, and article 57 lets its monitoring arise from its own staff's work or from information and complaints.

Article 58 gives a data subject the right to complain in writing to the Authority, requires the Authority to investigate unless the complaint is not made in good faith and to give its decision in writing within twenty-one days, and allows an appeal to the Federal High Court within sixty days.

Article 59 requires administrative fines to be effective, proportional and dissuasive and lists the factors that set them, and article 60 gives the Authority power to impose administrative penalties for processing in contravention of the Proclamation, rising to a fine of up to four per cent of total worldwide turnover of the preceding financial year where the offence was committed by an institution, in relation to sensitive data, or against a minor's personal data, with any gain made going to the government.

Article 63 puts the burden of proving an exemption on the data controller that refused a data subject's request.

Article 64 sets the criminal tiers: one to three years' simple imprisonment or 60,000 to 100,000 Birr for failing to notify a personal data breach, failing to implement technical and organizational measures, or processing in contravention of the Proclamation; three to five years or 100,000 to 200,000 Birr for denying a data subject's rights of erasure, objection, restriction or protection against automated decisions; five to ten years or 200,000 to 600,000 Birr for re-identifying de-identified data, selling personal data or transferring it out of Ethiopia unlawfully; and the same four per cent of worldwide turnover where the offence involves an institution, serious damage, sensitive personal data or a minor's personal data.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

Article 9(1) prohibits the processing of sensitive personal data outright, and article 9(2) permits it only in the listed cases: the data subject's written consent, specific to the purpose and given before the processing, unless a law bars the data subject from lifting the prohibition; protecting the life or health of the data subject or another person where the data subject cannot express consent; the lawful non-commercial objectives of public organizations; medical treatment carried out by a medical treatment institution; and the protection of lawful rights and interests in court or other public proceedings, or processing by a not-for-profit body with a political, philosophical, religious or trade union aim that relates solely to its members and is not disclosed outside it without consent.

Article 9(3) bars processing sensitive personal data in respect of race or ethnic origin unless it ensures justice and equality on those grounds and carries appropriate safeguards, and article 9(4) permits the listed cases only where appropriate technical and security safeguards are in place. Article 10 lets a Regulation add further categories of sensitive personal data.

Article 11 requires a minor's personal data to be processed in a manner that protects and advances the minor's rights and best interests, with the burden of proof on the data controller, and makes that processing lawful only where consent is given or authorized by the minor's parent, guardian or tutor, or where the processing is necessary to the minor's vitally important interest; the data controller must make reasonable efforts to verify the data subject's age and that the consent came from a parent or guardian, taking available technology into account, and processing a minor's personal data for marketing, profiling or merging of profiles is not allowed at all.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

Article 2(10) defines access to include to view, receive, move or copy data from a computer system. Article 3 punishes intentionally securing access to the whole or any part of a computer system, computer data, or network, without authorization or in excess of authorization, with simple imprisonment up to three years or a fine of Birr 30,000 to 50,000.

Where the target of an Article 3 offence is a system, data or network destined exclusively for a legal person, the penalty rises to rigorous imprisonment of three to five years and a fine of 30,000 to 50,000. Where the target of an Article 3 offence is critical infrastructure, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000.

Article 4 punishes intentionally intercepting non-public computer data or a data-processing service, without authorization or in excess of authorization, with rigorous imprisonment up to five years and a fine of 10,000 to 50,000. Where the target of an Article 4 offence is data or a data-processing service destined exclusively for a legal person, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000.

Where the target of an Article 4 offence is critical infrastructure, the penalty rises to rigorous imprisonment of ten to fifteen years and a fine of 100,000 to 200,000.

Article 5 punishes intentionally hindering, impairing, interrupting or disrupting the proper functioning of the whole or any part of a computer system by inputting, transmitting, deleting or altering computer data, without authorization or in excess of authorization, with rigorous imprisonment of three to five years and a fine of up to Birr 50,000.

Where the target of an Article 5 offence is a computer system destined exclusively for a legal person, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000. Where the target of an Article 5 offence is critical infrastructure, the penalty rises to rigorous imprisonment of ten to fifteen years and a fine of 100,000 to 200,000, or in a serious case fifteen to twenty years and a fine of 200,000 to 500,000.

