General Comment No. 25 on Children’s Rights in Relation to the Digital Environment: Implications for Children’s Right to Privacy and Data Protection in Africa

Abstract

The UN Committee on the Rights of the Child has published its much-awaited General Comment No. 25 on children’s rights in the digital environment in 2021. Much of the conversations since its adoption have centred on how General Comment No. 25 influences State behaviours in the western world or globally. Little attention has been given as to what General Comment No. 25 means for children’s right to privacy in Africa. This article seeks to explore the role of General Comment No. 25 in clarifying States’ obligations in respect of children’s rights to privacy and data protection in the digital era on the African continent. In doing so, this article first contextualises General Comment No. 25 in the broader context of the United Nations human rights system and analyses its recommendations on children’s right to privacy. Second, the article examines children’s right to privacy in Africa and analyses the specific features of the African human rights system that influence the understanding of this right. Finally, the article illuminates certain child-specific privacy and data protection measures that are being or have been included or discussed in the law-making processes and policy debates in a selection of African countries and links them to both General Comment No. 25 and the socio-cultural context of the continent.

1. INTRODUCTION

The digital age has brought both opportunities and challenges for the realisation of children’s rights across the globe.¹ The Internet and digital technologies have propelled children to express their views, and share and receive real-time information with very few spatial and temporal limitations.² In Africa, however, the digital divide remains wide across the continent. This is because only 43.2 per cent of the total population can access the Internet.³ According to the 2020 International Telecommunication Union (ITU) and UNICEF report, only 14 per cent of children in Africa have access to the Internet.⁴ For example, only 5 per cent of children and young people in West and Central Africa have Internet access at home compared to the 33 per cent global average.⁵ The digital divide in Africa, as elsewhere in the world, has left many children unable to take advantage of the opportunities offered by the Internet. They face several intersectional challenges, including financial constraints, limited digital literacy, and factors related to race and gender.⁶

While uneven Internet access and digital illiteracy are universal challenges that can hinder the exercise of children’s rights in a digital context, including the right to privacy, they are particularly pronounced in Africa.⁷ Beyond the problem of access, digital illiteracy exacerbates issues related to children’s privacy.⁸ It hampers their ability to effectively navigate social media, develop and create content, seek valuable information, discern and report harmful content to social media platforms and Internet intermediaries, among other concerns.⁹

Some of the challenges that African children encounter, align with challenges faced by children in other continents. For example, research has found that ‘children across the world are demanding that commercial entities explain how they are collecting, storing and using children’s data’.¹⁰ In this regard, children want guarantees that they will not be commercially exploited, and have called on governments to adopt legislation to protect their data and curb industry surveillance of children online.¹¹ Besides corporate surveillance, children in Africa face challenges associated with sharenting, where their parents’ right to freedom of expression clashes with their own right to privacy.¹² Indeed, parents in this part of the world, as in other parts, also share images of their children from the moment of conception into their late teens through social media and the Internet, preventing them from choosing how they portray themselves in the digital environment.¹³

According to the African Children’s Committee, sharenting is a growing practice encroaching on children’s privacy across Africa.¹⁴ More specifically, the Committee underscores that children’s privacy is at risk due to, among other things, sharing of children’s personal information by children themselves or their parents or other individuals, as well as by governments and businesses who are tracing, collecting, processing, monitoring and broadcasting children’s images, behaviour and locations on websites and through other digital technologies.¹⁵

Other issues related to children’s right to privacy in Africa are driven by cultural, economic and technological factors. This article will zoom in on the strong emphasis in African societies on community and collective interests, which may affect how children’s right to privacy is perceived and implemented. Furthermore, the digital divide may contribute to children and parents being less familiar with online privacy risks and less aware of how to exercise their rights in practice. Children in Africa also face language barriers that prevent them from reporting to Internet intermediaries or social media platforms that content about themselves is being distributed illegally, violating their privacy online.¹⁶

At the international level, guidance on children’s right to privacy in the digital environment has been offered in General Comment No. 25, adopted by the United Nations (UN) Committee on the Rights of the Child (CRC Committee) in 2021.¹⁷ General Comment No. 25 carefully addresses the opportunities, risks and challenges in respecting, protecting and fulfilling the full range of children’s rights in the digital environment.¹⁸ With its adoption, the Committee sought to clarify how States parties—including 54 African States—should implement the Convention with respect to the digital environment and provides guidance on relevant legislative, policy and other measures to ensure full compliance with their obligations under the Convention. The drafting process of General Comment No. 25 was participatory in nature, as it involved various actors and a series of consultations with States, civil society organisations, and most importantly an international consultation with 709 children and young people living in a wide variety of circumstances in 27 countries on six continents. Six of these countries are in Africa: Ethiopia, Egypt, Ghana, Kenya, South Africa and Tanzania.¹⁹

