Data Protection
Senior 2 · ICT
Data Protection
Lesson 1 of 5
18 min
Let's begin
Your school keeps a file on you: your full name, date of birth, class, your parents' telephone numbers, your marks and perhaps a note from the school nurse. Your family's mobile money account records every payment. In the wrong hands, any of this could be used to cheat, embarrass or harm you.
Data protection means keeping information about people safe from loss, misuse and people who have no right to see it. Rwanda has a law on it, Law N° 058/2021, which came into force on 15 October 2021. This lesson explains what the law protects and what rights it gives you, in plain words.
Data are raw facts, such as names, numbers, dates or photos, that a computer can store and process. The law defines personal data (Article 3) as any information about a living person who can be identified from it. The identification can be direct, through a name or an identification number, or indirect, through things like location data, an online identifier such as a username, or facts about the person's body, health, money, culture or social life.
| Information | Personal data? | Reason |
|---|---|---|
| "Keza Uwase, S2B, born 3 March 2013" | Yes | The name identifies her directly. |
| Mobile number 0788 123 456 | Yes | The number leads to one owner, so it identifies her indirectly. |
| A photo of a student on the school website | Yes | A face identifies a person. |
| "The average Mathematics mark in S2B was 64" | No | It describes a whole class. No single person can be picked out. |
| "It is 26 °C in Kigali today" | No | It is about the weather, not a person. |
Some personal data can cause serious harm if it leaks. The law calls it sensitive personal data. It includes a person's health status and medical records, criminal records, religious or philosophical beliefs, political opinions, genetic or biometric information (such as fingerprints or a face scan), race, social origin, sexual life and family details. Organisations must protect it with extra measures, for example by encryption (Article 11). Encryption turns data into a code that only authorised people can read.
A controller must reply to such a request within 30 days.
If a person is under 16 years old, an organisation must get consent from a parent or guardian before using their personal data (Article 9). Every controller must collect data only for a clear purpose, keep it accurate, keep it no longer than needed (Article 37) and keep it secure (Article 47). If data is lost or stolen (a data breach), the controller must report it to the supervisory authority within 48 hours (Article 43). Collecting, using or sharing someone's personal data in a way the law forbids is a crime (Article 56).
Tip
The one-person test. Ask: "Could this point to one real person?" If yes, it is personal data.
Remember three numbers from the law: 16 (under this age a parent consents), 30 (days to answer your request), 48 (hours to report a breach).
Try each question first, then read the worked solution.
Is the list of S2A students' fingerprints used by the school gate scanner personal data? Is it sensitive?
Solution: Yes to both. A fingerprint identifies exactly one person, so it is personal data. It is biometric information, which the law lists as sensitive, so it needs extra protection such as encryption.
A cooperative publishes "Total coffee delivered in March: 12 tonnes". Is this personal data?
Solution: No. It is a total for the whole cooperative, and no single farmer can be identified from it.
A new learning app asks Mugisha, aged 13, for his name and school. What must the app do first?
Solution: Mugisha is under 16, so under Article 9 the app must get consent from his parent or guardian.
A hacker steals the marks database of a school on Monday at 09:00. By when must the school report it?
Solution: Within 48 hours of becoming aware of it: by Wednesday at 09:00 if the school found out at once.
Remember
Sources and credits
