Personal Data Protection Proclamation, enforcement, sanctions and offences

Article 55 lets the Ethiopian Communications Authority serve an enforcement order on a data controller or data processor that has contravened, is contravening or is about to contravene the Proclamation, specifying the provision at issue, the measures to be taken, a period of not less than twenty-one days in which to take them, and the right of appeal; on complying, the recipient must tell the data subject concerned and, where compliance materially modifies the data, anyone the data were disclosed to in the twelve months before the order.

Article 56 lets the Authority request information from anyone, in a form that can be taken away and is intelligible and retrievable, and article 57 lets its monitoring arise from its own staff's work or from information and complaints.

Article 58 gives a data subject the right to complain in writing to the Authority, requires the Authority to investigate unless the complaint is not made in good faith and to give its decision in writing within twenty-one days, and allows an appeal to the Federal High Court within sixty days.

Article 59 requires administrative fines to be effective, proportional and dissuasive and lists the factors that set them, and article 60 gives the Authority power to impose administrative penalties for processing in contravention of the Proclamation, rising to a fine of up to four per cent of total worldwide turnover of the preceding financial year where the offence was committed by an institution, in relation to sensitive data, or against a minor's personal data, with any gain made going to the government.

Article 63 puts the burden of proving an exemption on the data controller that refused a data subject's request.

Article 64 sets the criminal tiers: one to three years' simple imprisonment or 60,000 to 100,000 Birr for failing to notify a personal data breach, failing to implement technical and organizational measures, or processing in contravention of the Proclamation; three to five years or 100,000 to 200,000 Birr for denying a data subject's rights of erasure, objection, restriction or protection against automated decisions; five to ten years or 200,000 to 600,000 Birr for re-identifying de-identified data, selling personal data or transferring it out of Ethiopia unlawfully; and the same four per cent of worldwide turnover where the offence involves an institution, serious damage, sensitive personal data or a minor's personal data.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.