High Court of Tanzania calls for clarity on Personal Data Protection Act

The High Court of Tanzania rules that provisions of the Personal Data Protection Act (PDPA) need to be amended to ensure effective data protection rules for citizens. Essentially, a human rights advocate, Tito Magoti, filed a petition challenging thirteen sections of the PDPA, claiming that they are unconstitutional and thus infringing on human rights.

Following the review of the judges, they concluded that two provisions of the PDPA (Sections 22(3) and 23(3)(c)(e)) were found to be vague, thus opening the door for potential misuse. Section 22(3) states, “A data controller shall not collect personal data by unlawful means.” The problem, however, according to the judges, is that this provision does not clarify what means are considered unlawful that would prevent data controllers from collecting users’ data.

As a result, the judgement orders that these sections be amended within a year from the judgment’s date, where it clarifies what acts or omissions are considered unlawful.

Why does it matter?

While not all provisions are ordered to be amended, this is a first step in ensuring more transparency in the data collection process in Tanzania. Additionally, this case could be used as a precedent for future data protection cases, for users to defend their rights if their data has been collected without their consent.