E271 – Ridwan Oloyede, Emerging Technologies and Technology Policy Lead (Rwanda Africa)
[00:00] Debbie Reynolds: The personal views expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.
[00:12] Hello, my name is Debbie Reynolds. They call me the Data Diva. This is the Data Diva Talks Privacy podcast where we discuss data privacy issues with industry leaders around the world with information that businesses need to know.
[00:25] Now I have a very, very special guest,
[00:28] Ridwan Oloyede from Rwanda, Africa.
[00:33] He is an emerging technologies and tech policy lead. Welcome.
[00:40] Ridwan Oloyede: Thank you, Debbie. It's a pleasure to be here with you today.
[00:44] Debbie Reynolds: That is so amazing. I'm happy to have you here. We've been connected on LinkedIn for many years.
[00:51] We chat back and forth and you do really great commentary. And I just said, wait,
[00:58] why don't you be on my show? Oh my God, like you're always like, talk and you have such really crisp insights. And I love to have people on from other, other countries and Africa especially because I feel like so much of what we talk about and privacy data protection that you see people talk about is a lot of very us,
[01:20] Europe,
[01:20] EU based.
[01:22] But people don't know that other countries have a lot of maturity in those areas. But give me an idea what you work on and how you came into the emerging tech and tech policy space.
[01:36] Ridwan Oloyede: All right, thank you. I think, I think I have to say as well, I'm a very big fan. Like you said, we've been connected for a while. So always a pleasure reading your commentary or listening to the different episode of the podcast.
[01:46] So it's nice that I finally have my shot on the podcast. So thank you for inviting me just to get started.
[01:53] I started working in the space a couple of years ago and that was long before became so mainstream. So I started out sometimes around 2016, and then it was more of just pure interest,
[02:05] pure enthusiasm, just trying to get a sense of what to do as a young lawyer then in Nigeria.
[02:12] So I stumbled on a couple of courses and I think it was around the same period the whole conversation around the GDPR was being finalized, and that's before 2018 when it finally came into full effect.
[02:22] So started out doing that, finally got a shot to do it from a professional point of view in 2017 when I started working at a commercial law firm.
[02:33] So I mean, my interest was purely from curiosity, just to trying to get a sense of what's happening, but also from someone young at that point in time, trying to also get a sense of what they want to do, wanted to do things differently.
[02:45] Not just, you know, the traditional setup where you go into law firm and then you end up in the court system. So those were like the two things that fueled my interest primarily at that stage.
[02:56] But of course,
[02:57] my interest evolved over time,
[02:59] which from starting out in data protection,
[03:02] looking at different aspects of cybersecurity,
[03:05] but then now narrowing down to working in the space, paying more attention to what's happening on the continent.
[03:12] And for me, it was really so important for me then because there were pocket of conversation happening on the continent. But I felt it was also very important that we do really more important work to tell the story of what is happening on the continent, which was also something that I personally particularly was really focused on.
[03:29] You know, how can we tell the story of the continent? How can we show our spotlight, things that are happening and amazing things happening on the continent to show the kind of progress we are making?
[03:38] So, yeah, that's it. And from working in a law firm to starting on my own consulting company in 2019, I think it's been an interesting journey from there.
[03:47] Debbie Reynolds: Very cool. Oh, my gosh. Yeah.
[03:50] I find Africa fascinating for a couple of different reasons.
[03:55] First of all,
[03:56] there's so much talent there and data protection is just unreal.
[04:03] Also,
[04:04] I feel like the people that I know or I have met or worked with in Africa, they understand data protection really well. They understand why it's important.
[04:12] But a lot of times you also,
[04:15] I don't know, in the US I feel like we are all like, let's make mistakes and then worry about it later.
[04:22] Where I feel like a lot of the people that I work with are liaise with Africa. They're very much about prevention,
[04:31] like let's prevent stuff. So I think that aligns very well with data protection and data privacy. But what's your thoughts?
[04:39] Ridwan Oloyede: I mean, the space has evolved.
[04:41] The last 10 years has been like an interesting one. So if you look at the research that came out of Africa like 10 years ago, you typically see,
[04:49] you see statistics like over 20 countries less than the number of countries on the continent have data protection laws.
[04:56] But then 10 years down the line, you've seen an incredible amount of progress that have happened where we've gone as far as way above 40 countries now with laws, way above 35 countries now with the data protection authorities.
[05:10] And we still have like more countries in the pipeline who are also like, trying to get past the finishing line in terms of what the professional space has also looked like.
