INTERNATIONAL COMMUNITY IN THE GLOBAL DIGITAL ECONOMY: A CASE STUDY ON THE AFRICAN DIGITAL TRADE FRAMEWORK

Abstract

Global digital integration is desirable and perhaps even inevitable for most States. However, there is currently no systematic framework or narrative to drive such integration in trade agreements. This article evaluates whether community values can offer a normative foundation for rules governing digital trade. It uses the African Continental Free Trade Area (AfCFTA) Digital Trade Protocol as a case study and argues that identifying and solidifying the collective needs of the African region through this instrument will be key to shaping an inclusive and holistic regional framework. These arguments are substantiated by analysis of the regulation of cross-border data flows, privacy and cybersecurity.

I. INTRODUCTION

The unprecedented growth of the global digital economy has triggered various policy shifts and divisions, creating a politically and legally messy space. Some scholars argue that digital trade¹ rulemaking is predominantly driven by three powers: the European Union (EU); the United States (US); and China.² However, in practice, policymaking on digital trade is far more variegated, driven by different national policy objectives, motivations and actors. For instance, while several States are reluctant to commit to liberalising data flows due to concerns about losing their policy space to make sovereign choices in domestic digital regulation,³ others have adopted a relatively open approach to data flows.⁴ These priorities also shift in time. For instance, China (which adopted a highly restrictive approach in the past) recently started easing its data flow restrictions. In contrast, the US (which adopted a liberal approach for a long time) seems to be moving in a more restrictive direction to protect sovereign interests.⁵

Sovereignty can mean different things in the digital context,⁶ but the general thrust has been towards implementing inward-looking measures that disrupt global flows of digital goods and services.⁷ Further, several developing countries have embarked upon programmes to promote their domestic digital sector and shield domestic companies from unfair competition.⁸ Overall, regulatory fragmentation has increased significantly in recent years, thereby disrupting cross-border digital trade flows and impacting businesses and internet users alike.⁹

Addressing digital trade fragmentation necessitates thoughtful interventions at different levels: international/regional; transnational; and domestic. International trade agreements have emerged as a popular forum to develop common frameworks for digital and data flows. For instance, several States have signed treaties containing rules on electronic commerce or digital trade in the last decade. These rules are spread over a network of Preferential Trade Agreements (PTAs) and Digital Economy Agreements (DEAs), creating what Burri and Chander call an emerging discipline of ‘digital trade law’.¹⁰

Over the past decade, digital trade rules have become more comprehensive and complex, and even cover emerging areas of regulation such as artificial intelligence (AI) and open data innovation. The legal architecture of these rules is also evolving, especially with recent PTAs and DEAs coupling traditional trade rules with several soft-law frameworks and creating mechanisms to involve non-State stakeholders.¹¹ Yet, despite the rapid adoption of digital trade rules, clear divergences exist across treaties. More importantly, digital trade law lacks a coherent framework or unifying narrative to reify commonly shared values and interests among States.

This article offers a narrative for digital trade law that seeks to facilitate connections and trust-building between States facing common challenges in regulating cross-border digital flows. It explores whether viewing digital trade law through a community lens can facilitate digital trust and regulatory cohesion in an incremental, inclusive and pragmatic manner. It also explores the constraints and inherent limits of such a community lens. It argues that international community and solidarity, as broadly conceptualised in international law, can meaningfully inform rulemaking in digital trade law, including in addressing complex issues such as cross-border data flows. This is because States share common interests in integrating into globally interconnected digital markets and addressing transnational policy challenges in data and digital regulation. However, the identification and articulation of these common interests and norms are not always straightforward; thus, practical constraints exist in forming coherent digital trade communities.

This article uses the African Continental Free Trade Area (AfCFTA), and in particular the Protocol to the Agreement Establishing the AfCFTA on Digital Trade (AfCFTA DTP)¹² and related digital economy frameworks, as a case study to demonstrate the above arguments. It examines how and why common interests, needs and priorities can be a concrete basis to form an integrated and coherent digital trade community in Africa, using the examples of the regulation of cross-border data flows, data protection and cybersecurity. It further discusses how and why African policymakers should address practical policy challenges in balancing and aligning community-level and national interests. While this article focuses on Africa as a case study, the core arguments and conclusions can apply in other contexts, whether in other regional fora or the World Trade Organization (WTO).

The article is organised into four sections. Section II first briefly explains how international community and solidarity have been conventionally conceptualised in public international law. It then discusses their role and potential relevance to international trade law. Subsequently, it focuses on digital trade and investigates whether there are emerging communities in digital trade law and the extent to which they can successfully mobilise States at different levels of digital development.

Section III briefly introduces the African philosophy of Ubuntu, representing African community and solidarity values. This philosophy is used to provide a socio-political context for Section IV, where African digital trade regulation is examined in the context of the AfCFTA. Section IV explores three areas in this regard: cross-border data flows; privacy; and cybersecurity. It argues that while shared interests and values exist that can drive strong regional digital integration in Africa, there are also political and pragmatic problems in mobilising the digital trade community under the AfCFTA DTP, especially due to perceived risks to sovereignty. This section proposes pragmatic ways to navigate these tensions in the African regional ecosystem.