At the UN level, regional treaties designed to promote and protect human rights are regarded as particularly well-suited to address and resolve human rights situations within their respective regions, ‘whilst upholding cultural traditions and history unique to the region’.²⁰ The African human rights system places a significant emphasis on collective and communal rights.²¹ This approach differs from the UN and European human rights systems, which are based on an individualistic conception of human rights.²² Sloth-Nielsen and Mezmur explain that ‘the African conception of human rights highlights that the notion of protection of the individual needs to be balanced by the acknowledgment that the individual is embedded within a community’.²³ It entails that all individuals—including children—have duties—or responsibilities²⁴ towards their family and society, the state and other legally recognised communities and the international community.²⁵ In this context, several important questions arise: How does the communal orientation impact the interpretation and implementation of children’s right to privacy and data protection in a digital context? In what ways does General Comment No. 25 influence or interact with the communal orientation of the African human rights system? Additionally, how do national data protection laws reflect or accommodate communal values?

Against this backdrop, this article delves into the implications of General Comment No. 25 for children’s right to privacy (and data protection) in Africa. Section 2 begins by contextualising General Comment No. 25 within the broader UN system of human rights, while also shedding light on its specific role in clarifying and illuminating children’s rights in the digital environment. Section 3 provides a succinct overview of the distinctive characteristics of the African human rights system pertaining to children’s rights. Moreover, it explores the conceptualisation of the child’s right to privacy in Africa, as well as the interplay between the African Children’s Charter and UN Convention on the Rights of the Child (UNCRC). Following this, Section 4 discusses the relationship between General Comment No. 25 and selected national legislative initiatives regarding data protection in Africa. Section 5 assesses the obligations of African States under General Comment No. 25 through the lens of cultural context in the continent and Section 6 concludes by summarising the key findings of the article.

2. THE ROLE OF GENERAL COMMENT NO. 25 IN CLARIFYING CHILDREN'S RIGHTS IN THE DIGITAL ENVIRONMENT

A. General Comment No. 25 Within the UN Human Rights System

The UN human rights system is a framework of international law (consisting of several treaties and conventions) and institutions (treaty bodies) established to promote and protect human rights worldwide.²⁶ UN treaty bodies—such as the UN Committee on the Rights of the Child²⁷—are committees of independent experts charged with monitoring the implementation of the treaties by States Parties and providing guidance on how to better realise human rights. One type of guidance from these treaty bodies are General Comments, which aim to illuminate the content of the rights set out in a specific treaty, outline potential violations of those rights and offer advice to States parties on how best to comply with their obligations under a human rights treaty.²⁸ Scholars argue that General Comments have taken the form of a powerful and indispensable interpretative tool that assists in reinforcing standards as well as in pushing at the boundaries of the law.²⁹ The main characteristic feature of General Comments across the board is, as the term ‘general’ suggests, that they comment on issues of a general nature, thereby addressing all States Parties to any of the international treaties rather than a particular State Party.³⁰

While General Comments do not legally bind States parties,³¹ they carry ‘considerable legal weight’ to interpret the terms of a treaty and clarify the obligations of State Parties.³² Additionally, General Comments are important documents that help States Parties prepare their reports to treaty bodies. As of December 2022, the UN treaty bodies had published a total of 178 General Comments (or General Recommendations).³³ Out of these, 25 were drafted by the UN Committee on the Rights of Child.

General Comment No. 25 was adopted in 2021, in response to the rapid and major changes in technology, and the increasing use of digital technologies by children. A few years earlier, scholars had voiced the need for a new General Comment in this area, as principled, coherent and authoritative guidelines for addressing children’s rights in the digital environment were lacking.³⁴ General Comment No. 25 recognises that while the digital environment offers great opportunities for children and their rights, including access to information and communication, it also presents new challenges and risks to their rights that State Parties must address, including online exploitation and the (excessive) collection and misuse of personal data. It addresses among other things the meaning of the general principles (i.e. the right to non-discrimination; the best interests of the child; the right to life, survival and development; and respect for the views of the child) and the various rights enshrined in the UNCRC (e.g. the right to privacy, freedom of expression, protection from commercial exploitation) in a digital context.³⁵

General Comment No. 25 sets out in more detail the specific positive obligations that States have to protect the rights of children in the digital environment, such as revising or adopting legislation; ensuring comprehensive policies and strategies; and facilitating independent monitoring and investigations by national human rights bodies.³⁶ Besides State obligations, General Comment No. 25 also clarifies the role of private and business sector actors such as social media platforms and other Internet intermediaries, who must fulfil their responsibility to respect children’s rights.³⁷ According to international human rights law, these actors have negative obligations which entail refraining from violating children’s rights through impermissible privacy and data processing practices (Article 16 UNCRC), economic exploitation (Article 32 UNCRC), discrimination (Article 2 UNCRC) and infringements of all types of freedoms (e.g. Articles 10, 11 UNCRC).³⁸ As primary duty bearers under the UN human rights system, States Parties have a positive duty to ensure that the business sector complies with children’s rights standards through appropriate legislative, regulatory, and supervisory frameworks.³⁹ Thus, the added value of General Comment No. 25 is to inform all States Parties on how they can shape policies, legislation and other measures to ensure that children’s rights in the digital environment are realised.⁴⁰

