Ethiopia

Ethiopia's comprehensive personal-data statute is the Personal Data Protection Proclamation No. 1321/2024, in force under its own Article 70 since its publication in the Federal Negarit Gazette, and signed at Addis Ababa on 24 July 2024.

It applies to processing personal data by automated means, or held in a filing system, by a data controller or processor established in Ethiopia or using equipment there, covering public and private bodies alike; its exhaustive scope exceptions (an individual's personal or household activity, and need-to-know exchange between government agencies) carry no carve-out for publicly available personal data.

Sensitive personal data, including genetic or biometric data, is presumptively prohibited absent a listed exception such as the data subject's specific written consent, and a minor's data may be processed only with a parent's, guardian's, or tutor's consent or where necessary to the minor's vitally important interest, never for marketing, profiling, or merging of profiles.

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them; a controller or processor must register with the Ethiopian Communications Authority (ECA), the Proclamation's designated supervisory authority, notify the Authority of a personal data breach within 72 hours, and secure an appropriate-protection determination or another listed condition before transferring personal data outside Ethiopia.

Violating the automated-decision right or another data-subject right carries imprisonment of three to five years or a fine of 100,000 to 200,000 Ethiopian Birr, or both, rising to a fine of up to four percent of worldwide turnover where the offence involves an institution, sensitive personal data, or a minor's personal data.

Ethiopia's computer-misuse authority is the Computer Crime Proclamation No. 958/2016, which punishes securing access to the whole or any part of a computer system, computer data, or network without authorization or in excess of authorization, whether or not the target is a public or a private system; no Ethiopian court decision or statutory carve-out reads a public, unauthenticated page as outside that offence.

The same Proclamation makes a service provider criminally liable for illegal content data disseminated by a third party through its own systems only where the provider was directly involved in disseminating or editing the content, or failed to remove or disable access to it after obtaining actual knowledge or a notice from a competent authority; that duty binds a hosting or access provider, not a general web crawler that only collects data from public pages it does not own.

No statute or reported case addresses terms-of-service enforceability, or whether login or acceptance of terms changes the legal picture; this is unsettled rather than a specific regime.

Copyright protects a database only as a compilation, never through a separate sui generis right: the Copyright and Neighbouring Rights Protection Proclamation No. 410/2004 protects a collection of works such as an encyclopedia, anthology, or database, whether in machine-readable or other form, only where the collection is original by reason of the selection or arrangement of its contents, and its personal-reproduction exception expressly does not extend to reproducing the whole or a substantial part of a database in digital form.

The Personal Data Protection Proclamation No. 1321/2024 reaches scraped public personal data: it defines personal data broadly as any information relating to an identified or identifiable natural person, and its exhaustive list of scope exceptions (personal or household activity, and inter-agency government exchange) carries no carve-out for publicly available personal data, so a scrape of a public page that captures personal data still needs a lawful basis under that Proclamation.

No specific unfair-competition or misappropriation doctrine addresses scraping, and no case law or regulatory statement gives robots.txt legal weight or addresses AI-training-specific access rules.

Ethiopia has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Copyright and Neighbouring Rights Protection Proclamation No. 410/2004 is the only law reaching an aggregator's reproduction of news content.

Its quotation article permits reproducing or quoting a published work without the copyright owner's authorization, provided the quotation is compatible with fair practice, does not exceed the extent justified by its purpose, and, where the source names an author, names the source and the author; the article carries no headline-length or short-extract cap and no restriction to the press industry, and no reported Ethiopian decision applies it to a systematic news aggregator as opposed to an individual quoting a published work.

Neighbouring rights under the Proclamation protect only performers, producers of sound recordings, and broadcasting organizations, not print or online news publishers, so there is no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates.

No statute or case law addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law exists. The Proclamation predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.