Article 6 punishes intentionally altering, deleting or suppressing computer data, or rendering it meaningless, useless or inaccessible to authorized users, without authorization or in excess of authorization, with rigorous imprisonment of up to three years and a fine of up to Birr 30,000. Where the target of an Article 6 offence is data destined exclusively for a legal person, the penalty rises to rigorous imprisonment of three to five years and a fine of 30,000 to 50,000.

Where the target of an Article 6 offence is critical infrastructure, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000. Article 9 punishes falsifying computer data, making false computer data or making use of such data to injure the rights or interests of another or to procure an undue right or advantage.

Computer-related forgery under Article 9 carries simple imprisonment of up to three years and a fine of up to Birr 30,000, or in serious cases rigorous imprisonment of up to ten years and a fine of 10,000 to 100,000.

Article 10(1) punishes fraudulently causing a person to act in a manner prejudicial to his own rights or those of a third person by distributing misleading computer data, misrepresenting his status, concealing facts he had a duty to reveal or taking advantage of the person's erroneous beliefs, with rigorous imprisonment of up to five years and a fine of up to Birr 50,000.

Article 10(2) punishes causing economic loss to another person, with fraudulent intent of procuring a benefit, by any change, deletion or other damage of computer data, with rigorous imprisonment of up to five years and a fine of 10,000 to 50,000, or in serious cases rigorous imprisonment of up to ten years and a fine of 10,000 to 100,000.

Article 16 makes a service provider criminally liable for illegal content data that a third party disseminates through the provider's own computer systems, but only where the provider directly participated in disseminating or editing the content, or, on obtaining actual knowledge that the content is illegal or a notice from a competent administrative authority, failed to take measures to remove or disable access to it.

Article 17 punishes a person's failure to cooperate with an investigative obligation imposed under specified articles of the Proclamation with simple imprisonment up to one year or a fine up to Birr 10,000. Article 17 also punishes intentional hindrance of a computer-crime investigation with rigorous imprisonment up to five years and a fine up to Birr 50,000.

Where an offence under Part Two of the Proclamation is committed by a juridical person, Article 20 fixes a fine of Birr 50,000 to 500,000 for a crime punishable with fine. Where the penalty is imprisonment, Article 20(2) caps the fine at Birr 50,000 for simple imprisonment of up to three years, Birr 100,000 for simple imprisonment of up to five years, Birr 150,000 for rigorous imprisonment of up to five years and Birr 200,000 for rigorous imprisonment of up to ten years.

For rigorous imprisonment exceeding ten years the cap on a juridical person's fine is the general maximum of Birr 500,000 stated in Article 20(1). Article 20(3) adds that where fine is expressly provided as punishment for a crime, it shall be five fold. None of these provisions exempts a publicly accessible, unauthenticated page from the definition of unauthorized access.

The Copyright and Neighbouring Rights Protection Proclamation No. 410/2004 defines a database as an aggregate of information, articles, or numerical data or diagrams that is systematically constructed so that it can be searched for with the aid of a computer. A collection of works such as an encyclopedia, anthology, or database, whether in machine-readable or other form, is protected as a work only where the collection is original by reason of the selection or arrangement of its contents.

Ethiopia has no separate sui generis database right. The Proclamation's exception permitting a single-copy personal reproduction of a published work does not extend to reproducing the whole or a substantial part of a database in digital form. Reproducing or communicating a protected work without authorization, outside the Proclamation's exceptions, is punishable under its criminal-sanctions article.

Proclamation No. 872/2014 adds a fine of Birr 25,000 to 50,000 to the imprisonment for an intentional violation of a protected right. It adds a fine of Birr 5,000 to 25,000 to the imprisonment for a violation by gross negligence.

The Information Network Security Administration may designate a critical infrastructure owner under Article 5. A designated owner sits in one of twelve named sectors, including information technology and communication, finance, transport, education, health, water and energy, government services, disaster management, agriculture, trade, and industry.

A designated owner must formulate and implement its own cybersecurity program based on the Administration's mandatory national cybersecurity frameworks. A designated owner must hold a current cyber-audit certificate and a cybersecurity inspection-and-evaluation certificate that the Administration issues. A designated owner must ensure the security of the supply chain of the technology products it uses.

A designated owner must obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system. A designated owner must establish and manage a center responsible for monitoring, reporting, and responding to cyberattacks. An owner may perform these obligations itself or delegate them to a person providing cybersecurity services licensed under this Proclamation.