[05:20] Pretty much like every market where something is new,
[05:23] we start from crawling to walking, from working to learning how to run. So we are also seeing the space and the professional Space also evolve.
[05:32] When I started out for example, there were like very few people, in fact it was hard to find people in Africa, living in Africa, who are working specifically in the space.
[05:42] Not just people who are just lawyers in the broader sense, but people were solely dedicated working in the space specifically. But few years down the line you've seen that has evolved.
[05:52] And now with more countries having their own data protection laws, you're seeing data protection societies or associations starting out.
[06:01] You're seeing affiliation with international bodies like the IPP as well as who is also creating knowledge led communities, helping people actually build real communities in these countries.
[06:11] And then you've seen also, I mean what we've also seen is the number of people who are also showing interest in certifications. I mean global certifications like the ipp, the pecb,
[06:22] but you also have like local certification involving in different African markets. So what I would say generally the space is evolving, is maturing.
[06:29] Still a lot of work that needs to be done. And I think I also remember very early days of the GDPR as well where you read some commentaries, everyone was just so the whole consent focused conversation where we're not,
[06:41] it wasn't truly like if you look at the commentaries, 2018, 2017, look at the quality of commentaries you have and we've also seen a lot of developments because now they're.
[06:49] You've seen more clarity with so many issues people have also deepen their expertise.
[06:54] So that's the kind of evolution we are also seeing where at first people jump on it because it's a new thing without the necessary depth to really speak to the conversation.
[07:03] But down the line you're seeing now the debt is happening. The debt is to, the conversation is also improving, is increasing.
[07:11] A whole lot of capacity building is also going on. You want to be on top of your game, you want to be able to compete anywhere in the world.
[07:17] We also see a lot of cross border work. I mean I for example have had opportunities to work with different professionals across different parts of the world. So again,
[07:25] beyond being a trusted source of tools for whatever it is you're doing is also when you move to other part of the world, can you also compete meaningfully? And we're seeing really amazing talents coming out of Africa,
[07:36] across different African countries,
[07:37] country specific domain, wider continental domain, knowledge and expertise. And it's really so beautiful to see. And I think the next few years, five years will also be really amazing and transformative for what's the majority of the professional space will look like.
[07:51] Debbie Reynolds: That's fascinating.
[07:52] I agree that There has been a lot of rapid growth and more acknowledgement of data protection and data privacy as its own distinct field,
[08:06] growing in that way.
[08:08] What is it that people don't know about Africa as it relates to data protection? So you work with a lot of people around the world and I'm sure there's a lot of misconception or just a lack of knowledge of the ethos,
[08:25] the culture,
[08:26] you know, culturally,
[08:27] what things are like in Africa in terms of data privacy and data protection. But can you tell me a little bit about that?
[08:34] Ridwan Oloyede: I mean, I think, you know, the conversations are in two buckets. One is few years ago the conversation will purely be because there wasn't enough information coming out of the continent about what's happening on the continent.
[08:46] So commentaries there were, I mean, conversations happening about the continent from outside of the continent was based on the very sparse information that was there then. So people didn't understand.
[08:58] And so it's easy to make commentary and say, oh, a lot of African countries are now united data protection laws that model themselves after the EU GDPR, the European directive of 95, for example.
[09:08] And you still see comments that still says this despite the fact that the first data protection in Africa was far back 2001.
[09:16] So many of the laws predates the GDPR, for example,
[09:20] and didn't take their influence from the GDPR. Yes, maybe a little bit from the European Directive,
[09:24] but there were also laws that didn't that looked completely in a different direction. One is, for example the,
[09:30] the first draft of the Seychelles law. It looked nothing like the European Directive. It was completely distinct.
[09:36] The South African law for example too was not exactly modeled after the Directive in its sense because even in terms of terminologies and concepts, they were completely distinct, they had different names.
[09:46] So there was that part where there wasn't enough information.
[09:49] But now the last few years there have been so much you have been written about the continent. Even though I feel I still strongly think there are some part of the continent that's still not spotlighted enough.
[10:01] So we still don't know what is really happening on the ground there.
[10:04] So I think one definitely is lack of understanding of what's happening on the continent, but also not enough information coming from the continent itself. But that's changing because now we have more data points.
[10:15] It's. You can't come and say, oh, not like,
[10:18] I mean in the past year. I mean, I think I saw a research recently that was written by someone on to the Africa saying things like barely half of the countries on the continent have Data production laws, but that's too long that you.
[10:30] Because now you have a situation where we have, like I said, Over 45 countries we lost. And as I speak this morning,
[10:39] a new country has actually enacted it. Now down the line, we still have like about five countries that are working on amendments or working on a new data protection law as we speak.
