I was recently invited by the Center for Human Rights, University of Pretoria to give a lecture in Public Participation in Data Protection. I drew alot of examples from KICTANet’s work in this subject.
I commenced my talk by noting that when Kenya’s Gen Z protesters translated the complex Kenya’s Finance Bill into local languages and shared simplified explanations across social media platforms, they demonstrated something profound about democratic participation in the digital age. Their success in mobilizing millions of citizens around technical policy issues offers crucial lessons for another equally complex domain: data protection governance.
Public participation in data protection represents a fundamental intersection between democratic governance and digital rights. In Africa, where 36 countries have enacted data protection laws as of 2024, the quality of public participation varies significantly, directly impacting the effectiveness and legitimacy of these frameworks. This variation is a concern, but also determines whether data protection laws serve citizens or merely exist on paper.
The African context presents unique challenges and opportunities for public participation. While countries like Kenya, Ghana, and Rwanda have pioneered inclusive approaches, others struggle with limited awareness, resource constraints, and weak enforcement mechanisms. This variation provides rich learning opportunities for understanding how local contexts shape participation strategies and, more importantly, how effective participation can transform data protection from technical regulation into lived democratic practice.
Why Public Participation Matters
The traditional approach to data protection policy, which is expert-driven, top-down, and technically focused, is failing African citizens. Too often, laws are crafted in boardrooms and passed in parliaments without meaningful input from the people whose data is at stake. The result? Policies that look impressive on paper but struggle with implementation, enforcement, and public trust.
What is Meaningful Public participation?
Legitimacy: When citizens participate in shaping data protection policies, these policies gain democratic legitimacy beyond mere legal authority. People are more likely to understand, respect, and comply with rules they helped create.
Effectiveness: Community input dramatically improves policy design by incorporating local knowledge, identifying practical implementation challenges, and ensuring that regulations address real-world problems rather than theoretical concerns.
Accountability: Ongoing participation creates robust mechanisms for monitoring enforcement and holding both governments and private sector actors accountable for their data practices.
Kenya’s celebrated Data Protection Act and Nigeria’s more recent legislation. Kenya’s law emerged from years of multi-stakeholder consultation, county-level meetings, and sustained civil society engagement through organizations like KICTANet. The result was not just better law, but stronger institutions—Kenya’s Office of the Data Protection Commissioner now leads the continent in regulatory innovation and public engagement.