On April 30th, 2024, the Internet Society Lesotho Chapter (ISOC LS) organised a vital dialogue with government stakeholders titled "Building a Digital Lesotho: Where Privacy Meets Innovation." The aim was to shed light on the gaps between existing legislation and the reality of data privacy safeguards in Lesotho.
Despite legal protections enshrined in the Constitution, the Data Protection Act, and other sectoral laws, the session revealed a need for more alignment between current practices and best practices in data protection.
Participants discussed a common practice in Lesotho: the visitors' register. In this country, it is common for visitors to government agencies and certain businesses to be required to fill in their details — such as name, surname, mobile number, and home address — in a visitors' register. There are several potential risks associated with writing personal information in these physical registers:
Loss or Theft: Physical registers are vulnerable to theft or loss, potentially exposing your personal information to anyone who gains access to them — employees, visitors, or even passersby.
Data Breaches: If the register is not stored securely, it could be accessed by unauthorised individuals, either intentionally or unintentionally.
Data Sharing: Data subjects need clarity on how the information collected in the register is used and whether it is shared with other entities.
Identity Theft: If your personal information falls into the wrong hands, it could be used for identity theft, leading to financial loss, credit damage, and emotional distress.
Targeted Advertising or Spam: Your information could be used for targeted advertising or sending unwanted spam messages.
Social Engineering Attacks: Malicious actors could use the information gathered from the register to launch social engineering attacks, tricking you into revealing further personal or financial details.
Lack of Data Protection Enforcement: Lesotho lacks a Data Protection Commission, which weakens legal recourse in case of data breaches or misuse.
Limited Consumer Protection: The absence of a comprehensive consumer protection law in Lesotho offers less legal protection for online and offline data-handling practices.
While the risks associated with physical visitor registers may seem less immediate compared to online data collection, it is important to be aware of the potential consequences and advocate for better data security and privacy practices in Lesotho.
Stakeholders were in agreement that the way forward included the following:
Lesotho's digital future hinges on bridging the gap between existing legal frameworks and practical implementation. Prioritising the establishment of the Data Protection Commission, coupled with public awareness initiatives and legislative reforms, will be crucial steps towards building a digital Lesotho where privacy and innovation thrive hand-in-hand.
Let's seize this occasion to build a digital Lesotho that is not only innovative but also respectful of its citizens' privacy. We call on all stakeholders — government, businesses, civil society, and citizens alike — to work together so that the protection of privacy is designed into the very core of our digital systems and processes.