[10:48] So you see, all of this is changing because now we now have more commentaries, more people doing more reviews.
[10:54] Professionals emerging in that countries also share their daily realities about the practice, how things are evolving.
[11:01] So I think, yeah,
[11:03] the question was rightly framed. There's a lot of misunderstanding. But misunderstanding is also born not out of not knowing what is happening, but it's more like there's just not enough information to make a meaningful judgment or meaningful opinion.
[11:15] And I think the last part is also the part where the continent gets kicked as though it's just one country. So you basically speak about Africa and then you speak about, just like it's a monolith itself.
[11:27] But what you find is across the over 40 countries we lost, there are also pure divergence.
[11:33] I mean, they are convergence on the fundamental principles and some basic things, but they're also fundamental difference in so many issues.
[11:41] So a couple of years ago, I started this project called Privacy Lens Africa. And your idea was using visualization to tell stories, the patterns, the trends,
[11:50] and what are the commonalities you have in data protection laws and also the divergence you have in data protection laws in Africa are basically trying to storify it.
[11:58] So you can have a country that says, oh, we are going to actually pay attention to postmortem privacy.
[12:03] That means the rights, the data protection rights even exist beyond death.
[12:07] And then you have a country that, you know what, it's not a priority. It's really not our business.
[12:12] So you see all of that differences. You find some of the things are not so popular in your part of the world, for example, like filing mandatory audit reports, mandatory statutory.
[12:23] So,
[12:24] so you, you also have.
[12:26] So you see that where the laws are like completely distinct.
[12:30] And then you have things like mandatory registration with the regulator. In some countries you have things like authorization.
[12:36] Before you can transfer data out of a country, you need to go to the regulator to get like an authorization.
[12:41] So when people speak and they basically just make Africa a data point, as though everything there is the same. I think it's part of the wider conversation about not understanding the continents enough.
[12:52] But when you come down,
[12:53] you see how things are like, so different. The divergence, the convergence,
[12:59] new initiatives springing up that's not modeled after the GDPR or any of these laws that we speak about. I mean and I'll give you one quick reference.
[13:06] I was currently reviewing the law in Djibouti. Djibouti is a country that is around the home of Africa.
[13:13] It recently put out his data protection law as part of his wider digital code. And I felt wow, this is a law that actually must have learned from what has failed and what has involved in some part of the continent.
[13:25] They basically just try to make their law to be kind of distinct. They addressed issues,
[13:30] some really detailed details that you won't find in other data protection laws in Africa.
[13:36] So again that's just another example. The guy is also another interesting country who doesn't acted its law. And it's also, you can see that it has taken what has worked, what hasn't worked and then created its all based on that.
[13:48] So again that just shows to the extent of how the perception of the continent. But I think with more research coming out and small researchers also paying attention to what's happening on the continent,
[13:59] we're close to the time where we have people do global reports and then they skip the entire continent completely.
[14:05] How do you say that is global when you skip like 55 countries entirely? So I guess but with more information available we start seeing people start paying more attention to what's happening.
[14:14] But also with more people on the continent also telling stories of their own realities and what's happening their different parts of the countries or the continent. I think it's a matter of time before we get to that point where we have resource rich perspective on the continent itself.
[14:30] Also very objective information about what's happening on the continent.
[14:33] Debbie Reynolds: Wow,
[14:35] that was so deep what you just said.
[14:37] I guess a couple of points that you said that are fascinating that I want your thoughts on.
[14:43] First of all, it's true that Africa is not a monolith. There's many different countries and I think people sort of think at think of it as kind of one big country and it really isn't.
[14:54] Also one of the points that you made is a really good one and that is about rights after death.
[15:05] So the, and this is something I talk with people all over the world about because people think like for example at you and I know that like the GDPR and the eu those are cradle to grave rights.
[15:19] So once you die you don't have,
[15:23] you don't have those same rights.
[15:25] Right, Right, exactly. Where like in China your rights,
[15:30] if someone dies,
[15:32] they still have rights,
[15:33] their identity, their estate, all those Things have rights after that. And so when you said that some countries may have that in Africa, some don't,
[15:42] to me that's like a really big deal because I think when people are trying to compare and contrast these laws, they may not understand what that is. And in the US we don't even.
[15:53] We just have rights and we're consumers. So if you're not a consumer, you just don't.
[15:58] If you're not consuming, you don't have, have rights. So it's very different the way different countries slice up things.
[16:04] But your thoughts about this, and this comes up a lot. So the GDPR introduce this concept of legal bases for data processing and people just took that and ran. Right.
