Following the Commercial Bank of Ethiopia’s (CBE) alarming decision to publish people’s private data, Access Now and the
Centre for Advancement of Rights and Democracy (CARD) are calling on the bank to cease its public shaming campaign immediately and respect privacy and data protection laws.
The state-owned bank’s decision to publish hundreds of names, account numbers, and photographs of people the bank alleges to have withdrawn unauthorized funds due to a systems glitch, grossly violates people’s data and privacy rights.
“People in Ethiopia have the right to privacy, and that right is not automatically ceded on mere allegations of unlawful
behavior,” said Naro Omo-Osagie, Africa Policy and Advocacy Manager at Access Now. “The Commercial Bank of Ethiopia has an obligation to protect people’s data and its decision to name and shame by
publishing personally identifiable information without consent is a violation of their fundamental right to privacy
guaranteed under Article 26 of the Constitution of Ethiopia.”
Earlier this year, Ethiopia’s Personal Data Protection Law was approved by Parliament. While enforcement of the Law is still in its infancy, the law has clear provisions on the legal basis for the processing of personal data which the CBE has failed to comply with. This is not the first
time a state-owned entity has undermined privacy in Ethiopia. In the past, reports of Ethio-Telecoms granting security authorities unlawful access to people’s information have highlighted the
government’s systemic attacks on the right to privacy.
“The Commercial Bank of Ethiopia must respect its obligations as a data controller and only collect, process, and share
data within the law,” said Bridget Andere, Senior Policy Analyst at Access Now. “Publishing people’s personal information violates the principles of necessity and proportionality. The bank must
delete the published information and pursue legal channels to recover the money they claim was illegally obtained.”
CBE has not responded to Access Now and CARD’s letter asking the bank to take down the lists and photographs and initiate a transparent review of its data policies and
procedures. CBE must immediately change its course of action and uphold people’s rights.