Botswana's Data Protection Act, Act No. 32 of 2018 carves out an exemption for data processing activities carried out by or on behalf of the State for specific law enforcement and national security purposes.

Text of Relevant Provisions

The Data Protection Act Art.3(2)(b)(ii):

*"(2) This Act shall not apply to the processing of personal data—

(b) by or on behalf of the State where the processing—

(ii) is for the prevention, investigation or proof of offences, the prosecution of offenders or the execution of sentences or security measures,"*

Analysis of Provisions

Article 3(2)(b)(ii) exempts data processing activities conducted by or on behalf of the State when such processing is related to:

• Prevention, investigation, or proof of offenses: This encompasses a broad range of activities undertaken to prevent criminal offenses, investigate suspected offenses, and gather evidence for proving offenses.
• Prosecution of offenders: This includes activities related to bringing criminal charges against individuals suspected of committing offenses and pursuing legal proceedings against them.
• Execution of sentences or security measures: This covers the implementation of court-ordered punishments or security measures imposed on individuals convicted of offenses.

The rationale for this exemption is to provide the State with the necessary flexibility and tools to carry out its law enforcement and criminal justice functions effectively. These activities often require the processing of personal data, and subjecting such processing to the full scope of data protection principles might hinder investigations, prosecutions, or the execution of justice.

However, it is important to highlight that this exemption is not absolute. Article 3(3) of the Act mandates that adequate security safeguards for protecting personal data must be established in specific legislation governing those exempt activities. This provision aims to strike a balance between the State's need to process personal data for law enforcement purposes and the protection of individuals' privacy rights.

Implications

The exemption for law enforcement and national security activities has several implications:

• Scope of exemption: The exemption is limited to data processing activities directly related to the specific purposes outlined in Article 3(2)(b)(ii). Any processing beyond these purposes would still be subject to the Act's provisions.
• Government contractors: Private companies processing personal data on behalf of the State for law enforcement purposes may fall under this exemption, provided their activities are directly related to the specified purposes.
• Oversight and accountability: The requirement for specific legislation with adequate security safeguards is crucial for ensuring oversight and accountability in the State's processing of personal data for law enforcement purposes.
• Data subject rights: Individuals whose data is processed under this exemption may have limited recourse to exercise their data subject rights under the Act, highlighting the importance of robust safeguards within the specific legislation governing those activities.