[16:19] And they're like. So a lot of people who maybe like you were saying Africa,
[16:25] there are many countries that had data protection regulation before the gdpr,
[16:30] right. So like around the time the Data Directive. And so I feel like,
[16:35] I feel like places that have had laws that came out before gdpr,
[16:41] they think of it a little bit differently. So like, for example, I had a client in Saudi Arabia, they don't have like legal basis.
[16:50] So like the GDPR say, okay, we have six ways you could process people's data and consent is kind of the last resort.
[16:59] So you're supposed to try to check the other five and then consent is the last resort where some place like the, A uae,
[17:07] maybe consent is the only thing.
[17:10] Right.
[17:11] So I want your thoughts about just that notion of a legal basis and how that plays out in your view in Africa.
[17:19] Ridwan Oloyede: Yeah, I mean,
[17:21] because the, like, the, the directive in itself had something somewhat similar. So many of the laws, the foundational laws that happened before then had pretty much melded after death.
[17:31] And so like a lot of countries also do have legal basis to different degrees.
[17:37] So but one thing you see recurrent amongst all of them is always the presence of consent. You see to the point where sometimes consent is even sort of prioritized in some markets where it's literally you have to get consent to do this, to transfer data.
[17:53] You have to have consent.
[17:55] And they are just very limited ways around how other things can be done.
[17:59] But what we are also seeing now is that many of these countries who had their laws early 2000s are also, they're making efforts to amend. Amend them or I've already amend to Cape Verde, for example, which is like the first country to enact the data protection laws, and then it's low.
[18:14] Senegal 2008, Morocco 2008 are also working to amend their laws to make them more in Tune with where things are currently.
[18:24] But interesting thing the regulators in those markets have also done is that they've also been.
[18:30] They've also done a lot in terms of providing guidance documents that have sort of extended traditional interpretation of what the law has sort of made. So that's going to give them an expansive view of things.
[18:42] So now those guidelines, those guidelines, those secondary regulations, and also helping to ensure that their regulatory oversight is still modern,
[18:54] even though the law is still as it is.
[18:56] But then there are ongoing work to do that because, I mean, that's purely legislative efforts.
[19:00] So. But generally legal basis exists across the different laws and then you see the different variations. So you can go to a country, for example, where you don't see things like legitimate interest.
[19:11] It's just, it's not just under the law,
[19:13] so it's just consent and other things.
[19:15] And you can go to a market, for example, where you have that and then you also have something completely new that you've not even seen before.
[19:23] I mean, I think I can't remember the country, but I've seen, for example, where scientific, historical, research purpose is in itself a basis.
[19:31] So which means you don't need to hang it on the traditional six as you know it.
[19:34] So again, like I said earlier, there are a lot of convergence. There are a lot of divergence on the continent, which is why, again, it's very important that when we speak about it, we speak to some of this nuance and this differences that you see across the different markets.
[19:48] So but generally, yes, it's something you find across consent a lot of times gets very amplified.
[19:54] And this amplification is also done by even the regulators and even the data subjects themselves too, who typically would think and based on what they understand is, oh, constant, really give a lot of control.
[20:04] It gives them some sort of power superpower that puts them in the driver's seat. But then in the real sense, it doesn't many times. So these are some of the things that like the evolving nature of the conversation on the continents.
[20:16] But yeah, a lot of work is actually being done to also, you know, deconstruct, demystify that part of it.
[20:23] But then there's still so. So lot of, I mean, I'm careful not to say the word obsession with consent,
[20:28] but yes, in different parts and pretty much like it's not unique to. It's not unique to the continent. You still see the future in even big conversations in other parts of the world where people speak about consent as though it's one interesting sword that offers protection against Every illness and every natural disasters,
[20:45] but it's really not.
[20:46] So yeah, there are a lot of differences you see across where you have the, you know, the European notion of the legal basis in some laws, some to a certain degree, maybe two, three, four, five of them, but not the entire six.
[21:00] And some even added something completely different that, that you won't find as a legal basis in,
[21:05] from the European point of view to be a legal basis under their laws.
[21:09] Debbie Reynolds: That's fascinating thinking about the legal basis.
[21:13] And it's true, I think two, I think consumers all around the world,
[21:19] consent can take many different forms and different shapes. And so understanding what it really means,
[21:26] they may have an idea that maybe give them more rights and more control than they actually have. So I think consent in and of itself, we could just talk about that.
[21:39] That would be a conversation in and of itself.
[21:41] Ridwan Oloyede: A whole conversation.
[21:42] Debbie Reynolds: Yeah, yeah.