The article concludes by reiterating that although the meaning of community is not precise in international law, it can be important for providing a framework for negotiations on digital trade law. In particular, the flexibility and the dynamism that it provides will be a useful anchor to mobilise dialogues among States on several aspects of digital trade and should thus inform future rule-making for the digital economy.

II. TRACING INTERNATIONAL COMMUNITY AND SOLIDARITY

This section briefly traces the various ways in which international community and solidarity are conceptualised in public international law, highlighting both their strengths and limitations. Next, the section highlights the extent to which underlying values or shared interests defining a community can be traced in international trade law. Finally, it turns to digital trade law and examines the extent to which different initiatives in various PTAs and DEAs focused on digital trade result in a distinct community or reflect an emerging digital solidarity. The latter discussion highlights the constant and complex interplay of the emerging regional/plurilateral consensus, and the domestic preferences related to digital sovereignty.

A. International Community and International Solidarity in Public International Law

The relevance of both international community and solidarity has been debated at length in public international law, both from a legal and normative perspective.¹³ While international law often makes references to international community in varied contexts, the concept does not have a precise meaning.¹⁴ Although occasional reference is made to the ‘international community of States’,¹⁵ a more common formulation is the ‘international community as a whole’,¹⁶ referring to the collectivity of States.¹⁷ In an ideal scenario, international community must be viewed as transcendental, ie it exists to fulfil interests and goals beyond the interests of specific States.¹⁸

In the present-day complex international legal system, a variety of political actors play critical roles. Thus, in addition to States, international and regional organisations, policy networks, transnational communities, sub-State entities, and even individuals have a role to play in the formation of any international community.¹⁹ For instance, the membership of an international community is not only limited to global bodies such as the United Nations (UN),²⁰ but also regional and international bodies such as the Association of Southeast Asian Nations (ASEAN), the African Union (AU) and the Organisation for Economic Co-operation and Development (OECD).²¹ This means that the international community as a whole consists of multiple layers, with some of these bodies being regional, some transnational and others international. This diversity of membership is particularly prevalent in today's world, where traditional international legal instruments/institutions are facing immense pressure. Further, international community values may not only be found in hard law springing from traditional multilateral groupings but could also spring from norms, principles and soft law common to multistakeholder, transnational and regional bodies.²²

International community (including at the global level) evolves and changes with time, especially with dynamic shifts in power relations. For instance, new groups and coalitions may be formed to represent certain community interests, eg, a plurilateral grouping of States or a transnational body rallying around a common policy concern. In its most radical formulation, some scholars have argued that international community ultimately consists of individuals, although this assertion does not enjoy strong support from most scholars.²³

Broadly, three views exist regarding the existence of an international community. The first group of scholars argues that international community finds clear expression in the most fundamental treaties underlying the international legal order such as the UN Charter²⁴ and the International Law Commission (ILC) articles on State Responsibility, and even in judgments of the International Court of Justice.²⁵ In understanding its legal implications, scholars often refer to the existence of jus cogens norms or peremptory norms of international law, and erga omnes obligations, which are obligations owed to the international community as a whole.²⁶

From the above, the logical deduction that international community is interlinked with international law could be made.²⁷ For instance, Simma argues that the international legal order has moved on from bilateral relations and purely State consent-driven co-existence to a world of significant international cooperation.²⁸ He further posits that this shift signifies the existence of an international community based on shared common interests (in contrast to reciprocal obligations) and the constitution of a ‘socially conscious legal order’.²⁹ Other scholars similarly argue that the international legal system is built on common values³⁰ and the international community is the basis of a ‘rule-based constitutive perspective of world politics’.³¹ Rudall argues that international law has a ‘minimum ethical core’ consisting of ‘universalist ideals’ and ‘community values’.³² These views signify a two-way relationship of international law and community, wherein international law regulates the international community and the international community constitutes and contributes to the international legal order. However, this school of thought does not clarify who the constituents of the international community are and how they shift over time.

The second group of scholars argues that international community is a flexible normative concept, which can be given contextual meaning and interpreted in different ways. For instance, Hakimi argues that even though jus cogens norms and erga omnes obligations can be considered community values defining the international legal order, their substantive content is subject to interpretation.³³ Thus, different interests or potential discord between States does not mean that an international community is absent, but rather dissent/differences are also constitutive of the community.³⁴ In turn, this means that international community is imperfect but flexible and can be fashioned to create dialogues among States and other stakeholders.

The third view, aligned with realistic thinking, is that international community is a mythical concept. In a world of unequal power relations, an international community does not actually exist. Abi-Saab argues that the presence of an international community has been undermined in the post-Cold War era.³⁵ Dupuy contends that the international community is a myth in the sense that States act as if an international community exists, but, in reality, it is simply legal fiction.³⁶ Consequently, States use the idea of international community as and when it is convenient to satisfy their individual interests.³⁷ Further, international community can often become a tool to exclude certain States such as non-liberal States.³⁸ While this view rightly recognises that power relations impact how any international community is constituted, it ignores that communities in the international legal order are nuanced, multilayered, flexible and dispersed in different locations, as argued above.