The Administration may identify infrastructure whose cybersecurity service may not be delegated on national-security grounds.

Not implementing a mandatory framework in time is fined from 500,000 to 1,000,000 Birr, not cooperating with a periodic audit is fined from 1,500,000 to 2,000,000 Birr, and not correcting an audit or inspection finding in time, or using an information and communication technology system that has not undergone the required inspection and evaluation, is each fined from 800,000 to 1,000,000 Birr, with a negligent violation of any of these fined at no more than half the stated amount, a first violation causing no damage resolved with a written warning instead, and a repeat violation fined at triple the stated maximum.

A critical infrastructure officer, employee, manager, or owner who intentionally commits the underlying failure is separately liable to imprisonment of up to one year, a term that rises to rigorous imprisonment of seven to ten years, or three to five years if committed negligently, where the failure damages the infrastructure's service or harms national security, national interest, public health, life, or the environment.

The Proclamation was published in the Federal Negarit Gazette, Year 32, No. 41, on 21 July 2026. Under its own Article 28, it enters into force one year later, on 21 July 2027.

Article 3 applies the Directive to all insurance companies and an Ethiopian reinsurer. Article 6.1 requires an insurance company to put in place and implement an IT risk management program aligned with its risk management program. Article 6.3 requires it to take into account the cyber security risk management requirements provided by the Information Network Security Agency.

Article 6.4 requires an insurance company to conduct a quarterly IT risk assessment and present the report to its board of directors. Article 6.5 requires the report to reach the Insurance Supervision Directorate of the National Bank within 30 calendar days after the end of each quarter. Article 6.6 requires an insurance company to maintain an IT risk register and update it quarterly.

Article 7.2 requires its IT risk management policies to cover an incident response plan, hardware, software and network maintenance, database and backup management and access, and IT change and patch management. Article 7.2 also requires them to cover password, data transfer security, user right access, antivirus and firewall security. Article 8.1 requires an insurance company to prepare an annual IT security awareness plan.

Article 9.1 requires an insurance company to establish an IT audit function within its internal audit function. Article 9.5 requires IT audit at least quarterly, with the findings reported to the board audit committee. Article 13 brings the Directive into force on 4 April 2022. Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date.

Article 12.2 says an insurance company that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Article 64(2) of the Insurance Business Proclamation No. 746/2012, as amended by Proclamation No. 1163/2019.

Article 58(2) of Insurance Business Proclamation No. 746/2012, as published in 2012, lets the National Bank issue directives necessary for its implementation. Article 57(7) of that Proclamation punishes any person who contravenes or obstructs directives issued under it with imprisonment up to three years and a fine up to Birr 10,000.

Article 3 applies the Directive to all banks operating in Ethiopia. Article 6.1 requires a bank to put in place and implement an IT risk management program aligned with its risk management program. Article 6.3 requires it to take into account the cyber security risk management requirements provided by the Information Network Security Agency. Article 6.4 requires a bank to conduct a quarterly IT risk assessment and present the report to its board of directors.

Article 6.5 requires the report to reach the Banking Supervision Directorate of the National Bank within 30 calendar days after the end of each quarter. Article 6.6 requires a bank to maintain an IT risk register and update it quarterly. Article 7.2 requires its IT risk management policies to cover an incident response plan, hardware, software and network maintenance, database and backup management and access, and IT change and patch management.

Article 7.2 also requires them to cover password, data transfer security, user right access, antivirus and firewall security. Article 8.1 requires a bank to prepare an annual IT security awareness plan. Article 9.1 requires a bank to establish an IT audit function within its internal audit function. Article 9.5 requires IT audit at least quarterly, with the findings reported to the board audit committee. Article 13 brings the Directive into force on 1 April 2022.

Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date. Article 12.2 says a bank that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Article 65(2) of the Banking Business Proclamation No. 592/2008, as amended by Proclamation No. 1159/2019.

Article 94(1) of Banking Business Proclamation No. 1360/2024 repeals Proclamation No. 592/2008 and the amending Proclamation No. 1159/2019. Article 93 of that Proclamation keeps existing National Bank Directives in effect, so far as they are consistent with it, until they are amended. Article 91(2) of that Proclamation lets the National Bank issue Directives necessary for its implementation.

