Privacy as a Human Right in the Digital Age: Assessing Ethiopia's Personal Data Protection Proclamation No. 1321/2024

Tilahun Silesh , B.A.L.L.B

Wodia University , Ethiopia 

1. Introduction 

In today's fast changing global digital landscape, safeguarding personal data has evolved from a specialized regulatory concern into a crucial human rights issue. For many years, Ethiopia's approach to information privacy was stuck in the past, relying on traditional, analog ideas of territorial security and physical safety. But with the recent surge in digital transformation efforts and the widespread use of mobile technology, it's become clear that this old legal framework just doesn't cut it anymore. The current digital environment calls for strong protections against ongoing threats like corporate data mining, digital vulnerabilities, and government surveillance. In light of these urgent challenges, the introduction of the Personal Data Protection Proclamation No. 1321/2024 represents a significant legislative step forward, aimed at updating the country's legal system. This article takes a closer look at this groundbreaking proclamation through a human rights perspective, analyzing its key protective features, enforcement mechanisms, and notable gaps. In the end, it will determine whether this new regulatory framework truly provides a meaningful safeguard for individual rights or if it merely serves as a symbolic gesture amid the complexities of the digital age.

2. The Right to Privacy: From Constitution to Digital Reality

The right to privacy in Ethiopia has been mainly upheld by Article 26 of the 1995 Federal Democratic Republic of Ethiopia (FDRE) Constitution. This constitutional safeguard effectively protects citizens from arbitrary physical intrusions, like unlawful searches of their homes, bodies, or correspondence. The right to privacy is also affirmed in Article 12 of the UDHR and Article 17 of the ICCPR because of international agreements ratified by Ethiopian parliament are integral part of the law of the land. These provisions provide that no one shall be subject to such interference against with his or her privacy, family, home, or correspondence. However, with the rapid rise of digital transformation initiatives and the widespread use of mobile technologies, the landscape has changed dramatically. The old physical protections are becoming increasingly inadequate in the face of modern challenges, such as extensive state surveillance, corporate data mining, and vulnerabilities in digital platforms. This significant gap between an analog constitutional framework and a complex digital reality highlights the urgent need for comprehensive regulatory updates. As a result, the introduction of the Personal Data Protection Proclamation No. 1321/2024 marks a vital legislative advancement, purposefully updating Ethiopia's legal framework to establish informational privacy as a recognized, enforceable human right in today's digital age. 

3. Key Highlights of Proclamation No.1321/2024: A Human Right Perspective 

Looking at it from a fundamental human rights angle, the Personal Data Protection Proclamation No. 1321/2024 takes the somewhat abstract idea of privacy enshrined in our 

constitution and turns it into a practical, modern day shield for our digital lives.  It goes beyond the old-school notions of privacy by establishing a solid rights-based framework that puts individuals back in control of their personal data in a world that's becoming more and more digital. Article 6 of the proclamation lays down the essential human-centered principles of lawfulness, fairness, and complete transparency, ensuring that individual dignity is at the heart of all data processing activities. On top of that, this legislation gives citizens strong data subject rights, like the right to be informed, the right to access their data, and the crucial right to have their data erased.  Importantly, Article 9 offers extra, non-negotiable protections for sensitive personal information, such as biometrics and health records, while the proclamation sets a legal standard aimed at shielding minors from digital exploitation. With these clear legal provisions, Ethiopia is firmly establishing informational self-determination as a key element in protecting broader democratic freedoms in our digital age. 

4. Enforcement and the New Data Protection Authority 

As per article 5 of the Personal Data Protection Proclamation No. 1321/2024, the Ethiopian Communications Authority (ECA) has been appointed as the independent body responsible for overseeing national data operations. This significant shift transforms the ECA from merely a telecommunications regulator into a central protector of individual data rights.  Article 58 lays out a clear process for accountability, enabling individuals who feel their data rights have been violated to file complaints directly with the ECA. Once a complaint is received, the authority is required by law to investigate and provide a formal decision within 21 days.  If they find non-compliance, the ECA has the power to issue binding compliance notices, enforce permanent processing bans, or impose hefty administrative fines. Additionally, to ensure a fair process, Article 58 allows any dissatisfied data subject or organization to appeal the ECA's final decision to the Federal High Court within 60 days. This framework marks a significant step toward creating a legally enforceable digital environment in Ethiopia. 