This section now turns to an examination of international solidarity, which can spring from the presence of an international community. The principle of solidarity has long been used in international law as setting a foundation for international cooperation,³⁹ but its legal relevance and even its existence are debated.⁴⁰ Nonetheless, it has found expression in drafts of the UN Declaration on Human Rights and International Solidarity, where it has been defined as an ‘expression of unity by which peoples and individuals enjoy the benefits of a peaceful, just and equitable international order, secure their human rights and ensure sustainable development’.⁴¹ This draft declaration characterises it as a human right, that binds States, international organisations and private bodies.⁴² However, this instrument is vague as it refers to lofty objectives such as ‘justice, peace, sustainable development and equitable and fair partnerships between States’ and ‘protection and fulfilment of human rights and fundamental freedoms for all individuals’.⁴³ It also imposes heavy obligations on States to engage with other States and non-State actors to implement solidarity, without setting out clear and binding mechanisms.⁴⁴

While international solidarity may have an ambiguous meaning, it has a certain normative value and appeal. For instance, as a moral objective, it provides a direction for international law.⁴⁵ Scholars have tested the relevance of the idea of solidarity in different contexts to facilitate international cooperation in areas such as environmental law, climate change law and human rights.⁴⁶ Other scholars have taken a more extreme (and perhaps less actionable) view, where they consider international solidarity as altruistic behaviour to achieve the common good.⁴⁷ Cosmopolitan thinking also emphasises that solidarity exists beyond mere State interests as human beings hold compassion towards others across borders.⁴⁸ In practice, self-interested solidarity, for example, where States cooperate when they face common problems, is arguably more pragmatic than altruistic solidarity.⁴⁹ However, altruistic behaviour in the international community is not entirely likely in a humanitarian or environmental disaster.

B. The Existence of Community Values and Solidarity in International Trade Law

International trade law governs trade relationships between States. Predictably, the mainstream view is that it is a discipline based on mercantilist interests focused on bilateralism and reciprocity,⁵⁰ without any clear community values. This article will now examine an alternative view that international trade law can be understood from the perspective of community values, ie, it is driven by shared interests among States transcending bilateral, reciprocal interests.

At the outset, it is acknowledged that arguments can be made opposing this inquiry. First, the power differentials in the global trading system make it hard to view bodies such as the WTO as institutions of an international community with common, shared values.⁵¹ Second, the formation of an international trade organisation such as the WTO is seen as ceding sovereignty (or at least certain aspects of it), challenging basic notions in international law.⁵²

To understand the values underlying international trade law better, the foundational elements in trade treaties must be examined, particularly to discern whether the idea of international community finds any direct or indirect expression in them.⁵³ This examination reveals that several trade treaties set out policy objectives that represent community values transcending individual State interests. In fact, the Havana Charter (the first international trade treaty, that sought to establish the stillborn predecessor of the WTO, the international trade organisation) identifies as one of its objectives the facilitation ‘through the promotion of mutual understanding, consultation and co-operation the solution of problems relating to international trade …’.⁵⁴ The foundation of the WTO was to create a framework for economic interconnectivity and cooperation between States that trade with each other.⁵⁵ These goals cannot be achieved by any State acting alone—they are only possible if there is a community at the international level.⁵⁶ Therefore, the participation and acceptance of the obligations that come with the membership of the WTO community can be seen as a self-interested choice made by States to achieve commonly shared interests, instead of a forced act of giving up domestic policy space and sovereignty on certain aspects of domestic affairs.

The architecture of the WTO itself must also be examined in more detail. It consists of 166 members,⁵⁷ but does that mean it constitutes an international community? Unlike the UN Charter or the ILC Articles on State Responsibility, WTO treaties do not make any clear reference to ‘international community’. Yet, the WTO often refers to community interests and international community. For instance, in the 12th Ministerial Conference held in June 2022, the WTO Director-General (DG) stated in her speech: ‘this is a time to demonstrate that … the WTO can deliver for the international community, and the people we serve’.⁵⁸ Who is the DG referring to as the international community? Who determines the interests of this community?

First, the preamble of the WTO Agreement should be examined. It states that the key objectives of the WTO include raising standards of living, ensuring full employment and increasing real income.⁵⁹ It further acknowledges the need to ensure that developing countries share in the growth in international trade, especially taking into account the different levels of economic development in the WTO membership.⁶⁰ Although it recognises that trade barrier reduction entails reciprocal bargaining, this is ultimately aligned with the goal of creating an integrated, viable and durable multilateral trading system.⁶¹ In other words, boosting economic welfare, promoting sustainable development and reducing poverty are underlying objectives of the WTO system.⁶² These objectives can be seen as global community values.