Article 32(1) of that Proclamation applies where an examination of a bank results in a finding that it has failed to comply with the relevant laws and Directives. Article 32(1)(e) of that Proclamation lets the National Bank impose fines on the bank as determined by National Bank Directive. Article 90(7) of that Proclamation punishes any person who contravenes or obstructs Directives issued to implement it with a fine up to Birr 50,000 and imprisonment up to 3 years.

A service provider is any person who provides technical data-processing or communication service or alternative infrastructure to users by means of a computer system.

Any service provider, or any government organ, that has knowledge that a crime under this Proclamation is being committed, or that a third party is disseminating illegal content data, through the computer system it administers, must immediately notify the Information Network Security Agency, now reconstituted as the Information Network Security Administration, report the crime to the police, and take appropriate measures. The Agency may issue a directive on the form and procedure of that report.

No provision of this Proclamation attaches a penalty specifically to a failure to comply with this reporting duty: the separate failure-to-cooperate offense in Article 17 lists five other, unrelated investigatory-assistance articles and does not name Article 27. The Proclamation entered into force on the date of its own publication in the Federal Negarit Gazette, Year 22, No. 83, on 7 July 2016, and no provision found here has repealed or amended Article 27 since.

The Information Network Security Administration may designate a critical infrastructure owner under Article 5. A designated owner sits in one of twelve named sectors, including information technology and communication, finance, security and safety, and health. A designated owner must notify the National Computer Emergency Response Center of a cyber incident within 48 hours of becoming aware of it, and must implement the mandatory recommendations or directions the Center provides.

A designated owner must also give the Center the information it requests and cooperate with its activities when it is responding to a cyberattack. Failing the 48-hour notification or corrective-action duty is fined from 1,500,000 to 2,000,000 Birr.

Failing to cooperate with the Center's response activities is fined from 300,000 to 500,000 Birr, with a negligent violation of either fined at no more than half the stated amount, a first violation causing no damage resolved with a written warning instead, and a repeat violation fined at triple the stated maximum.

A critical infrastructure officer, employee, manager, or owner who intentionally commits either failure is separately liable to imprisonment of up to one year, a term that rises to rigorous imprisonment of seven to ten years, or three to five years if committed negligently, where the failure interrupts or damages the infrastructure's service or harms national security, national interest, public health, life, or the environment.

The Proclamation was published in the Federal Negarit Gazette, Year 32, No. 41, on 21 July 2026. Under its own Article 28, it enters into force one year later, on 21 July 2027.

Article 3 applies the Directive to all insurance companies and an Ethiopian reinsurer. Article 10.1 requires an insurance company to notify the Insurance Supervision Directorate of the National Bank, within two working days, of any IT incident that could have significant impact on its ability to provide services to its customers or adversely affect its reputation or financial condition.

Article 10.2 requires an insurance company to submit to the Insurance Supervision Directorate every quarter a report on its ongoing handling of IT incidents. Article 13 brings the Directive into force on 4 April 2022. Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date.

Article 12.2 says an insurance company that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Article 64(2) of the Insurance Business Proclamation No. 746/2012, as amended by Proclamation No. 1163/2019.

Article 58(2) of Insurance Business Proclamation No. 746/2012, as published in 2012, lets the National Bank issue directives necessary for its implementation. Article 57(7) of that Proclamation punishes any person who contravenes or obstructs directives issued under it with imprisonment up to three years and a fine up to Birr 10,000.

Article 3 applies the Directive to all banks operating in Ethiopia. Article 10.1 requires a bank to notify the Banking Supervision Directorate of the National Bank, within two working days, of any IT incident that could have significant impact on its ability to provide services to its customers or adversely affect its reputation or financial condition. Article 10.2 requires a bank to submit to the Banking Supervision Directorate every quarter a report on its ongoing handling of IT incidents.

Article 13 brings the Directive into force on 1 April 2022. Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date. Article 12.2 says a bank that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive.

The Directive recites that the National Bank of Ethiopia issued it under Article 65(2) of the Banking Business Proclamation No. 592/2008, as amended by Proclamation No. 1159/2019. Article 94(1) of Banking Business Proclamation No. 1360/2024 repeals Proclamation No. 592/2008 and the amending Proclamation No. 1159/2019. Article 93 of that Proclamation keeps existing National Bank Directives in effect, so far as they are consistent with it, until they are amended.