[21:44] So what's happening in the world right now in data protection, data privacy or in technology that's concerning you,
[21:52] around your work and the things that you do in these areas?
[21:56] Ridwan Oloyede: I mean, so part of what I do day in, day out is also like regulatory intelligence. So part of what that means really is being able to pay attention to some of the evolving nature of the conversation globally.
[22:10] But I mean, for the sake of this is also what's the evolving nature of the conversation on the continent.
[22:15] So some of the things we've seen happening on the continent, for example, is more countries are introducing new laws, those with older laws are also trying to amend their laws to make them more modern and so also deal with some of the emerging issues.
[22:29] Another interesting thing is also with AI governance, for example,
[22:33] where, you know, now you're having a lot of countries talk about have any AI specific laws. I mean, Angola for example has like an AI bill.
[22:41] Same with Nigeria, same with Morocco, Egypt.
[22:44] An interesting part about the AI bill in Angola is it also takes the element of the EU AI act, you know, with the critical risk based model.
[22:53] But the interesting thing happening in Angola is there's a current proposal to also amend the Data Protection Law that also has specific AI inclusion, includes specific requirements on AI. So they kind of complement each other.
[23:05] Which is really interesting seeing happening in Angola. And it's moving really so fast. So we're seeing that where, you know, countries are trying to enact AI specific laws. I mean, I'm not a big fan of making technology a focus of regulation because there's a whole lot of problems around that.
[23:21] And as you can see, even with the EU AI conversation,
[23:24] the tech is still evolving A lot of new things are bringing up but also because of how unique things are in the north side of the world where we need to fix capacity, we send it to.
[23:34] There's a whole lot conversation around,
[23:36] you know, even funding new authorities are also being created as a result of creating new laws for new. So it's, it's a whole lot of issues. So that's my personal opinion and I feel maybe we should rather play with what we have currently to deal with some of the risk or some of the conversations that we have.
[23:51] Debbie Reynolds: Right.
[23:51] Ridwan Oloyede: And you know, trying to like reinvent and create new authorities and stuff like that. But yeah, another interesting thing you're also seeing like in Ghana, Ghana is not just seeing AI specifically Ghana is looking at emerging technologies broadly.
[24:03] The governance approach in Ghana is let's use the existence even though we're creating like a central coordinating body but rather leverage the existing authorities, the data protection, the information technology authority, the standards authority for product safety and then link specific issues to those authorities to deal with.
[24:21] Which I think yes,
[24:23] it's basically similar to what you call like the clearinghouse model. Clearinghouse regulatory model where you basically use existing authorities and you create some sort of coordination. They share resources, they share intel,
[24:34] they share capacity.
[24:36] So you're not inventing anything new, you're basically using what you have.
[24:39] But speaking away from that is also our data protection authorities are also playing an interesting role in Africa about AI governance. So from I saw back as 2019 by the way, actually the Moroccan authority imposed like a moratorium on the use of facial recognition technology which basically saying, you know what,
[24:57] we want to get a sense of what this really looks like, we want to understand it. But for now we're imposing the moratorium which was extended and after that they published like two guidelines on the use of facial recognition technology.
[25:07] We've seen Senegal also talking about the use of facial recognition in workplace and this was way before the EUA act by the way. I need to point that out.
[25:15] Some of these conversations go way back as far as 2017.
[25:19] We've also seen authorities publishing guidelines specifically on AI. You've seen lot of data protection, I mean increasing amount of data protection authorities in Africa doing something interesting.
[25:31] So that's one I think another interesting conversation is the cross border data flow framework. That's also very interesting. So historically you've seen few African countries who have been so Mauritius, Morocco and Kenya currently who have tried to get an EU adequacy decision.
[25:48] It's kind of proven elusive.
[25:50] It's kind of elusive. Let me Just put it that way because I will say as much as it's kind of framed as a human rights conversation, I think it's also an economical, a political conversation.
[26:00] So Morocco, Mauritius didn't get it despite the fact that they have one of the most interesting data protection authorities who've been around for a while.
[26:10] But you see Kenya might get it interestingly because last year when we were having the National Data Protection Authorities Conference, general conference, it was the EU delegation who actually mentioned that Kenya is in the pipeline for an EU adequacy decision.
[26:23] And that may happen probably in 2026 somewhere on daylight.
[26:27] But what we are seeing on the continent is when people, more countries are realizing okay, this is more like an elusive target.
[26:36] So they're creating a different model. A different model simply means shifting the conversation away from adequacy to looking at sub regional bodies like the East African Community for example, trying to create like a framework that can allow data more freely within the Community.