Certain scholars argue that community values, such as the objectives enshrined in the WTO Agreement, can help create a rules-based and fair global market.⁶³ For example, provisions on non-discriminatory treatment and exceptions that balance trade and other public interests could be seen as emphasising community values.⁶⁴ Some scholars such as Wolfrum have also argued that provisions on the most-favoured nation obligation, which prohibit WTO members from discriminating against other members if they are providing a specific trade advantage to any party (including a non-WTO member), reflect a commitment to the entire global economic community and not bilateral interests between two States.⁶⁵

The implementation of the above principles has been far from perfect. However, as argued below, these lapses in acknowledging community values do not mean that they do not exist in WTO treaties. Rather, it means that WTO members must be nudged to implement their commitments in the spirit of the community values embedded in the Agreement. For instance, while the WTO treaties provide different exceptions and carve outs to balance the policy space desirable for domestic regulation with the broader objectives of trade liberalisation, constant endeavour is necessary to optimise and implement these mechanisms. As an example, a well-reasoned approach is essential to examine scenarios where the domestic political or economic systems of WTO members have a trade-inhibiting impact.⁶⁶ Similarly, trade tribunals must be judicious in applying the balancing mechanisms under the exceptions, especially as sovereignty-related interests change over time.⁶⁷

In fact, taking this argument a step further, in order to implement the existing provisions and safeguards in WTO law that balance varied domestic and global interests, community values are critical. For instance, a shared sense of community values can be instructive in interpreting the goals of WTO law in a manner that supports global economic welfare. From the perspective of bilateralism, the goals of WTO law may be viewed as representing narrow economic interests underlying bilateral trade relationships between States. In contrast, using a community lens, the objectives set out in the WTO Agreement can be given a much deeper and more coherent meaning. This is evident in WTO practice such as the growing importance of incorporating values of sustainable and inclusive development into WTO law.⁶⁸ Moreover, in numerous reports, WTO panels and the Appellate Body have read important policy goals into the existing framework of WTO law.⁶⁹

Similarly, the exceptions allow States to balance their trade liberalisation obligations with important domestic policy objectives. This allows them to give preference to important public interests over pure economic interests and, at the same time, links domestic policy values to global economic relations.⁷⁰ For instance, in certain areas of domestic regulation, a wide reading of available policy space is more likely to be misused by powerful, dominant States than to serve the interests of developing countries.⁷¹ In fact, in several disputes, panels have adopted a carefully measured reading of the exceptions to ensure a fair and balanced approach. Taking into account the community objectives of WTO law would ensure that exceptions are read in a manner that protects and promotes global economic welfare.

Some scholars argue that special and differential treatment (SDT) constitutes an important expression of solidarity in international trade law,⁷² although the implementation of these provisions leaves much to be desired, as argued below. Existing SDT provisions provide some concessions and benefits to developing countries such as technical assistance and capacity building, preferential treatment and additional time to comply with certain obligations.⁷³ Certain WTO treaties such as the Trade Facilitation Agreement, with its tiered implementation structure, provide additional time and financial support for compliance to developing countries.⁷⁴ Further, several provisions in trade treaties require developed countries to take into account the special needs of developing countries and, particularly, least developed countries (LDCs).⁷⁵

However, SDT provisions are often considered meaningless and symbolic due to their largely non-binding, discretionary nature and weak implementation.⁷⁶ This can be seen as a failure of the WTO membership to offer fair and meaningful opportunities to developing countries. This has been a major cause for political turmoil in the global trading order, and particularly the WTO, in recent years,⁷⁷ stemming from the failure of the WTO membership to acknowledge the importance of community values in implementing SDT provisions.⁷⁸ Thus, in thinking about future trade rules, SDT provisions must be designed and implemented differently, in a manner that strengthens the global economic community envisaged under the WTO, including by better aligning the interests of developing and developed countries.

The voting architecture of the WTO builds on the idea of a core community, but reality shows much more complexity in how communities have been constituted, as membership has evolved. Under the consensus-based voting mechanism of the WTO Agreement,⁷⁹ each member has an equal vote irrespective of its economic stature, thus symbolising an inclusive, equal community. Yet, the consensus mechanism is not without its constraints. For instance, as the WTO membership has grown in number and diversity, agreement has become harder to reach, calling into question whether the WTO community still exists today. Due to the breakdown of several multilateral talks owing to disagreements between WTO members, several plurilateral negotiations have emerged in areas such as e-commerce, investment facilitation and domestic regulation on services. One way of viewing such divisions is that the international community is not static, and thus the formation of these plurilateral groupings is not necessarily a disruption of the community, but rather its reconfiguration through the formation of new alliances representing shared interests. These discords and differences, as Hakimi argues, are constitutive features of international communities.⁸⁰

The discussion so far suggests that an international community is embedded in international trade law (at least in some shape or form). However, it also indicates that community values often need to be strengthened and, if necessary, reconfigured to address power imbalances or changing political dynamics in trading relationships. This confirms the views of leading public international law scholars. For instance, Simma and Paulus argue that economic solidarity can be a value that connects States at different levels of development.⁸¹ Hakimi similarly argues that economic interdependence in the global order can form a basis for acting in common interests.⁸²

The failings of the global economic community are most visible in moments of crisis. For instance, during the COVID-19 pandemic, supply chain disruptions and the calls for reshoring and friend-shoring—returning manufacturing and other business operations to the home State from elsewhere or restricting the supply chain to ally States—led to a complete disruption of the global economic order and the failure of the community to act together. Consequently, there were urgent calls at the WTO and other trade bodies to respond to the crisis faced by the entire community.⁸³ A transparency mechanism was created to record and track COVID-related trade restrictions and support measures.⁸⁴ While these examples may be seen as a breakdown of the trade community, constructive responses from smaller groups of States also took shape to address these challenges. For instance, the suspension of the operations of the Appellate Body led to the constitution of the Multi-Party Interim Appeal Arbitration Arrangement (MPIA) in April 2020 by 47 WTO members.⁸⁵ Similarly, the WTO has been engaging in discussions around the Global Supply Chains Forum to create more integrated and robust supply chains.⁸⁶

A dynamic and pluralistic view of community can be helpful in making sense of the above responses. While the community endorsing several of the above initiatives is smaller than the WTO membership, these smaller communities also represent shared values/interests and thus help create liaisons rather than fragmenting global power structures. Such flexible evolution and adaptation of new communities in the WTO ecosystem is crucial at the present time, as trade goals are increasingly being seen as disconnected from domestic policy.⁸⁷ Such communities also connect the gaps between the domestic and regional/global policy communities (eg, at the WTO, regional trade bodies) to develop a holistic understanding of how to interpret the shared goal of global economic welfare underlying international trade law.

