Data Privacy and Responsible AI Adoption in Cameroon

Artificial Intelligence (AI) is now part of the daily lives of most humans. The explosion of its generative applications has liberalized its use, even if this technology is not new and was already integrated in several fields, from health to industries. However, several countries are still lagging behind, not yet having the prerequisites to ensure the integration and dissemination of emerging technologies in the socio-cultural and economic fabric.

Cameroon is one of them.

Cameroon is a country that aspires to economic emergence by 2035. Among the promising sectors, emerging technologies occupy a prominent place in this ambitious program. Indeed, the country is among the most advanced in the field of scientific and technical research in Central Africa, and an important economic hub on the continent. However, academic excellence struggles to translate into concrete initiatives that enable the country to bridge the digital divide that separates it from its peers and the rest of the world. The lack of digital infrastructure does not allow for preliminary tasks such as rigorous data collection, storage and processing for training and deployment of large language models. The rate of domestic and foreign investment in technology is extremely low. More importantly, unlike several African countries, Cameroon does not have comprehensive policies, laws and strategies for user data protection and responsible adoption of AI.

Privacy rights are embedded into the Preamble of the Cameroonian Constitution. On December 23, 2024, the President of the Republic of Cameroon promulgated the first comprehensive Personal Data Protection Law No. 2024/017. Its scope is limited compared to frameworks enacted by other countries in Africa and around the world. The three principles mostly covered by the new legislation, as well as other data protection frameworks in Cameroon, are informed consent, rectification and retention. 

Section 21 states that the processing of personal data on digital communication networks or any other medium by a data controller or a processor requires the consent of the data subject. Individuals have the right to be informed about how their data is used. There is no reference to automated decision-making involving personal data. The law focuses mainly on data processing, defined as "operations or sets of operations performed on personal data, whether or not by automated or semi-automated means". It does not address the principle of data minimization, or decisions emanating from collected data. Although Law 2024/017 does not specifically cover AI or machine learning algorithms, its provisions align with certain AI governance principles of transparency and accountability implemented in several countries, and lay the foundations for a future AI law. Regarding data accuracy and protection, Article 21 requires the controller to ensure that personal data is accurate, up-to-date and processed with respect for the dignity and rights of individuals. The document also contains a chapter on cross-border data transfers.

Article 32 restricts the transfer of personal data outside Cameroon, unless the destination country ensures an adequate level of protection. The aim is to ensure the control of sensitive data flows, which is particularly relevant where current or future AI systems involve cross-border data exchanges. This reflects international standards such as the EU's General Data Protection Regulation (GDPR). Data transfers outside Cameroon are only permitted if the destination country ensures an “adequate level of protection”. The National Agency for Information and Communication Technologies (ANTIC) must approve international data transfers, and organizations must implement appropriate safeguards (such as contractual clauses) for international transfers. Special authorization is required for transfers to countries without an adequate level of protection. The provisions are aligned and consistent with those contained in the African Union Convention on Cybersecurity and Personal Data Protection (Malabo Convention) and the CEMAC (Economic and Monetary Community of Central Africa) regulation on electronic transactions. However, the implementation and enforcement mechanisms are extremely limited and should evolve to explicitly include AI. The recent Continental AI Strategy adopted by the African Union Commission, which sets out the vision and ambitions for AI governance in Africa, further urges Cameroon to catch up in this area.

The lack of awareness among citizens about personal privacy rights exposes them to abuses and the means at their disposal to counteract these violations are insufficient. The amount of digital data collected, the use and possible transfer to third parties (within and outside the country) by service providers and operators are unclear. Most existing laws are weakly enforced and suffer from gaps in implementation. For instance, whether in the physical or virtual world, there is no constraint to mention the presence of surveillance cameras, whether for the observation of customers or employees. It is not uncommon for people to find themselves confronted with photographic, audio or video material collected without their knowledge or under conditions not provided for in a prior contractual agreement. Deepfakes are becoming a weapon for destroying reputations. Faced with all these grievances, the Cameroonian justice system seems powerless because public policies and laws do not apply to current technologies which bring new issues and tend to be more complex and intrusive in terms of privacy than previous technological tools.

In 2021, the Cameroonian Ministry of Posts and Telecommunications launched the World Bank-funded Digital Transformation Acceleration Project (PATNuC). Its objective is to create a new strategy and support the improvement of the policy and regulatory environment. The end goal is to foster the emergence of a dynamic, secure and inclusive digital economy in Cameroon. As part of this project, a new set of laws on commercial communications, cybersecurity and cybercrime has been under consideration since 2023. They introduce new terminologies such as personal, biometric, genetic or sensitive data; the controller, the processor, the personal data breach and the standard contractual clauses, among others. 

The Global Center on AI Governance recently released its Global Index on Responsible AI 2024(GIRAI). It is a groundbreaking tool that establishes global benchmarks for responsible AI and evaluates them in 138 countries and jurisdictions, including 41 countries in Africa, one of the largest dataset in the domain to date. GIRAI refers to responsible AI as “the design, development, deployment and governance of AI in a manner that respects and protects all human rights and upholds AI ethics principles at every stage of the AI ​​lifecycle and value chain”. It includes all national actors (public and private sectors, civil society and academia) who bear responsibility for the potential human, social and environmental impacts of AI. The 19 thematic areas of Responsible AI covered by the index are grouped into 3 main dimensions: Human Rights and AI, Responsible AI Governance, and Responsible AI Capabilities.

The GIRAI ranks Cameroon at the 97th position with an index score of 4.04 over 100. The absence of any AI governance framework on AI gives the country a score of 0, even if government actions obtain a score of 5.46/100. Even at the level of the dimensions, it obtains low scores, which align with the previous observations. The highest score (9.27) comes from civil society and universities. This is indicative of the dynamic research and innovation in Cameroon that the country would benefit from capturing and amplifying. Indeed, the academic world is full of initiatives and projects aimed at democratizing new technologies and making them more accessible in the socio-economic landscape.

Source: GIRAI 2024 Scored of countries in Africa

AI has the potential to become a real lever for growth on the African continent which remains almost absent in this area. Last June in Yaoundé, the first national consultations organized by the Ministry of Post and Telecommunications took place under the theme "What government policies for better appropriation of AI in Cameroon". They reiterated the urgency of policies and strategies for the large-scale development, adoption and dissemination of AI. In order to achieve positive regulatory and legislative outcomes in Cameroon, it is crucial to understand where and how technology is moving. The new policies should align with the latest challenges posed by emerging technologies, as well as the benefits and opportunities they bring. Proactive measures and swift actions that put human rights and responsibility at the center, but also protect public institutions and private companies are needed. Therefore, the involvement of competent experts is necessary to ensure that Cameroon’s laws and frameworks comply with regional and international standards, and with the exponential evolution of emerging technologies. 

Author: Marcelle Momha, Candidate | Masters in Public Administration, Fellow Kistefos African Public Service, Harvard J.F. Kennedy School of Government. Follow Marcella on LinkedIn

This article is funded by the International Development Research Centre (IDRC) and UK International Development under the AI4D program, as part of the African Observatory on Responsible AI.