B. General Comment No. 25 and Children’s Right(s) to Privacy (and Data Protection) in the Digital Environment

The largest section in General Comment No. 25 is the section devoted to the right to privacy (Article 16 UNCRC) highlighting that ‘privacy is vital to children’s agency, dignity and safety and for the exercise of their rights’.⁴¹ Although a right to ‘data protection’ is not explicitly included in the text of the UNCRC, there are references to its link with the right to privacy in a number of UN guidance documents⁴² and reports, and this is also—extensively—the case in General Comment No. 25. For example, paragraph 67 of General Comment No. 25 recognises that

threats to children’s privacy may arise from data collection and profiling by public institutions, businesses and other organisations” but equally “from the activities of family members […], for example, by parents sharing photographs online or a stranger sharing information about a child.

Paragraph 68 mentions a number of digital practices that rely on data processing—such as profiling, behavioural targeting, mandatory identity verification, mass surveillance—that the Committee believes could lead to arbitrary or unlawful interferences with children’s right to privacy.

With regard to States’ duties on the right to privacy, paragraph 70 of General Comment No. 25 provides that States have a duty to adopt and enforce data protection legislation that contains specific protections for children, without arbitrarily restricting other rights, such as children’s right to freedom of expression or their right to play.⁴³ This duty means inter alia that States should require the technology industry to integrate privacy-by-design into digital products and services that affect children. In addition, States should ensure that children have data subject rights they can exercise against technology providers, and more generally, that they are entitled to an effective remedy for violations of their rights (including but not limited) to privacy and data protection.⁴⁴ General Comment No. 25 also calls for a legal ban on certain digital practices, including commercial profiling, targeted advertising and neuromarketing.⁴⁵

The General Comment also acknowledges that it is the duty of States to render appropriate guidance and support to parents and caregivers in carrying out their child-rearing responsibilities. This requires the facilitation of awareness-raising⁴⁶ and educational programmes containing information on how to protect children’s privacy, for various stakeholders (including children, parents, caregivers, the general public and policymakers). General Comment No. 25 also stresses the importance of preserving children’s evolving capacities and autonomy in this regard, and States should assist parents in striking an appropriate balance between their responsibilities and the child’s rights.⁴⁷ The principles that should guide parents and caregivers in this balancing exercise are the best interests of the child and the consideration of the child’s evolving capacities. Moreover, it is worth noting that paragraph 86 of General Comment No. 25 underscores the importance of States taking into account the unique and specific nature of parent–child relationships when providing support and guidance. This suggests that contextual factors, such as cultural norms and factors, must be carefully considered. One particularly sensitive and culture-dependent question that General Comment No. 25 touches on is the extent to which parents and caregivers may monitor and track a child’s digital activity. The General Comment points out that such monitoring tools, if not implemented carefully, may hinder a child’s ability to seek help from a helpline or access sensitive information.⁴⁸ Therefore, States are encouraged to educate children, parents, caregivers and the public about the importance of the child’s right to privacy and how parental practices can infringe upon this right. In cases where parents and caregivers monitor a child’s digital activity, they should act in a proportionate manner and with due consideration for the child’s evolving capacities.⁴⁹

This examination of General Comment No. 25 reveals that States are bound by specific obligations pertaining to the protection of children’s privacy in the digital environment. These obligations are subject to additional refinements influenced by the distinct socio-cultural contexts of each State. Subsequently, the following section delves into the African human rights system, offering an exploration of how these obligations are further developed and influenced within the African context.

3. CHILDREN'S RIGHT TO PRIVACY IN AFRICA

A. The African Human Rights System Relating to Children’s Rights

The African human rights system is one of the three major regional human rights systems⁵⁰ and was formally created on 27 June 1981 with the adoption of the African Charter on Human and Peoples’ Rights.⁵¹ Because the African human rights system is relatively younger than the European and Inter-American systems, it is often considered and quoted as less developed, but at the same time, according to some, undervalued in terms of its contribution to conceptualising human rights, including children’s rights.⁵² Llyod, in particular, regards it as the most forward-thinking among regional systems and notes it was the first to adopt a specific declaration on children’s rights (infra).⁵³

Early on African States met in Monrovia, Liberia, from 17 to 20 July 1979 to discuss a number of issues on the rights and welfare of children in Africa, culminating in the adoption of the African Declaration on the Rights and Welfare of the African Child. The African Declaration, also known as the Monrovia Declaration, was the first non-binding legal document in Africa that urged African States to take appropriate measures to promote and protect the rights and welfare of children in the continent. In addition, the African Declaration considers children as ‘inheritors and keepers of African cultural heritage.’⁵⁴ This means that the African Declaration places great emphasis on African cultural heritage, historical background and values of civilisations when it comes to the protection and promotion of children’s rights.⁵⁵