C. International Community and Solidarity in Digital Trade Law

Having discussed the role of international community and solidarity in international trade law, this section examines digital trade regulation. Several efforts are ongoing in different global and regional bodies to address digital trade-related concerns. In addition to trade treaties, several regional bodies have developed other policy instruments to facilitate consensus on shared values and principles for the digital economy.⁸⁸ Some recent initiatives also focus on multistakeholder models, high-level political declarations, and instruments developed by transnational policy networks.⁸⁹ This plurality of initiatives is expected given the multidimensionality of digital trade. This section will now examine whether such diverse initiatives can result in a distinct digital trade community or reflect an emerging digital solidarity.

1. Development of data regulatory frameworks for digital trade

One of the toughest issues in digital trade is the regulation of cross-border data flows, especially given the different perspectives of governments, businesses and other important stakeholders such as internet policy and technical communities. At its very core lies a conflict of two values: data sovereignty⁹⁰ (which may be seen as representing the self-interested behaviour of States); and an open and free internet⁹¹ (arguably, representing a type of community value premised on global connectivity and economic freedom).

Scholars argue that data sovereignty is a double-edged sword; while it can be used to protect public interests genuinely, it can often become a tool of oppression or protectionism.⁹² Most States do not operate at the extreme ends of this spectrum, having developed a framework for cross-border data flows combining data sovereignty concerns with practical concerns around global connectivity.⁹³ As yet, a preferred approach to this balancing act has not presented itself, as States have not come to a consensus on the common values necessary to develop a global framework for data regulation.

States have a shared interest in being connected to global networks to benefit from digital trade. These shared interests also explain the rapid development of digital trade law in recent years. For instance, the Trade Agreement Provisions on Electronic Commerce and Data (TAPED) dataset,⁹⁴ that tracks digital trade commitments in PTAs and DEAs, indicates that 78 PTAs contain commitments on the promotion of digital trade, of which 65 have soft commitments and only 13 contain binding commitments.⁹⁵ These agreements are spread across different jurisdictions. Similarly, with respect to provisions that require the cross-border flow of data for digital trade, 49 PTAs contained some level of commitment, with 30 PTAs taking on hard obligations, although all these provisions contain national security and public policy exceptions.⁹⁶ Similarly, 31 PTAs contain commitments on the prohibition of data localisation measures.⁹⁷ Several recent PTAs also recognise the importance of data protection by requiring States to adopt a domestic regulatory framework. According to TAPED, 145 PTAs have commitments on data protection, with 41 of these PTAs containing hard commitments. Finally, commitments on cybersecurity cooperation can be found in 67 PTAs.⁹⁸

While hard PTA commitments on the above aspects indicate shared interests among parties, the varied language used in these commitments reflects different degrees of consensus on and understanding of these interests. For instance, while States have agreed to adopt domestic data protection frameworks in several PTAs, the prescribed benchmarks for an adequate regulatory framework for personal data protection vary significantly. While the US-driven treaties adopt a lenient approach and even include voluntary frameworks as possible benchmarks, the EU-driven treaties usually contain comprehensive requirements for domestic data protection frameworks.⁹⁹ However, the US has committed to higher standards of data protection in certain treaties such as the United States–Mexico–Canada Agreement (USMCA), by referencing the OECD Privacy Guidelines.¹⁰⁰ Similarly, while certain China-driven treaties such as the Regional Comprehensive Economic Partnership (RCEP) have language on data flows and data localisation, these provisions are weak as they are subject to self-judging exceptions and not subject to dispute settlement.¹⁰¹ This approach can be contrasted with the far stronger provisions in treaties signed by other States such as Australia, Japan and Singapore. China has, however, expressed interest in joining treaties with stronger provisions on data flows such as the Digital Economy Partnership Agreement (DEPA)¹⁰² and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP).¹⁰³

The above discussions indicate that as economic and political interests evolve, the alignment of interests and incentives across communities changes. For instance, the US changed its stance on cross-border data flows and data localisation¹⁰⁴ almost immediately after China loosened several restrictions in its domestic laws on cross-border data flows.¹⁰⁵ While the repercussions of these changes are not yet clear, it might be pondered whether China, for instance, may be more willing to participate in more liberal/open digital trade frameworks. Similarly, while the EU objected to negotiating frameworks on cross-border data flows and data localisation for several years, it has shifted policy priorities in recent years in its treaties with the United Kingdom (UK), New Zealand and Japan. These treaties contain provisions on cross-border data flows and data localisation, but with a carve-out for domestic data protection law. Similarly, China and Vietnam have pushed for self-judging exceptions in the RCEP that shield their domestic cybersecurity laws from disputes. The constant shift of values and interests in digital trade can result in the re-configuration of digital trade communities from time to time. While realists might view these developments as a pure articulation of sovereign interests, these dynamic shifts are nuanced and depend on how States want to position themselves in different digital trade communities.