[26:52] The ECOWAS is also trying to amend the supplementary law to also ease the burden of cross border data flow.
[26:59] Then you have another interesting thing which is the global CBPR which is getting now quite popular in Africa. Nigeria is now an associate member. South Africa has indicated interest that he also wants to join the cppr.
[27:12] So there is a fundamental shift we are seeing. And now China has also announced it's also going to come up with an international research framework. And you know,
[27:21] Africa, China like a strong partnership there.
[27:24] So we're seeing that change happen.
[27:27] But the change isn't just limited to you know, all of this trend. It's also like how some of the laws these days are also being drafted to make sure there is that reciprocity within between African countries where a lot of MOUs are happening between African countries.
[27:41] And part of the conversation is also including cross border data flow. Another interesting thing is also the increase in enforcement.
[27:47] Angola, Nigeria, South Africa, Kenya,
[27:51] different African countries, you're seeing stronger enforcement. Things are changing. Record fines are being imposed,
[27:57] more organizations have been scrutinized, questions are being asked.
[28:01] So these are like some of the trends that we're seeing.
[28:04] And I think for what maybe one last interesting trend I think point out is also that is also emerging from the data protection authorities, also the conversation around online child safety.
[28:16] So again many of these conversations happening on the global north are happening there. But then in a unique way it's also happening on the continent and we're trying to find local solution, trying to deal with these problems as they emerge in our way.
[28:29] So yeah, to talk about some of the things that we've been seeing in the past few years.
[28:34] Debbie Reynolds: Wow.
[28:35] Learning so much. This is incredible.
[28:38] One of the things that you have mentioned just now and it's about adequacy,
[28:42] adequacy versus frameworks.
[28:45] And I agree with you a thousand percent about that. And so the, the thing that I find fascinating about this area and the reason why I really like frameworks, the difference to me, and I want your thoughts between adequacy and frameworks.
[29:05] I feel like adequacy is more like this is our law and we want you to align with our law where framework is like our laws are different but here's our commonality and here's our shared values and here's how we can work together without trying to make you like me.
[29:24] But what, what is your thought about that?
[29:27] Ridwan Oloyede: I mean adequacy is like creating some sort of exclusive club.
[29:31] Debbie Reynolds: So velvet rope. Like a velvet.
[29:34] Ridwan Oloyede: Yeah.
[29:34] I mean if you don't look like us, you don't roll in with us.
[29:38] So it's like some really exclusive club kind of thing.
[29:42] And yeah, quite a number of African countries honestly do have adequacy in their laws. Very few have sort of also published list of countries they consider to be adequate. Interestingly,
[29:54] another interesting thing is also the fact that non African countries are also recognizing some African countries to be adequate. Serbia, Russia, Bahrain, for example. I've listed a few African countries and say you know what, we consider them to be inadequate.
[30:07] Again, like I said, I think it's,
[30:09] I mean I wrote a paper that was published this year and the argument is I co authored was essentially it's an economy and a political thing rather than human rights.
[30:19] So that's what adequacy kind of looked like. So it basically does create you're with us or you're not with us or you're part of us, you're not working with us.
[30:28] But when what framework like CDPR will do is more countries that have been told you're not going to be part of us will find it more endearing because all you have to do is just show commitment.
[30:38] You're going to be guided by the framework in itself and the rules and then you can create,
[30:43] you know, the certification framework and then basically just roll with that. And when you have big economies on the continent like South Africa, Nigeria, showing interests, it tells you a story.
[30:53] So my prediction really is we're going to see more countries gravitate towards the CBPR framework and what the China government comes up with,
[31:02] then you see the gravitation towards the EU adequacy decision. And interestingly, you know, the fact that EU is also going on with some reforms trying to tone down,
[31:12] you know,
[31:13] the law.
[31:14] There's been like a running joke that if we're not careful, you're probably going to have African countries who are data protection laws than the EU laws because many some African countries actually modeled their framework against what the GDPR was there.
[31:26] So I think it's going to be an interesting next few years to see how that conversation is really going to go. But yeah, I think it's some gatekeeping in a way as well because you're seeing, because even for the come up with countries that that has been considered to be adequate from EU point of view.
[31:42] I mean there are questions you want to ask as well, there are questions you want to ask and those same standards don't scale for that part of the world. But I think that's an entirely different conversation.
[31:53] But yeah, that's what we're likely going to see emerge.
[31:56] Debbie Reynolds: Wow, that's incredible.
[31:58] Yeah, so, right, so recently the EU throw out threw out a proposal. Is it official yet?