Later, in 1990, this position was mirrored in the preamble of the African Charter on the Rights and Welfare of the Child (ACC).⁵⁶ The ACC is an important regional instrument for advancing children’s rights both offline and online.⁵⁷ Notably, the ACC has been argued to set standards that go beyond those outlined in the UNCRC. An important example is Article 4 (1) ACC, which asserts that the best interests of the child are the primary consideration, surpassing the comparatively lower standard set by Article 3 (1) UNCRC, where they should be a primary consideration.⁵⁸ The ACC is complemented by the primary regional human rights instrument, i.e. the African Charter on Human and Peoples’ Rights (also known as the ‘Banjul Charter’). Although the Banjul Charter and the ACC differ in terms of their object and content, they share a number of characteristics. First, both instruments have codified three generations of rights,⁵⁹ namely civil and political rights, socio-economic rights, and third generation solidarity rights.⁶⁰ They include, for example, the protection of the rights to freedom of expression⁶¹, privacy,⁶² education⁶³ and health.⁶⁴ The second common feature of these instruments is the emphasis on individual duties.⁶⁵ This entails that everyone (including a child) has a duty to their family, society and country.⁶⁶ As Makau Mutua has observed, ‘the governing narrative which claims no rights without duties became an African dialect’.⁶⁷ Thus, both the Banjul Charter and the ACC reflect the view that individual rights must be accompanied by duties of individuals.⁶⁸ They also incorporate various ‘claw-back clauses’—a term that is used to refer to provisions that entitle States to limit the rights granted to the extent permitted by national law.⁶⁹ However, these are now understood to be limitations that must be consistent with international law.⁷⁰ This reflects the principle that human rights are not absolute, aligning with other international and regional human rights instruments.

Finally, both instruments established independent human rights mechanisms to oversee the promotion and protection of human and children’s rights in Africa. For example, to oversee the implementation of the Banjul Charter, the African Commission on Human and Peoples’ Rights was established⁷¹ as a quasi-judicial body (performing a number of judicial-like functions) of 11 independent experts⁷² and is mandated to perform five basic functions.⁷³ These are: promotional (Article 45(1) of the Banjul Charter), receiving state reporting (Article 62 of the African Charter), protective (Articles 47–59 of the Banjul Charter), interpretative (Articles 60 and 61 of the Banjul Charter) and other tasks assigned to the Commission (Article 45 (4) of the Banjul Charter). The African Committee of Experts on the Rights and Welfare of the Child (‘African Children’s Committee’) was established as a supervisory body empowered to oversee the promotion and protection of the rights of children in Africa.⁷⁴ Crucially, the mandate of the African Children’s Committee mirrors that of the African Commission on Human and Peoples’ Rights,⁷⁵ in that the African Children’s Committee can receive individual and inter-state communications, is also mandated to interpret the Charter,⁷⁶ examine state reports,⁷⁷ and may undertake fact-finding missions.⁷⁸ Hence, the mandate of the African Committee corresponds to that of the African Commission, but specifically focuses on children’s rights.⁷⁹

B. The Role of Parents, Guardians and the Broader Community in the ACC and its Implications for Children’s Right to Privacy

At the time of the adoption of the UNCRC, there was a sentiment among African governments that the CRC did not pay sufficient attention to important socio-cultural and economic realities of African society.⁸⁰ It was argued that the drafting process lacked diversity and inclusion, resulting in a Convention that according to some, was too western-centric.⁸¹ This situation was partly due to tensions between the global East and West at the time, and in the underrepresentation of African States.⁸² It resulted in a number of factors that were important to the African context being excluded from the drafting process, such as considerations of socio-economic circumstances, culture, tradition and development.⁸³ Consequently, African States adopted an independent children’s rights instrument, the African Children’s Charter (supra), in the firm belief that it would (re)surface African cultural values.⁸⁴

While the UNCRC generally makes it clear that children are independent subjects and have rights, the ACC adds that African cultural values and experiences should be taken into account when considering children’s rights issues in Africa. The perception of children as independent rightsholders has been difficult to realise in African societies because ‘the attitude of domination over children by adult(s) has continued to determine the destiny of children, especially children in Africa’,⁸⁵ particularly in rural areas.

Against this backdrop, the ACC, for instance, recognises the central role of parents and caregivers in guiding and directing children in the exercise of their rights, and includes various elements of parental or guardian power. For example, Article 9 of the ACC reinforces the duty of parents and caregivers to provide guidance and direction to children in the exercise of their right to freedom of thought, conscience and religion.⁸⁶ Article 10 ACC provides that ‘parents or legal guardians shall have the right to exercise reasonable supervision over the conduct of their children’, which is also applicable in the digital environment (see infra). Article 31 ACC is a further manifestation of the relationship between children and adults, as it imposes on children the responsibility to respect their parents, superiors and elders at all times, which is meant to preserve and strengthen African cultural values.⁸⁷ This can be framed within the cultural and social norms in Africa, such as Ubuntu.