Article 91(2) of that Proclamation lets the National Bank issue Directives necessary for its implementation. Article 32(1) of that Proclamation applies where an examination of a bank results in a finding that it has failed to comply with the relevant laws and Directives. Article 32(1)(e) of that Proclamation lets the National Bank impose fines on the bank as determined by National Bank Directive.

Article 90(7) of that Proclamation punishes any person who contravenes or obstructs Directives issued to implement it with a fine up to Birr 50,000 and imprisonment up to 3 years.

Article 30(1) requires a person who sends unsolicited commercial communications to consumers to provide the consumer with the option to cancel his subscription from that person's mailing list. Article 30(2) requires that person to provide, upon the consumer's request, the particulars of the source from which he obtained the consumer's personal information. Article 30(3) provides that no agreement is concluded where a consumer has failed to respond to an unsolicited communication.

The Ministry of Justice law library lists the Proclamation as in force and dated 30 June 2020. Article 46 provides that the Proclamation enters into force as of the date ratified by the House.

Article 2(23) defines an intermediary as a person who, on behalf of another person, sends, receives or stores an electronic message or provides other services with respect to that electronic message. Article 23 provides that an intermediary supplying services of transmission of information, or offering access to online public communication, is not held liable for the information transmitted on condition that it does not monitor the online communication and does not initiate the transmission.

Article 23 also conditions that protection on the intermediary not selecting the receiver of the transmission and not selecting or modifying the information contained in the transmission.

Article 24 provides that an intermediary is not liable for the automatic, intermediate and temporary storage of an electronic record made to make the onward transmission of the electronic message more efficient to other recipients who requested it, as long as the intermediary meets the conditions the article lists. Article 24 lists as one of those conditions that the intermediary removes or disables access to the electronic message it has stored upon receiving a take-down notice.

Article 25(1) provides that an intermediary that provides a service comprising the storage of electronic messages is not liable for damages arising from information stored, as long as it is not aware that the information infringes the right of third parties, it took all necessary measures to withdraw the information or make access to it impossible immediately after becoming aware of its unlawful character, or upon receipt of a take-down notification it acts expeditiously to remove or disable access to the information.

Article 25(2) denies that limitation on liability to a service provider unless it has designated an agent to receive notifications of infringement and has provided through its services, including on its website, the agent's name, address, phone number and email address. Article 25(3) provides that the limitation in article 25(1) does not apply if the recipient of the service works with the service provider.

Article 26 provides that an intermediary is not liable for damages incurred when it refers or links users to a website containing infringing electronic messages or infringing activities, where the conditions the article lists are met. Article 26 lists among those conditions that the intermediary removes, or disables access to, the information relating to the electronic message within a reasonable time after being informed that the electronic message infringes the rights of third parties.

Article 27(1) provides that a person who has complaints about information made available to third parties shall notify the complaints about the unlawful activity, in writing, to the intermediary or to the concerned service provider or its designated agent.

Article 27(2) provides that the notification includes the complainant's full name, address, telephone number and electronic mail contacts, the complainant's written or electronic signature, and the rights that have been infringed and the justification of the unlawful activity. Article 27(2) also provides that the notification includes the remedial action required to be taken in order to resolve the dispute and a statement by the complainant that the information provided is true and correct.

Article 27(3) makes a person who lodges a notification knowing that it materially misrepresents the facts liable for damages for wrongful take-down. Article 27(4) provides that an intermediary is not liable for a takedown in response to a wrongful notification. Article 25(1)(c) makes acting expeditiously to remove or disable access to the information upon receipt of a take-down notification under the Proclamation a condition of the hosting limitation on liability.

Article 10 of the Copyright and Neighbouring Rights Protection Proclamation No. 410/2004 provides that the owner of copyright cannot forbid the reproduction of a quotation of a published work. The quotation must be compatible with fair practice and must not exceed the extent justified by the purpose. Where the quotation is taken from a source that carries the author's name, the quotation must name both the source and the author.

Neighbouring rights under the same Proclamation protect only performers, producers of sound recordings, and broadcasting organizations, so a print or online news publisher holds no neighbouring right distinct from its ordinary copyright in the articles it publishes. No provision addresses hyperlinking, framing, or inline display, and no reported case law applies art. 10 to a systematic aggregator rather than an individual quoting a published work.