In addition to the treaties, certain regional bodies are proactively developing principles to enable digital connectivity, digital trade and data flows. For example, ASEAN members agreed upon a blueprint in 2015 to implement a high-level regulatory framework for e-commerce.¹⁰⁶ They subsequently developed the ASEAN E-Commerce Agreement,¹⁰⁷ Framework on Data Governance,¹⁰⁸ Digital Integration Framework Action Plan¹⁰⁹ and ASEAN Model Contractual Clauses.¹¹⁰ They are now negotiating a regional Digital Economy Framework Agreement (DEFA), with the aim of establishing an open, secure, interoperable, competitive and inclusive regional digital economy.¹¹¹ A key component of DEFA is addressing digital development disparities across the region and preparing micro, small and medium-sized enterprises to participate meaningfully in digital ecosystems.

Several other policy networks and multistakeholder bodies are also engaged with developing high-level values and principles for the digital trade community. For instance, the Global Privacy Assembly, consisting of over 130 data protection and privacy authorities across the world, has developed various high-level principles to enable privacy-compliant data flows. This includes declarations and other principles on cross-border privacy and cybersecurity enforcement, data sharing, governmental access to data, and regulation of emerging digital technologies such as AI and facial recognition.¹¹² Other bodies such as the Internet Society,¹¹³ UN agencies¹¹⁴ and multistakeholder initiatives such as the Internet Jurisdiction and Policy Network¹¹⁵ and Datasphere¹¹⁶ also address different principles necessary for the regulation of cross-border data flows. A common theme across these initiatives is developing shared norms to enable cross-border data flows while preserving core policy goals such as privacy and cybersecurity.

An area where community-level consensus building is necessary and timely, but has been underexplored to date, is digital inclusion and development. While some recent DEAs contain provisions to foster digital inclusion,¹¹⁷ further initiatives are necessary to support digitally excluded groups through knowledge exchange and dedicated work programmes. Such initiatives would be much more meaningful if there were stronger understanding of shared interests in the relevant communities, especially at the regional level and, particularly, resulting from active participation of developing countries.

2. Is there an emerging community in digital trade law?

While the above section highlights various digital trade initiatives, there is a need to examine further whether these initiatives indicate an existing or emerging digital trade community. If so, who are the constituent members and what are their values? These questions are significant because a globally interconnected internet infrastructure and economy has benefits, thus creating an obvious basis for shared interests among States. Certain recent proposals such as the Data Free Flow with Trust (DFFT) proposed by Japan at the G20 in 2019¹¹⁸ (and thereafter considered across many other fora such as the OECD and Group of Seven (G7)) indicate shared interests (at least among digitally developed countries). Further, since several data-related issues constitute transnational policy concerns, exploring shared values and building consensus in different digital trade communities is feasible.¹¹⁹

In addition to the more trade-related concerns in the digital economy, a global consensus is emerging in relation to preserving certain core values in data governance frameworks to build a just and equitable framework for the digital economy.¹²⁰ This consensus is already visible in some contexts. For instance, a diverse group of States has shown a common interest in developing meaningful data sharing and interoperability practices to create a fairer and more equitable digital economy.¹²¹ Certain groupings of States have agreed upon high-level ethical principles for the regulation of emerging technologies such as AI.¹²² Similarly, international organisations and multistakeholder bodies are developing high-value and open data sharing projects that can create global public goods.¹²³ All these areas where States share common values/interests are ripe for collective action by the digital trade community.

Finally, digital trade law is undergoing a shift from focusing solely on reciprocal bargaining for market access to developing regulatory frameworks on data flows. These new areas require comprehensive identification of cross-cutting principles and values across States as they impact the domestic policy space. For example, certain recent PTAs contain provisions on data protection and cybersecurity cooperation. A growing network of DEAs is moving away from the traditional trade paradigm to look at the regulation of the digital economy as a holistic issue including through soft-law frameworks in areas such as AI, digital identities and digital payments. To foster discussion on such a wide variety of digital governance issues with both domestic and transnational policy implications, a community lens can be highly useful.

Nonetheless, it is acknowledged that digital trade communities can be a tool for both inclusion and exclusion. As an example, this tension is visible in the ongoing negotiations on a cybercrime treaty at the UN, where certain States have argued that the proposed provisions are a cover for imposing data localisation and stringent censorship of digital networks.¹²⁴ Similarly, the burgeoning tech war between the US and China is visible in the way digital trade communities are developing. For instance, the US left China out of the Indo-Pacific Economic Framework for Prosperity (IPEF) initiative (one of the pillars focuses on digital trade and data flows) despite its Asian focus.¹²⁵ China has, however, developed its alliances in the Asia-Pacific region through the RCEP.¹²⁶ Interestingly, however, certain States such as Australia and Japan are part of both initiatives, thus indicating that different States may share varied interests with members of different communities. Therefore, in mobilising different communities, different constituent stakeholders must account for the flexibility and diversity necessary to engage fruitfully on these topics in different fora.