[32:05] I think when it first came out they were like, this is a secret propos that we came up with about them trying to tone down the GDPR and the E Privacy Directive so that it doesn't stifle innovation and stuff like that.
[32:18] And so I don't know, I just laughed when I saw it and I was like, oh goodness, I don't know what they think they're doing.
[32:25] Part of the thing that I find a bit humorous about it is that a lot of the companies that don't care for the GDPR don't understand that the GDPR isn't that different from the Data Directive that had been enforced over 20 years.
[32:44] So I was like, so what were you doing for the last 25 years with data? Exactly. Like it's not that different. It's actually, I would say 80% the same as the Directive.
[32:54] So, so, and we've seen like when the Data Directive came out, there were a lot of countries, like you said, even in Africa,
[33:01] that modeled after that.
[33:02] So the GDPR wasn't that that different.
[33:07] And then also countries are trying to come up with their own ways to look at data.
[33:13] So I think it's going to be interesting.
[33:15] The funny thing about it is that the EU doesn't do anything fast.
[33:19] So even though they did this proposal, we'll probably still be talking about it for the next six years because I mean they had been talking about updating the E Privacy Directive.
[33:29] I just gave up because typically like.
[33:32] Ridwan Oloyede: Yeah, so it's good to be there for such an interesting amount of time.
[33:37] Debbie Reynolds: I typically. So when I do these five minute videos every week, I've done that for about six or seven years.
[33:43] And typically I'll only do a video on a law if it is passed or it changes. I was like, oh wait, I want au privacy. When it gets updated, I'll do a video about it.
[33:54] And it just never got updated.
[33:57] So it's just been in limbo all that time.
[34:00] One thing I want your thoughts about you touched on this and I think it's a fascinating thing and that is when regulators make laws about are about technology or have some type of technology element,
[34:15] the danger always is that you are too specific to a technology or you're not so agnostic that it doesn't make sense.
[34:28] And I think that's. That can be a problem. So that I think that's one of the challenges that I have with the AI Act.
[34:34] I do like the act and I like the fact that it's based on,
[34:38] you know, they have this whole thing about harm to the person.
[34:42] So making the person the center, I think is a very good thing. But then also trying to make a law about a technology,
[34:52] I think it narrows the way that countries can govern emerging tech because for me I feel like AI is a technology under the umbrella of emerging technology.
[35:06] And so if you're saying you're going to pass an AI law,
[35:09] are you going to have a Internet of Things law? Are you going to have a VR XR virtually law?
[35:17] Ridwan Oloyede: I said we almost had blockchain laws too.
[35:19] Debbie Reynolds: Yeah, right. Well, what was your thoughts about that?
[35:24] Ridwan Oloyede: That's a hard balance because I also work in policy. It also means like I know I teach regulation,
[35:31] I engage a lot in it.
[35:34] The challenge, or some of the challenges with having technology specific laws rather than principle technology agnostic ones, is that we risk what you call the precision trap.
[35:44] When things are too precise,
[35:47] we run into problems.
[35:50] That problem then builds on what you also call like the, sorry, the, the law of unintended consequences where because you are too specific,
[36:00] we create new set of problems.
[36:02] And that also is also then woven into what you call the,
[36:07] I can't remember the name right now, but basically what it means, what you were saying is when you have very technology specific law,
[36:15] you also have what you call the Collingwood dilemma. Actually, are you getting there too fast? Are you getting there too late?
[36:23] Which it's always going to be a problem.
[36:25] So but what you have is what I'm seeing also is few data protection authorities in Africa actually engaging in consultation,
[36:32] which is Cote d', Ivoire, for example, did something where they opened two consultations and they're saying what? Just come tell us about emerging text so we can have a better informed regulatory response.
[36:44] So that is how you are now having knowledge preceding regulation,
[36:48] which I think is a very fantastic one. You're also having some of them play with different experimental regulation models,
[36:53] which is.
[36:55] Let's learn from it first again before we design a regulatory response, which I think is also very smart and also a good use of resource.
[37:02] So but the challenge is when,
[37:04] you know, we want to act on impulse and we need to define what's our priority. Do you want to regulate foundational model? Are you prioritizing the risk or the use of the technology itself?
[37:14] Do you want to create like a risk tier where you also say some things are extremely exclusively prohibited.
[37:21] But the challenge is when you do this against all technologies,
[37:25] we some things it makes sense to just focus on coins. You it focus to focus on standards. So like quantum computing, for example, it makes sense to just focus on standards.
[37:36] So regulators also need to understand that ad law or the ad law is not just the only regulatory model. You can regulate through architecture, you can regulate through the markets, you can regulate through social behavior as well.
