# _4.3.4 Safeguards: Personal data_

The first dimension under safeguards covers personal data—regulatory practices that seek to protect personally identifiable data. Given the sensitivity of personal data, which may include an individual’s health or financial information, the level of regulatory protection could have an impact on individuals’ trust in data products or services, thus affecting their willingness to participate in data economy activities.

The personal data dimension measures 12 different features of the data protection law of a given jurisdiction.<sup>4</sup> It first examines whether an overarching data protection law has been enacted, then it surveys the implementation of data subject rights such as redress; objection to the use of personal data and limitation of sharing with third parties; data minimization, purpose limitation, and storage limitation requirements. Furthermore, this dimension looks at whether limitations exist on the possibility that decisions about individuals are taken only on the basis of automated processes, which might lead to social discrimination (Article 29, Working Party 2018). Finally, this dimension provides information on whether data subject rights are effectively protected on the technical side through the implementation of measures based on the privacy-by-design and privacy-by-default principles in the surveyed jurisdictions (UK Information Commissioner’s Office 2020b), as well as by the monitoring activity of a data protection authority.

Overall, 58 percent of the countries surveyed enacted an overarching data protection law, such as Nigeria’s Data Protection Regulation 2019 or Ukraine’s Law on the Protection of Personal Data of 2010. Data protection laws are found in 40 percent of low-income countries, 53 percent of lower-middle-income countries, 62 percent of upper-middle-income countries, and close to 80 percent of high-income countries (figure 4). All these laws include exceptions to the limitations on data collection and processing by governments, but a necessity and proportionality test for such exceptions appears in 18 percent of the countries measured. Such limitation can be found in Côte d’Ivoire’s data protection law, whereby the processing of personal data carried out on behalf of the state, or a public or private legal entity managing a public service authorized by decree, is subject to the reasoned opinion of the Data Protection Body.<sup>5</sup> Interestingly, the performance of income groups on a few specific provisions of personal data protection legislation is quite consistent. Provisions on purpose limitation, individual’s right to challenge accuracy of personal data, and seek redress are found in 79% of high income countries, 62% of upper middle-income countries, 53% of lower middle-income countries and 40% of low-income countries. This indicates that when countries adopt personal data protection legislation, the above mentioned regulatory good practices are usually embedded in the regulatory framework, implying a convergence on regulatory practices in personal data protection across countries. However, there emerges a potential gap between the enactment of regulatory frameworks and their implementation. Though personal data protection legislation is relatively prevalent at 58 percent, supervisory authorities for data protection are found in 47 percent of the countries surveyed and only 33 percent in low-income countries.

> 4 While scores are averaged on the basis of the full set of countries surveyed, the DBI methodology assigns a score for the specific safeguards adopted only if a country adopted an overarching data protection law.

> 5 See _Loi 2013-450 relative à la protection des données à caractère personnel_ , art. 13. Accessible at: <u>https://www.artci.ci/images/stories/pdf/lois/loi_2013_450.pdf.</u>

14