 

5. Major Challenges and Gaps in the Proclamation

Legal examination uncovers some serious structural issues, systemic contradictions, and challenges in implementation. When we look at it through the lens of fundamental human rights, these legislative shortcomings could weaken the real impact of the proclamation, leaving individuals at risk in an increasingly digital government landscape. The main structural issue stems from the institutional setup outlined in Article 2(36), which appoints the Ethiopian Communications Authority (ECA) as the primary regulatory body for data protection. This consolidation of power raises a major conflict of interest that directly contradicts the internationally accepted human rights standard of having a fully independent supervisory authority. The ECA, by its very nature, is an economic regulator focused on expanding telecommunications networks and granting corporate licenses. Expecting it to also serve as an unbiased overseer for human rights violations creates a conflicting dual role that distracts from its core mission. Genuine accountability demands a separate data protection commission that is entirely free from both commercial telecommunications influences and direct pressure from the executive branch.

On top of that, the human rights guarantees in the proclamation are significantly weakened by the broad and vaguely defined exemptions found in Article 3(2). This particular provision expands state authority by completely excluding data processing activities related to national defense, national security, and general public safety from the protective measures of the law (9). In the realm of international human rights law, any exceptions to privacy rights must strictly follow the universal principles of legality, necessity, and proportionality. By granting an absolute blanket exemption rather than requiring judicial warrants or independent oversight for intelligence agencies, the proclamation exposes individuals to unregulated state surveillance. This absence of explicit statutory checks allows law enforcement bodies to bypass data minimization rules, creating a legal loophole where state security interests easily override individual liberties. Operational vulnerabilities also emerge within the statutory complaint mechanisms established under Article 58 (13). While granting citizens the right to file administrative complaints against non-compliant data controllers, the strict 21-day window mandated for the ECA to complete complex technical investigations is highly unrealistic. Given Ethiopia’s current digital ecosystem, characterized by severe shortages of trained forensic auditors and limited cyber security infrastructure, the regulatory authority lacks the institutional capacity to meaningfully meet these tight timelines. Although intended to protect data sovereignty, keeping all sensitive biographical and biometric data within domestic borders unintentionally increases security risks. Centralizing massive citizen databases, such as the national Fayda digital identity registry, without first establishing advanced, highly resilient defensive cyber security frameworks makes them prime targets for state-sponsored or commercial cyber-attacks. Consequently, unless lawmakers introduce urgent legislative reforms that establish a fully autonomous commission and place strict judicial limits on national security exemptions, Proclamation No. 1321/2024 risks remaining a symbolic piece of paper rather than a functional shield for human rights.  

6. Concluding Remarks 

The introduction of the Personal Data Protection Proclamation No. 1321/2024 is a groundbreaking step for Ethiopia, turning the constitutional right to privacy from a theoretical concept into a real digital safeguard. However, as this blog post points out, the effectiveness of this law is at risk due to internal conflicts within the Ethiopian Communications Authority, broad national security exemptions, and weaknesses in domestic data storage. To ensure that this significant legislation doesn't end up being just a symbolic gesture, urgent structural changes are necessary. Ethiopian lawmakers need to create a fully independent data protection commission that operates free from the influences of telecommunications and executive powers. Additionally, it's crucial to implement strict judicial oversight for public security exemptions and make substantial investments in infrastructure to protect centralized national databases.

References

Constitution of the Federal Democratic Republic of Ethiopia, Proclamation No. 1/1995, Federal Negarit Gazeta, 1st Year, No. 1 (1995).

Council of Europe. (1981). Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). https://rm.coe.int/1680078b37

European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L119, 1–88. https://eur-lex.europa.eu/eli/reg/2016/679/oj

Federal Democratic Republic of Ethiopia. (2024). Personal Data Protection Proclamation No. 1321/2024. Federal Negarit Gazette.

Greenleaf, G. (2018). Global data privacy laws 2017: 120 national data privacy laws, including Indonesia and Turkey. Privacy Laws & Business International Report, 145, 10–13.

Kuner, C. (2007). Transborder data flows and data privacy law. Oxford University Press.

Murray, A. (2022). Information technology law: The law and society (6th ed.). Oxford University Press.

Organisation for Economic Co-operation and Development. (2013). OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. OECD Publishing. https://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf

Solove, D. J. (2021). Understanding privacy (2nd ed.). Harvard University Press.

United Nations. (1948). Universal Declaration of Human Rights. https://www.un.org/en/about-us/universal-declaration-of-human-rights

United Nations. (1966). International Covenant on Civil and Political Rights. https://www.ohchr.org/en/instruments-mechanisms/instruments/international-covenant-civil-and-political-rights

United Nations Human Rights Committee. (1988). General Comment No. 16: Article 17 (Right to Privacy). https://www.refworld.org/docid/453883f922.html