[37:48] So people need to, I mean, regulators need to think about their powers beyond just everything has to go through the hard law as you know it. So I mean, my conclusion really is when we narrow things down to specifically and we speak about, like we joked about it, Quantum computing law,
[38:05] IoT law, Internet of bodies law,
[38:08] I mean, we're just jokers.
[38:10] And we also understand our unique context, which is when we do this and the nature of the technology changes. For example, maybe it's the nature of the autonomy or maybe it's the agency that changes in the nature of the technology itself.
[38:23] Do we then go back to start amending when we know it takes like a very long legislative process to push amendments, to push new laws or push new reforms?
[38:32] Or do we just say the new regulator we are creating that we start looking for new resources for and we start stacking with new capacity.
[38:39] We give them powers to then do things that probably they also wouldn't have the competence to do. So I think we need to rethink how we do things. Principles are great.
[38:49] It gives us.
[38:50] There are times your principles are great, there are times where you need to be specific.
[38:53] But we need to find a way to balance all of this to ensure that we're not stifling. But beyond stifling, we're also not creating problems that we don't intend to create because sometimes you might,
[39:04] you might have no intent. No, I mean you can have noble intention to solve a problem, but you end up creating new set of problems.
[39:10] So yeah, that's, that's my take.
[39:12] Debbie Reynolds: Oh wow. This is mind blowing.
[39:15] Mind blowing conversation.
[39:17] Oh my gosh. I have to talk to you about this regulation,
[39:22] about the policy part because it's very tricky.
[39:25] It's a hard thing to navigate. Right. Especially because you're talking about technology. But then you're also talking about hopefully you're talking about harms to human. And so being able to navigate that and make it something that is really worthwhile and something that really does help people is definitely the key.
[39:46] Now Ridwan if it were the world according to you and we did everything you said, what would be your wish for privacy or data protection anywhere in the world?
[39:56] Whether that be regulation,
[39:58] human behavior or technology?
[40:00] Ridwan Oloyede: I go for human behavior because I feel like if you can, I mean to an extent there's like what agency can do for you when you actually you have agency.
[40:12] Even though the power dynamics may not entirely be yours and yours. But we've also seen regulation hasn't solved those problems.
[40:20] It hasn't taken away all the problems.
[40:22] And you know,
[40:24] but I think we can start having really good and interesting conversation from agency. Agency can lead us into activism, can lead us to stronger advocacy,
[40:33] evidence based advocacy,
[40:34] strategic litigations that can fog some of these changes that is taking us forever to get even user feedback can also force product redesign.
[40:44] So and I think what you've seen also is how some of these big players have actually make a lot, they've made a lot of progress with regulation than some regulators have done.
[40:57] And I'll give you a context.
[40:59] Look at when Apple introduced the att the app transparency.
[41:03] That's something regulation couldn't get lot of people to disclose for the longest time and then they simply did just with.
[41:11] So you see, you see my point.
[41:12] Look at how Google also tried to enforce things like making sure if you, if you build an app and you ask for people information on it, you must also include an, you know, a part on the app where you can allow people to delete their accounts which is like part of like the terms for hosting apps on Play Store.
[41:33] So again feedback can encourage whether there's a commercial incentive to do it is a different conversation. But I think when people are informed and they have their agency in that true behavior we have an interesting opportunity as reform.
[41:45] Of course, we need the other elements to also work. Technology to work, we need regulations to work. But I think putting people in the driver's seat, human behavior with well informed, with true autonomy can get us further.
[41:57] Debbie Reynolds: I love that I share that dream. I agree there is.
[42:02] I feel like regulation has a place, but it can't be everything.
[42:07] So, like, I don't think, I think sometimes people think of regulation as a shield and I don't think of it that way. And as you know, a lot of times some regulations are very reactive.
[42:17] So I'm all for prevention, like, let's prevent some things from happening as opposed to like, oh, wow, this bad thing happened to Johnny. Let's pass a law,
[42:27] a law about that. And so, and then, and like you say, these, the especially the OS makers have a lot of power. And so that app transparency deal was a huge game changer about giving people more control over their data.
[42:40] So I'm hoping to see more of that as well in the tech space. But, yeah, this is amazing. I just can't thank you enough for being on the show. It's a pleasure to have you on the show.
[42:51] Ridwan Oloyede: Thank you. So glad we eventually.
[42:56] Debbie Reynolds: Well, I'll talk to you, we'll talk soon and hopefully we'll find ways to collaborate. But thank you so much. I really appreciate you. All right, thank you.