III. UBUNTU: THE AFRICAN PHILOSOPHY OF COMMUNITY AND SOLIDARITY

Before exploring the role of community in enabling digital trade integration in Africa in the next section, this section outlines the African communitarian philosophy of Ubuntu to provide the context for the discussion. Ubuntu is often seen as an opaque concept that is not capable of being concretely defined.¹²⁷ Its meanings are multiple because its origins cannot be pinned down to a particular time in Africa's history.¹²⁸ Etymologically, the word ‘ubuntu’ is an abstract noun comprising a combination of the root -ntu, which means a ‘person’ or ‘human being’ and the prefix ubu-, which means ‘to be’.¹²⁹ One description of Ubuntu is the positive moral qualities of a person.¹³⁰ Ramose, an eminent Ubuntu scholar, characterises Ubuntu as ‘a lived and living philosophy of the Bantu-speaking peoples of Africa’.¹³¹ It is also perceived as African humanism,¹³² a moral theory or ethics,¹³³ and an African worldview.¹³⁴

Although Ubuntu as a concept has its roots in southern Africa, it is often regarded as part of a broader African worldview, sharing philosophical ties with African humanist traditions such as Julius Nyerere's Ujamaa or Leopold Senghor's négritude.¹³⁵ The latter similarly emphasise collective well-being and the empowerment of African people. In the area of politics and law, the values ascribed to Ubuntu have included justice, fairness and equity.¹³⁶

The normative appeal of Ubuntu in the context of developing regional and international law is largely untested outside of Africa. There is a contrast, however, between the ideals informing international law (especially as understood in the Western world), placing value on the individual and individualism, and Ubuntu, which views an individual in relation to their community.¹³⁷ However, Qobo and Nyathi argue that Ubuntu should not be viewed as an exotic philosophy applicable only to Africans as it represents ‘fundamentally human qualities that at different points coloured various cultures and civilisations’.¹³⁸ They posit that Ubuntu can offer a useful paradigm for international relations and an alternative to the power structures and Western hegemony that have significantly constrained global affairs.¹³⁹

Other scholars have also made a strong case for using the philosophy of Ubuntu in the international legal context. For instance, Chengeta argues that the philosophy of Ubuntu or humanity has permeated public international law and forms the basis of many of its branches. He notes that humanity is central to, for example, international human rights law and international humanitarian law, finding concrete expression in the latter in the Geneva Conventions on the Law of War and their Additional Protocols.¹⁴⁰ An illustration of the concept of humanity is shown in, for example, the provisions on exercising due restraint in warfare which are applicable even in relation to prisoners of war. Chengeta considers that the concept of humanity, and thus Ubuntu, can be defined as a normative standard.¹⁴¹

While some sceptics might view the above assertions as controversial or utopian, there are clear examples of the manifestation of Ubuntu in State practice. For instance, South Africa has used Ubuntu as a tool to frame its foreign relations, recognising global ‘interconnectedness and interdependency’ and the need to respect all nations, people, and cultures.¹⁴² The government has further recognised that promoting and supporting the positive development of other States is aligned with its national interest, and that ‘national security would therefore depend on the centrality of human security as a universal goal, based on the principle of Batho Pele (putting people first)’.¹⁴³ The South African judiciary has also relied upon the concept, using it as a principle of judicial interpretation. In S v Makwanyane, the Constitutional Court judgment that abolished the death penalty in South Africa, Mokgoro J considered it important to recognise indigenous South African values, particularly those of Ubuntu, in constitutional interpretation and State decision-making.¹⁴⁴

The above contextualisation of African socio-political values with parallel concepts from international law is crucial to better understand the role of community values in the African digital trade ecosystem, discussed in the following section.

IV. PROSPECTS AND CHALLENGES FOR THE AFCFTA AS AN EMERGING INTERNATIONAL COMMUNITY IN DIGITAL TRADE

The AfCFTA Agreement is an Africa-wide free trade agreement (FTA) that seeks to enhance regional integration by increasing intra-African trade and investment. It is the largest trade agreement by number of parties since the creation of the WTO. This agreement is a significant piece in the African puzzle of creating a single continental market with free movement of goods, services, people and capital. The AfCFTA encompasses over 1.2 billion people with a combined gross domestic product (GDP) of more than $2.5 trillion.¹⁴⁵ If fully implemented, it is expected to increase regional trade by 16 per cent.¹⁴⁶ The AfCFTA Agreement entered into force on 30 May 2019, 30 days after the receipt of the twenty-second instrument of ratification on 29 April 2019.¹⁴⁷ The operational phase of the AfCFTA Agreement was launched on 7 July 2019. After COVID-19-related delays, trading under the AfCFTA Agreement officially started on 1 January 2021. To date, 54 AU Member States have signed the AfCFTA Agreement, and 48 have deposited their instruments of ratification.¹⁴⁸

