Tanzania recently promulgated the Personal Data Collection and Processing Regulations, G.N No. 349 of 2023 (Data Collection Regulations) and the Complaint Handling and Breach of Personal Data Regulations, G.N No. 350 of 2023 (Complaint Handling Regulations) (collectively, the Regulations).
The Regulations are intended to regulate, among other things, the collection and processing of data and procedures for presenting complaints under the Personal Data Protection Act 2022 (Act).
The Regulations came into operation on 12 May 2023, and fall within the remit of the Minister of Information, Communication and Information Technology (Minister). They are currently promulgated only in Kiswahili.
Registration procedures for collectors and processors
A person who intends to collect or process personal information shall submit a registration application to the Commission for Personal Data (Commission) using a prescribed form together with identity documentation if the applicant is an individual, or incorporation documents if the applicant is an entity. A registration fee is payable depending on the number of employees the data processor or collector has.
The Commission has seven days to review the application, after which it will either issue a certificate of registration or will, within 14 days, provide written information to the applicant explaining the reasons for rejecting the application.
The registration certificate will be valid for a period of five years from the date of issue and may be renewed three months before the date of expiry.
Register of data collectors and processors
There will be a register of registered collectors and processors which will include the following information:
The Commission may permit any person to search or download any information entered in the register, provided that the person submits their request in writing to the Commission together with payment of fees as specified by the Commission.
The Commission may cancel a registration if it is satisfied that the processor or collector:
If a data collector or processor is dissatisfied with any decision made by the Commission, they can submit an appeal in writing to the Minister within seven days from the date of the decision of the Commission and the decision of the Minister will be final.
Procedure for the data subject to obtain rights in the collection and processing of personal data
The data subject may request the collector or processor to delete or destroy personal information held by the collector or processor where:
The collector or processor shall, within a period of 14 days deal with the request to delete or destroy personal information and may accept or reject such a request.
Procedure for exporting personal data
A collector or processor who intends to export personal information abroad will have to submit a permit application to the Commission using a prescribed form. At the time of submission, the applicant shall submit proof that:
The Commission shall within 14 days accept or reject such an application. The permit issued by the Commission shall be used on the following terms:
Submission of complaints
Anyone who discovers a violation of the protection of personal data or is dissatisfied with a decision by the collector or processor regarding personal data can submit a complaint to the Commission, either in English or Kiswahili, again using a prescribed form.
The respondent shall, for a period no later than 21 days after receiving the summons, submit a defence to the Commission. If the respondent fails to submit its defence as required, it will be considered that the respondent has waived its right to attend and participate in the proceedings and the Commission will continue to hear one side.
Investigation and dispute resolution
The Commission will investigate complaints submitted to it. The Commission will try to resolve the complaint within 30 days of its submission. During dispute resolution, the Commission shall appoint one official from the Commission to be the arbitrator between the parties to the complaint.
An appointed arbitrator will try to resolve the dispute and in doing so will be able to convene arbitration meetings at the location and time as may be agreed upon by the parties.
If, at any stage within the 30-day period, it is found that the parties have failed to reach an agreement within the given time, the arbitrator will return the complaint to the Commission for hearing procedures.
Complaint hearing procedures
If there is no agreement after investigation and mediation efforts, the Commission will appoint a Complaint Hearing Committee (Committee) that will be made up of three people from the Commission including people with expertise and experience in the legal industry and the personal information protection and information technology industry. The party may attend in person or be represented by a lawyer or their senior officer or an authorised representative.
Any person who has an interest in the complaint before the Commission may, at any stage before the end of the hearing, submit an application to the Commission to intervene in the complaint. The Commission will then notify the parties in the proceedings of the application and any party can file an objection within seven days after receiving the notification. The Committee will ensure that the prospective person intervening in the complaint is directly affected by the outcome of the hearing.
The awards of the Commission will be implemented as the order of the High Court of Tanzania (High Court). The decree holder will, subject to the period of the limitation specified in the penalty notice, request the registration of the award at the High Court. Applications for registration of awards will be submitted through a letter attaching the award to be registered. The High Court, after receiving the application will register the award as if the award had been made under the Arbitration Act 2020.
Appeal procedures
Any party to the complaint who is not satisfied with the award of the Commission may, within 21 days, request referral of the award to the Commission using a prescribed form. The Commission, within 14 days of receiving the referral request, will refer to its award and may cancel, change, or terminate any instructions it has given in the award. References to the Commission's award will be made by an officer or officials other than the one who handled the complaint.
Any party who is not satisfied with the decision of the Commission may, within a period of 21 days from the date of the award, appeal to the High Court.
--
Read the original publication at Bowmans.