CBE Ethiopia

Access Now and CARD letter to Commercial Bank of Ethiopia on the publication of customers personal data

17 May 2024

Mr Ato Abie Sanu

President, Commercial Bank of Ethiopia

P.O.Box 255, Ras Desta Damtew Street, 

Addis Ababa, Ethiopia


H.E. Mamo E. Mihretu, Governor, National Bank of Ethiopia, 

Eng. Balcha Reba, Director General, Ethiopian Communications authority

Re: Publication of Customers’ Personal Data

Dear Mr. Sanu, 

We, the undersigned organizations, are writing to address the recent and concerning issue of the Commercial Bank of Ethiopia’s (CBE) publication of personal information including the names, account numbers and photographs of certain customers in connection with reported discrepancies due to a systems glitch. While we acknowledge the CBE’s efforts to rectify the situation and engage with affected individuals prior to resorting to public disclosure, we find the subsequent actions to be in violation of the privacy rights of these individuals.

The right to privacy 

The publication of personal information without the duly obtained consent of the data subject infringes upon the fundamental rights guaranteed under Article 26 of the Constitution of Ethiopia, which unequivocally protects the right to privacy of all citizens. Any encroachment upon this right must adhere to stringent legal standards, including being non-discriminatory, necessary, and proportionate. It is crucial to emphasize that the individuals concerned are currently under investigation and have not been convicted of any wrongdoing. Therefore, any actions taken against them must uphold their presumption of innocence and safeguard their constitutional rights including the rights to privacy and a fair hearing. 

The actions of the CBE not only contravene domestic law but also run afoul of international human rights standards, particularly those enshrined in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), to which Ethiopia is a signatory. Similarly, International data protection laws and standards such as the African Union Convention on Cyber Security and Personal Data Protection 2014 and the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108) emphasize the principle of informed consent to legitimize data processing which the CBE has not adhered to in these circumstances. These laws and standards affirm the right to privacy as inviolable, except under strictly defined circumstances and subject to judicial oversight. Furthermore, as a corporation, the CBE has a duty to respect human rights as recognized in the UN Guiding Principles on Business and Human Rights

We urge the CBE to cease its public shaming campaign immediately and remove the list of customers from public platforms, including its website, and discontinue the display of customers’ photographs at its branches and other locations. Furthermore, we call upon the CBE to initiate a transparent review of its policies and procedures regarding customer data protection, publicly commit to upholding privacy rights, and outline steps it will take to prevent similar incidents from occurring in the future.

We welcome a written response to the serious issues raised in this letter, as a way to show the public that you take their right to privacy seriously. We would greatly appreciate a formal response from the Commercial Bank of Ethiopia by May 27, 2024. We will make this letter public on May 29, 2024.

Thank you for your attention to this matter.


Access Now

Center for Advancement of Rights and Democracy (CARD)

Access Now (https://www.accessnow.org) defends and extends the digital rights of people and communities at risk. As a grassroots-to-global organization, we partner with local actors to bring a human rights agenda to the use, development, and governance of digital technologies, and to intervene where technologies adversely impact our human rights. By combining direct technical support, strategic advocacy, grassroots grantmaking, and convenings such as RightsCon, we fight for human rights in the digital age. 

Center for Advancement of Rights and Democracy (https://www.cardeth.org) is a Non-Profit Organization that aspires to see an Ethiopia where democratic culture flourished on human rights values and has been working with a mission to empower citizens and groups of citizens to ensure their ability to promote and defend human rights and build democratic governance in Ethiopia.