Evaluating Personal Data Transfer Mechanisms to International Organisations Under the Malabo Convention: A Core Regulatory Approach

Abstract

The African Union Convention on Cyber Security and Personal Data Protection (hereinafter the Malabo Convention) was strategically intended to establish a harmonised regional framework on data protection and cybersecurity issues. Its approach is anchored on the reliance on State obligation to establish national frameworks that develop the required standards elaborated in the Convention. However, the lack of detail in its enforcement structure has resulted in minimal motivation and slow adoption of the Convention by African Countries. Instead, many African countries are focused on adopting legislation similar to the GDPR that is elaborate in structure. This is notwithstanding the far-reaching effects on collaborative limitations, particularly in responding to data transfer issues that do not respond to prescriptive provisions dictating specific mechanisms like Standard Contractual Clauses and adequacy decisions. This paper analyses this problem by observing the regulatory limitations when prescribing adequacy requirements of personal data transfer to international organisations. This paper analyses the weaknesses of the GDPR’s personal data transfer mechanisms to IOs compared to that of the Malabo Convention, considering their regulatory structures. This paper highlights the concerns of adopting regulations with structures that lack dynamism in responding to data protection challenges and how we can resolve these concerns by re-thinking command and control regulations in support of core regulations.