The concept of Ubuntu originally derived from a proverb in South Africa—‘umuntu ngumuntu ngabantu’ which means that a person is a person through other persons.⁸⁸ While the concept of Ubuntu is well developed in South Africa, it is reflected in other African societies of Bantu origin, including in Central, East and West Africa.⁸⁹ Ubuntu mirrors some of the ideals of African humanism by emphasising communalism, interdependence, obedience towards elders and community, respect for others, humanity, sharing, compassion and caring.⁹⁰ Through custom, these principles of Ubuntu are to be taught and passed on to children in a manner that will allow them to develop into unique human beings, endowed with these principles.⁹¹ In King N.O. and Others v De Jager and Others, the Constitutional Court of South Africa stated: ‘At the heart of ubuntu is the idea that a society based on human dignity must take care of its most vulnerable members and leave no one behind.’⁹² According to Ubuntu philosophy, it is the duty of the whole community to mould children into good members of that specific community and the broader society.⁹³ This means that not only parents or legal guardians have a say in children’s upbringing but also the community as a whole would have a role in shaping children’s attitudes.⁹⁴ In addition to the principles of Ubuntu, there is a widely held adage in the continent, ‘It takes a village to raise a child,’ which aptly encapsulates the vital role of community in nurturing children in Africa.⁹⁵

The UNCRC was drafted in a way to accommodate cultural practices regarding parenting like the ones described above.⁹⁶ First, Article 5 UNCRC specifies that

States Parties shall respect the responsibilities, rights and duties of parents or, where applicable, the members of the extended family or community as provided for by local custom, legal guardians or other persons legally responsible for the child, to provide, in a manner consistent with the evolving capacities of the child, appropriate direction and guidance in the exercise by the child of the rights recognized in the present Convention.⁹⁷ [Emphasis added]

This inclusion of the reference to ‘members of the extended family or community as provided by local custom’ was intended to acknowledge that in certain communities, individuals other than parents may assume responsibility for the daily care of children.⁹⁸ Along these lines, the CRC Committee explains that the notion of ‘family’ should be understood as ‘a variety of arrangements that can provide for young children’s care, nurturance and development, including the nuclear family, the extended family, and other traditional and modern community-based arrangements, provided these are consistent with children’s rights and best interests’,⁹⁹ again demonstrating that cultural practices are taken into consideration in these discussions. Additionally, Tobin and Varadan explain that the nature of the responsibilities, rights and duties of parents (or other caregivers) that States are required to respect are not only informed by the UNCRC (particularly Articles 5, 14, 18 and 27) but also by other sources. These sources may include other human rights instruments such as regional treaties (e.g. the ACC), domestic legislative standards (e.g. national data protection laws), and/or cultural and customary practices regarding the role of parents.¹⁰⁰ This underscores the complementary nature of regional mechanisms and instruments in relation to international human rights law. Regional human rights laws, such as the ACC, aim to tailor international norms to reflect regional characteristics and conditions.¹⁰¹ While the UNCRC remains the foremost instrument for protecting and promoting children’s rights globally,¹⁰² the ACC builds on the same fundamental principles while highlighting issues of special importance in the African context.¹⁰³ In other words, in drafting the ACC, the unique socio-economic, cultural, traditional and developmental circumstances in Africa were taken into account.

Both the UNCRC and the ACC contain specific provisions on the right to privacy for children. The ACC has a corresponding provision to Article 16 UNCRC and sets out that

No child shall be subject to arbitrary or unlawful interference with his privacy, family home or correspondence, or to the attacks upon his honour or reputation, provided that parents or legal guardians shall have the right to exercise reasonable supervision over the conduct of their children. The child has the right to the protection of the law against such interference or attacks.¹⁰⁴

There are at least two key differences between these instruments in terms of how they frame the meaning of the right to privacy.¹⁰⁵ The first concerns the omission in the ACC of the word ‘unlawful’ in relation to attacks to a person’s honour or reputation. Gose argues that this was probably a drafting error, noting that protection against ‘lawful’ attacks is a highly improbable interpretation.¹⁰⁶ The second and more substantial difference between the two instruments lies in the inclusion of the supervisory power of parents and guardians in the ACC in this context. Specifically, the ACC states that ‘parents or legal guardians shall have the right to exercise reasonable supervision over the conduct of their children’ (emphasis added). This qualification regarding the exercise of children’s right to privacy in the ACC is not included in the UNCRC. This is crucial to consider when conceptualising the right to privacy in the African context. Linked to this, the African Children’s Committee in its General Comment No. 4 on Article 31 on the Responsibilities of the Child, underlines that there is a need to strike a balance between the authority exerted by adults over children and the corresponding responsibility of children to be respectful and mindful of such authority.¹⁰⁷ Notably, the General Comment goes further to state that the ‘[r]ights of the child including freedom of expression, privacy, participation, and development, among others, shall not be compromised or violated by reference to “respect for adults’.¹⁰⁸ In other words, children’s fundamental rights, such as the right to privacy, should not be restricted under the guise of ensuring the duty to respect elders or adults. More recently, the African Children’s Committee in its General Comment No. 7 (2021) further cautioned that managing these tensions in the digital environment requires sensitive approaches.¹⁰⁹ For example, parents should be equipped to educate and advise their children about online privacy and safety, rather than denying children access to the online space altogether, as the online and offline domains are increasingly intertwined and cannot be easily separated.¹¹⁰

