On June 8^th 2023, the African Union’s Convention on Cyber Security and Personal Data Protection, also known as the Malabo Convention, officially entered into force. The convention was adopted on June 27, 2014, and after nine years and the receipt of the fifteenth instrument of ratification, it became the only binding regional treaty on data protection outside of Europe. With Mauritania’s ratification on May 9th, 2023, the convention took effect thirty days later, as stated in Article 36.

The Malabo Convention serves as a framework convention, focusing on three main themes: personal data protection, electronic commerce, cybersecurity and cybercrimes in Africa. Its primary goal is to harmonize data protection policies across the continent, emphasizing digital rights such as data protection, privacy, and internet freedom.

The convention’s scope of application is primarily territorial, unlike the European Union’s General Data Protection Regulation (GDPR), which applies (extra)territorially. The Malabo Convention applies to any data processing, whether automated or non-automated, taking place within the territory of state parties, involving individuals, the state, local communities, or private actors, as stated in Article 9. While the convention lacks clarity on its applicability to data processors or controllers established outside the continent, the GDPR addresses such situations, particularly when processing activities are related to offering goods or services to data subjects in the European Union or monitoring their behavior within the Union.

The convention aims to achieve two main objectives. First, it requires member states to establish a legal framework that protects fundamental rights and personal data. Second, it seeks to strike a balance between the rights of data subjects, the prerogatives of the state, and the rights of local communities, although the concept of “local communities” is less defined. However, a combined reading of the convention’s preamble and Article 8(2) suggests that it encompasses various rights under the African Charter on Human and Peoples’ Rights, such as freedom of expression and access to information.

The entry into force of the Malabo Convention presents opportunities for the development of digital rights in Africa. It aligns with the African Continental Free Trade Area (AfCFTA) Agreement, facilitating the free flow of people, goods, and capital across Africa. With increasing internet connectivity and digitalization plans on the continent, the convention can be effective in conjunction with national data protection laws. However, the convention may face challenges. Its scope may be perceived as overbroad, as it encompasses multiple issues such as human rights, criminal law, trade, and commercial law in a single instrument. The lack of clarity on the extraterritorial applicability of the convention to foreign data controllers or processors may also pose challenges. Nonetheless, the entry into force of the Malabo Convention marks a significant step toward enhancing personal data protection and digital rights in Africa.