Following the Commercial Bank of Ethiopia’s (CBE) alarming decision to publish people’s private data, Access Now and the Centre for Advancement of Rights and Democracy (CARD) are calling on the bank to cease its public shaming campaign immediately and respect privacy and data protection laws.
The state-owned bank’s decision to publish hundreds of names, account numbers, and photographs of people the bank alleges to have withdrawn unauthorized funds due to a systems glitch, grossly violates people’s data and privacy rights.
People in Ethiopia have the right to privacy, and that right is not automatically ceded on mere allegations of unlawful behavior. The Commercial Bank of Ethiopia has an obligation to protect people’s data and its decision to name and shame by publishing personally identifiable information without consent is a violation of their fundamental right to privacy guaranteed under Article 26 of the Constitution of Ethiopia.Naro Omo-Osagie, Africa Policy and Advocacy Manager at Access Now
Earlier this year, Ethiopia’s Personal Data Protection Law was approved by Parliament. While enforcement of the law is still in its infancy, it has clear provisions on the legal basis for the processing of personal data which the CBE has failed to comply with. This is not the first time a state-owned entity has undermined privacy in Ethiopia. In the past, reports of Ethio-Telecoms granting security authorities unlawful access to people’s information have highlighted the government’s systemic attacks on the right to privacy.
The Commercial Bank of Ethiopia must respect its obligations as a data controller and only collect, process, and share data within the law. Publishing people’s personal information violates the principles of necessity and proportionality. The bank must delete the published information and pursue legal channels to recover the money they claim was illegally obtained.Bridget Andere, Senior Policy Analyst at Access Now
CBE has not responded to Access Now and CARD’s letter asking the bank to take down the lists and photographs and initiate a transparent review of its data policies and procedures. CBE must immediately change its course of action and uphold people’s rights.