An illustrative case that highlights the challenges associated with parental supervision in the digital environment and the protection of a child’s right to privacy is the case of SM v ABB case 20/1732, presented before the South African High Court.¹¹¹ The Court rendered a significant judgment affirming that the act of accessing children’s messages on social media messaging apps and subsequently disseminating them to third parties without the knowledge of their legal guardian constitutes an infringement of the right to privacy on the Internet.¹¹² This legal dispute arose within the context of a contentious divorce case, where the father had shared private content from the child’s WhatsApp conversations with the mother.¹¹³ The Court ruled that the defendant’s conduct in accessing and dissemination the messages infringed upon the right to privacy of both the mother and the minor child.¹¹⁴ This case serves as an indication that parental rights to access their children’s digital communications without justifiable cause may be constrained to ensure protection of the child’s right to privacy in the online sphere.

4. THE INTERPLAY BETWEEN GENERAL COMMENT NO. 25, SELECTED (NATIONAL) DATA PROTECTION LAWS AND THE SOCIO-CULTURAL CONTEXT OF THE AFRICAN CONTINENT

The remainder of this article takes a closer look at the efforts made by a selection of African States in fulfilling their duties to safeguard children’s right to privacy in the digital age, primarily through the enactment of national data protection laws.¹¹⁵ These efforts are analysed in conjunction with General Comment No.25, and the cultural norms discussed earlier.

A. Introducing the Landscape of Data Protection Laws in Africa

The data protection landscape in Africa showcases a diverse array of instruments at different levels, including regional, sub-regional and national frameworks. Some of these instruments are still in the draft stage, or have not yet come into effect posing challenges for their implementation and enforcement. In 2014, African States negotiated the Convention on Cyber Security and Personal Data Protection, also known as the Malabo Convention. This Convention has only recently entered into force, in June 2023, following struggles to obtain sufficient ratifications.¹¹⁶ On the other hand, some African countries have ratified the Council of Europe Convention 108(+),¹¹⁷ which is also open for signature and ratification by non-members of the Council of Europe. In this way, the Council of Europe aims to harmonise data protection standards globally, transcending continents. There are several reasons for countries to accede to the Convention, not in the least reasons related to trade.¹¹⁸ Among African nations, Cape Verde, Mauritius, Morocco, Senegal and Tunisia have ratified the Convention, while Burkina Faso has signed it but not yet ratified. Importantly, none of these regional instruments currently include specific protections for safeguarding children’s personal data.

At the sub-regional level, sub-regional economic communities have also shaped data protection legislation within Africa.¹¹⁹ For example, in 2010, the West African Economic Community (ECOWAS) members have adopted a Supplementary Act on Personal Data Protection¹²⁰—which complements the Revised ECOWAS Treaty and is now fully binding in fifteen Member States in Africa.¹²¹ The Act aims to define the content of data protection legislation in ECOWAS Member States,¹²² including the composition of a data protection authority.¹²³ Interestingly, the ECOWAS Supplementary Act draws inspiration from the European data protection model in terms of data collection and processing, data quality and proportionality, transparency, security, rights of access and rectification, restrictions on transfers of data and sensitive data.¹²⁴ This is because the Supplementary Act project was supported by the European Union (EU) and the ITU. Despite these significant efforts, similar to other regional instruments, the Act does not currently incorporate specific measures to protect children’s personal data.

Finally, at the national level, data protection laws have been adopted by 35 African countries so far.¹²⁵ Additionally, three countries have draft bills on data protection, while 10 countries currently lack legislation in this domain.¹²⁶ In the upcoming section, a selection of existing data protection laws is analysed, focusing on specific protections for children. The selection is not meant to be exhaustive but aims to highlight pertinent aspects from specific African countries that have data protection laws in place. This selection was based on two criteria: firstly, whether their national data protection laws contain explicit provisions pertaining to children’s data protection, and, secondly, their representation of the North, East, West and South African sub-regions. Consequently, Egypt (North Africa), Mauritius (East Africa), Nigeria (West Africa), South Africa and Zambia (Southern African States) were selected as illustrative examples. The aim is to assess the extent to which the legislative instruments of the selected African countries align with the specific recommendations outlined in General Comment No. 25 while considering the socio-cultural context of the African continent.

