Africa risks losing digital sovereignty to global tech firms – DPC Executive Director

The Executive Director of the Data Protection Commission (DPC), Dr Arnold Kavaarpuo, has urged African countries to take control of their data to protect their digital sovereignty.

He warned that the continent risked losing its digital sovereignty as global technology companies consolidated their control over artificial intelligence (AI) and data infrastructure.

Dr Kavaarpuo made the call at a lecture held at the Ghana Institute of Management and Public Administration (GIMPA) on October 28.

The lecture, which was on the topic "Privacy-by-Design and Ethical Analytics," was organised by the School of Technology and Social Sciences (SOTSS) of GIMPA.

The lecture was attended by the Deputy Rector of GIMPA, Prof. Ebenezer Adaku, who chaired the event; the Dean of SOTSS, Prof. Emmanuel Sarkodie Adabor; and the Dean of Students, Prof. Augustina Akonnor.

Dr Kavaarpuo said fewer than five companies developed the foundational AI models on which the world relied, while users provided the raw material through their photos, location data, and online activities.

He said the situation where the United States had more than 5,000 data centres, Europe 3,500, while Ghana had eight and the entire of Africa had fewer than 200, was a cause for concern and a wake-up call for African countries.

He described the gap as a concentration of power, not a question of development, and urged Ghana and the rest of Africa to invest in their data security.

Dr Kavaarpuo, who chairs the working group on cross-border data transfers at the Network of African Data Protection Authorities, proposed that at least a copy of health, financial, energy and natural resource data be kept in the country.

"It is important we start thinking about data sovereignty in a real way," he said.

Dr Kavaarpuo said the Data Protection Act, 2012 (Act 843), was undergoing review, adding that the proposed legislation would make the appointment of compliance officers mandatory for large data processors and introduce data protection impact assessments.

“It will also add privacy by design and by default, and cover biometrics, online identifiers such as GPS location, cross-border transfers and AI. Penalties would be higher,” he said.

Under the current law, processing personal data without registering with the commission is an offence that carries a prison term of two years.

The DPC boss said the commission had registered more entities in September this year than in all its previous years and had focused on the public sector first.

He added that the "Privacy is Personal" campaign had also reached an estimated 25 million people.

For his part, Prof. Adaku challenged students to help safeguard the continent's sovereignty by taking keen interest in designing innovative safeguard systems.

"Very soon, we will be colonised again, not with guns and ships, but because we do not have possession of data and other countries do," he said.

The President of GIMPA Association of Technology Students (GATS), Nartey Jonathan Nii Laryea, said: "Let us not merely build intelligent systems, but let's build systems worthy of human trust".