On April 30th, 2024, the Lesotho Internet Society Chapter (ISOC LS) organised a vital dialogue with government stakeholders titled "Building a Digital Lesotho: Where Privacy Meets Innovation." The aim was to shed light on the gaps between existing legislation and the reality of data privacy safeguards in Lesotho.
Despite legal protections enshrined in the Constitution, the Data Protection Act, and other sectoral laws, the session revealed a need for more alignment between current practices and best practices in data protection.
Participants discussed a common practice in Lesotho: the visitors’ register. In this country, it is common for visitors to government agencies and certain businesses to require visitors to fill in their details such as name, surname, mobile number, and home address in a visitors’ register. There are several potential risks associated with writing personal information in these physical registers:
Data Security:
Loss or Theft: Physical registers are vulnerable to theft or loss, potentially exposing your personal information to anyone who gains access to them. This could include employees, visitors, or even passersby.
Data Breaches: If the register is not stored securely, it could be accessed by unauthorised individuals, either intentionally or unintentionally
Data Sharing: Data subjects need clarity on how the information collected in the register is used and whether it is shared with other entities.
Potential Consequences:
Identity Theft: As mentioned earlier, if your personal information falls into the wrong hands, it could be used for identity theft, leading to financial loss, credit damage, and emotional distress.
Targeted Advertising or Spam: Your information could be used for targeted advertising or sending unwanted spam messages.
Social Engineering Attacks: Malicious actors could use the information gathered from the register to launch social engineering attacks, tricking you into revealing further personal details or financial information.
Additional Considerations:
Lack of Data Protection Enforcement: Lesotho lacks a Data Protection Commission, which weakens legal recourses in case of data breaches or misuse.
Limited Consumer Protection: The absence of a comprehensive consumer protection law in Lesotho offers less legal protection for online and offline data handling practices.
While the risks associated with physical visitor registers may seem less immediate compared to online data collection, it is important to be aware of the potential consequences and advocate for better data security and privacy practices in Lesotho.
The Way Forward:
Stakeholders were in agreement that the way forward included the following:
Urgent Need for a Data Protection Commission
Stakeholders agreed that the absence of a Data Protection Commission creates a significant gap in oversight and enforcement. They acknowledged the commission's crucial role in:
- Public Education: Raising awareness about data rights and responsible data handling.
- Law Review: Updating the 2011 Data Protection Act to address evolving digital threats like AI
- Enforcement: Ensuring compliance with data protection regulations.
The discussion acknowledged the challenges of establishing a data protection commission:
- Funding: Establishing a financially sustainable commission that operates with functional autonomy.
- Political Influence: Mitigating potential political interference in the appointment of the commission's leadership and operations.
- Outdated Legislation: Amending the 2011 Act to reflect current data protection needs and emerging technologies.
While comprehensive legal reform may take time, stakeholders emphasised the immediate need to establish the Data Protection Commission. This critical step can pave the way for reviewing and strengthening the legal framework.
Beyond Legislation: Public Awareness is Key
The session underscored the importance of ongoing advocacy and public awareness campaigns. Educating citizens about their data rights empowers them to demand better data-handling practices from government institutions and businesses.
Research on Digital Rights in Lesotho
The second part of the session presented research conducted in 2021 on digital rights practices of service providers in the financial and telecommunications sectors, specifically assessing digital wallets, internet banking, and digital communications services. The findings revealed:
- Limited Transparency:Service providers often fail to disclose their commitment to human rights, as recommended by the U.N. Guiding Principles on Business and Human Rights' Operational Principle 16. This lack of transparency makes it difficult for consumers to hold them accountable for upholding human rights standards.
- Language Barriers: Terms of service are frequently written solely in English, excluding the majority of Sesotho-speaking citizens.
- Privacy Concerns:While some companies have privacy policy statements, not all do, despite collecting data through website cookies and online forms.
- Consumer Protection Gap:The absence of an overarching consumer protection law in Lesotho limits safeguards for online consumers, although such legislation could offer some protection in the absence of robust data protection enforcement.
Building a Digital Lesotho with Privacy at its Core
Lesotho's digital future hinges on bridging the gap between existing legal frameworks and practical implementation. Prioritising the establishment of the Data Protection Commission, coupled with public awareness initiatives and legislative reforms, will be crucial steps towards building a digital Lesotho where privacy and innovation thrive hand-in-hand.
Call to action
In celebration of the 200th anniversary of the Basotho nation's establishment, let's seize this momentous occasion to build a digital Lesotho that is not only innovative but also respectful of its citizens' privacy. We call on all stakeholders – government, businesses, civil society, and citizens alike – to work together.
This collaborative effort is crucial to ensure that the protection of privacy is designed into the very core of our digital systems and processes. By prioritizing privacy from the outset, we can create a thriving digital environment that fosters trust, empowers individuals, and safeguards their fundamental rights.
Let us embrace this opportunity to build a digital future for Lesotho that is both progressive and protective, honouring the rich heritage of the Basotho nation while paving the way for a secure and prosperous future for all.