B. An Analysis of Specific Provisions on the Protection of children’s Data in Selected African Countries

Our analysis shows that across the selected States, as is the case in other parts of the world, there are significant differences in terms of the age threshold for specific data protection measures pertaining to children. For instance, in Nigeria, there are specific rules governing the processing of personal data of children under the age of 13¹²⁷, while in Zambia, the threshold is set at under 15¹²⁸ and in Mauritius it is under 16.¹²⁹

However, when specific protections for children are included, they are limited to parental consent requirements—with the exception of Zambia.¹³⁰ The legislators of the selected countries have generally adopted a stance of prohibiting the processing of children’s personal data, unless parental or guardian consent is obtained. An example of this approach can be found in Section 30 of the Mauritius Data Protection Act, which explicitly states that parental consent is the sole legal basis for processing children’s personal data and represents the only provision specifically addressing children in the Act. It is worth considering that the age threshold is set at 16 in Mauritius, which raises questions about participatory chilling effects for those children whose parents are perhaps not present, informed or willing to consent. In Nigeria, consent for the processing of personal data of a minor is required,¹³¹ as stated in the 2023 Data Protection Bill, which explicitly stipulates that consent must be obtained from parents, or legal guardians.¹³² Other national acts treat children’s data as sensitive data. In Egypt, for instance, children’s data are mentioned under Chapter 6 ‘sensitive personal data’, the processing of which is prohibited unless the guardian’s consent is obtained.¹³³ However, apart from this categorisation, no additional protection measures specifically addressing the processing of children’s personal data are outlined.

Our analysis also revealed that in certain African countries the mechanisms of parental or guardian consent are supplemented with measures aimed at empowering the child, but this is not the case everywhere. General Comment No. 25 underlines that children have the right to be informed about the processing of their personal data in a language and format they can understand. In particular, it states this as part of business’ responsibilities for children’s right to privacy: ‘they should also provide information to children, parents and caregivers on such matters, in child-friendly language and accessible formats.’¹³⁴ While lawmakers in Nigeria and Zambia included explicit provisions on the right to child-friendly information, lawmakers in Egypt, Mauritius and South Africa omitted this in their national laws. For instance, the Nigeria Data Protection Act Implementation Framework requires that privacy policies be drafted in a child-friendly form when data controllers’ or processors’ target their services at children.¹³⁵ In Zambia, there is a generic provision on the right to accessible information during data processing that could be applied across the board to all data subjects including children. Specifically, the Zambian Act stipulates that

Where a data subject consents in the form of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.¹³⁶

By providing child-friendly information as suggested under the General Comment No. 25, African States could further reinforce and protect children’s right to privacy in the digital environment. This is crucial for enabling children’s access to information in their local languages and dialects.

5. DISCUSSION: ASSESSING AFRICAN STATES' DUTIES UNDER GENERAL COMMENT NO. 25 IN LIGHT OF CULTURAL CONTEXT

General Comment No. 25, issued by the CRC Committee, holds significant importance as an interpretative document that provides valuable guidance to States—including African countries—regarding their obligation to safeguard children’s right to privacy in the digital environment through legislation and other measures. In the face of regulatory challenges for children’s right to privacy posed by the digital age across the world, the adoption of General Comment No. 25 addresses the pressing need for clarification, reflection and direction on the duties of States in realising children’s rights to privacy in the digital environment. This influential document sets forth two main duties for States in this context. First, it calls for the development of robust legal frameworks, specifically data protection frameworks, which include provisions providing specific protection for children when their personal data are processed. Such frameworks must go beyond general data protection laws to address the unique vulnerabilities of children. Second, General Comment No. 25 emphasises the duty of States to provide appropriate guidance and support to parents and caregivers, enabling them to effectively fulfill their roles in safeguarding children’s right to privacy.

In relation to both duties, General Comment No. 25 acknowledges the significance of local contexts and cultural norms in shaping the understanding of children’s right to privacy in the digital environment. It recognises the need for flexibility, allowing (African) States to shape their legal frameworks and provide guidance and support to parents in a manner that aligns with the specific cultural and contextual considerations in which children grow up.¹³⁷

Regarding the first duty, there is a noticeable disconnect between African data protection laws and the requirements of specific protection for children outlined in General Comment No. 25. At the regional level, while there is some general guidance provided by the ACC and the Malabo Convention, there is a lack of explicit and specific recognition of children’s privacy and data protection through these treaties. Additionally, there are no concerted efforts across the continent harmonising regulations pertaining to children’s privacy and data protection.¹³⁸ As such, increased (sub)regional coordination and coherence could arguably contribute to the development of more robust and consistent safeguards for children across the continent.

At the national level, only a limited number of African countries have implemented specific protections for children. Where provisions are included, these measures predominantly revolve around parental consent requirements or the provision of child-friendly information. This approach might be too limited in light of the full range of recommendations of General Comment No. 25. Moreover, the challenges of obtaining parental consent for the processing of children’s data in the digital environment have been well-documented also in other regions. For instance, in relation to provisions related to parental consent in the context of the EU General Data Protection Regulation, scholars have emphasised that parents are not necessarily better informed or better equipped to understand what they are consenting to. In a continent where digital illiteracy is high, this might even be more challenging. Furthermore, practical difficulties may arise for children in care or other vulnerable situations where parents are absent.¹³⁹ In Africa, in particular, where a more communal approach is prevalent, the focus on the parent in the context of data protection might not conform to the cultural context. Additionally, the requirement of parental consent could lead to excessive parental supervision and interference in children’s lives.¹⁴⁰ Regarding the latter, of course, the right to reasonable supervision of parents and other caregivers in Article 10 ACC is relevant to note. The line between excessive and reasonable supervision in a digital context might be thin. In this regard, General Comment No. 25 recommends that [p]arents’ and caregivers’ monitoring of a child’s digital activity should be proportionate and in accordance with the child’s evolving capacities.

Regarding the second duty, General Comment No. 25 emphasises several key aspects that States need to consider when developing guidance and support on privacy-related matters to parents and other caregivers. States have to recognise the importance of the evolving capacities of the child in decision-making regarding their online privacy, acknowledge the important role of parents in balancing their children’s need for guidance and protection on this subject with their need for autonomy and participation online (in accordance with their evolving capacities), and provide guidance to parents on this balancing exercise. While General Comment No. 25 provides valuable guidance, the role of parents can vary significantly based on local and cultural factors (cf. the concept of Ubuntu, which recognises the communal responsibility within society for raising children) within the African context. Consequently, an African-centric approach to children’s right to privacy that is anchored in the cultural and social realities of the continent is needed. This requires tailored guidance for (African) States to shape their legal frameworks and guidance and support for parents.¹⁴¹

In the future, the African Committee of Experts on the Rights and Welfare of the Child could play a significant role in assisting States in fulfilling these two duties, by developing guidance and raising awareness throughout the African continent on how to tailor laws and guidance for parents in a manner that respects cultural diversity while ensuring the protection of children’s rights in the digital age. The African Children’s Committee has already clarified the obligations of States Parties in its General Comment No.5, stating that the ‘duty to recognise rights’ implies a level of formal recognition of the rights (including the right to privacy in Article 10), by law or in Constitutions.¹⁴² To further tackle the challenges presented by the digital revolution, the African Children’s Committee could proactively provide some guidance on the right to privacy in a digital context, by adopting a General Comment or Concluding Observations on States parties’ reports.¹⁴³ The fact that the Committee chose “The rights of the child in the digital environment” as the theme of the Day of the African Child in 2023 could be seen as an indication that there is a momentum to do so in the near future.¹⁴⁴ In its concept note, the Committee acknowledges that [w]hilst a number of African countries have enacted Data Protection Laws, only a few have comprehensive provisions on the protection of children’s data hence there is no standardised way of protecting children’s personal data’. The Committee calls on Member States to [e]nact Cyber Security and Data Protection legislation, which also offer guidance on the protection of children’s privacy and personal data’. This call seems to reflect the call in the General Comment No. 25.

6. CONCLUSION

Although children on the African continent do not enjoy the same levels of access to the digital technologies and the Internet as children elsewhere due to the prevailing digital divide, their right to privacy is equally at stake in the digital environment. The CRC has emphasised in its General Comment No. 25 that privacy is vital to children’s agency, dignity and safety, and, hence, urges States Parties to establish strong legislative and regulatory frameworks that aim to protect children’s personal data.

Whereas many African states have adopted national data protection laws, specific protection for children is rarely explicitly included and predominantly restricted to requirements in relation to parental consent. Whereas this is not uncommon—also in other continents and in other spheres of children’s lives parental consent is pivotal—the General Comment No. 25 encourages States to go further and adopt more wide-ranging measures to ensure children’s right to privacy in the online sphere. Both monitoring by the CRC and culture-specific guidance and monitoring by the African Children’s Committee could, in this regard, be essential to ensure that children’s rights in Africa are effectively realised in the digital environment.

ACKNOWLEDGEMENTS

This article was developed and written when Yohannes was a visiting doctoral researcher at Ghent University in 2022 through the Global Minds Fellowship programme. Valerie Verdoodt’s contribution for this article was funded and created in the context of the BOF Postdoctoral Research Project ‘Children’s rights and the monetisation of play in the digital environment’, funded by the Special Research Fund of Ghent University [grant no. BOF.PDO.2021.0034.01]. The authors acknowledge the funding received from Ghent University. The authors also acknowledge Monash University for making this publication an open access through the Australia and New Zealand Institutions (CAUL affiliated) Open Access Agreement [82783405].

Footnotes

Author notes