The AfCFTA negotiations were launched in June 2015,¹⁴⁹ and have been divided into three phases. Phase I covered trade in goods and services and dispute settlement.¹⁵⁰ Phase II negotiations (launched in February 2019) covered intellectual property rights, investment and competition policy.¹⁵¹ Finally, the negotiations of Phase III of the AfCFTA Agreement on digital trade and women and youth were announced in February 2020 but began in December 2022 due to the COVID-19 pandemic.¹⁵² The AfCFTA DTP was eventually adopted by the Assembly of the Heads of State and Government of the AU at its Thirty-Seventh Ordinary Session held from 17 to 18 February 2024 in Addis Ababa, Ethiopia. Although adopted, negotiations on the AfCFTA DTP's eight annexes are ongoing. The following annexes will be developed: rules of origin; cross-border data flows; cross-border digital payments; source code disclosure; digital identities; financial technology; emerging and advanced technologies; and online safety and security.¹⁵³

Despite the delays, the AfCFTA DTP was negotiated in 14 months, considerably quicker than the Phase I and II negotiations.¹⁵⁴ Such rapid negotiation of an FTA is unprecedented for Africa and, indeed, also uncommon elsewhere. It indicates the high priority accorded to the digital economy in Africa's trade agenda and highlights Africa's strong sense of community and collaboration on digital trade issues. The AfCFTA and the AfCFTA DTP, in particular, are apt case studies because of the significance of these instruments to Africa's economy and the philosophy of Ubuntu and community in general that underpin their development.

Indeed, Africa is on the cusp of a drastic digital transformation, accompanied by regulatory innovation in the form of the AfCFTA DTP, among other initiatives. However, despite the developments, serious challenges remain, such as an ever-growing asymmetry in digital development creating a yawning digital divide.¹⁵⁵ Some issues require a careful balancing of domestic and regional interests, such as cross-border data regulation which raises concerns at both domestic and Africa-wide regional levels.¹⁵⁶ This section argues that a digital trade community is gradually emerging at the African continental level and in the Regional Economic Communities (RECs) in the regulation of cross-border data flows, privacy and cybersecurity. It highlights examples of existing strategic frameworks in the region and the provisions of the AfCFTA DTP that conceptualise the future of digital trade regulation in Africa and establish shared norms and principles. Developing a robust pan-African regulatory framework for data governance necessarily requires a sense of collective responsibility underlined by community/Ubuntu values. Therefore, the implementation of the AfCFTA DTP, including the negotiation of the outstanding annexes—among which the Annex on Cross-Border Data Flows is of particular relevance for this article—must strengthen the consensus on digital trade rules and foster mechanisms that nurture the embryonic AfCFTA digital trade community.¹⁵⁷ This is fundamental to regulating the digital economy in a manner tailored to African realities while giving the continent a powerful voice in the relevant global fora.

The establishment of the AfCFTA is a powerful politico-legal manifestation of African collaboration and solidarity. From the perspective of this article, it can also be viewed as a manifestation of community values and shared interests among members of the African community, international law and, more importantly, the praxis of Ubuntu. Since the beginning of Africa's formal economic integration in the 1980s, African States have recognised that ‘shared prosperity and well-being’¹⁵⁸ can only be fully realised by political cooperation among themselves.¹⁵⁹ Given that the African region comprises 55 States, including 33 LDCs,¹⁶⁰ 13 lower-middle-income economies, 7 upper-middle-income economies and a high-income economy,¹⁶¹ achieving such cooperation is not an easy task. Nonetheless, African States have maintained a strong dedication to their collective future, as demonstrated below.

A. Unpacking the AfCFTA DTP and Related Instruments

A core ambition for the African region's digital trade community is creating an optimal intra-African regulatory framework to tackle some of the digital economy's most pressing issues: cross-border data flows, data protection and cybersecurity. The AfCFTA State Parties face the gargantuan task of ensuring normative cohesion, fragmentation limitation, regulatory interoperability and the adoption of standards to permit the seamless integration of the African digital trade market. These challenges mirror those experienced globally, as States have struggled to achieve alignment on these issues. Despite the complexity of the task, the AfCFTA State Parties have the potential to develop meaningful norms that focus on common challenges in the region, such as limited data infrastructure, technical expertise and regulatory resources, thereby also promoting a community perspective.

Several regional bodies, including the AU and certain RECs, have contributed to the development of instruments to build a digital trade community and support the establishment of the African Digital Single Market.¹⁶² In addition to the AfCFTA DTP, several other continental digital strategies capture the spirit of African interdependence and solidarity in creating a common and inclusive regulatory framework on digital trade. For instance, the Digital Transformation Strategy for Africa 2020–2030 and the AU Data Policy Framework provide strategic direction for physical and regulatory infrastructure for the digital economy in Africa. Specifically, the Digital Transformation Strategy has been developed to ‘guide a common, coordinated digitalization agenda, enhance synergies and avoid duplication of effort’.¹⁶³ It sets a clear vision for the AU to establish

an integrated and inclusive digital society and economy in Africa that improves the quality of life of Africa's citizens, strengthens the existing economic sector, enables its diversification and development, and ensures continental ownership with Africa as a producer and not only a consumer in the global economy.¹⁶⁴

Significantly, the founding principles of the Digital Transformation Strategy include solidarity and cooperation.¹⁶⁵ It also refers to collaborative imperatives of establishing harmonised policy, legal and regulatory frameworks,¹⁶⁶ strengthening collaboration between African institutions and regulators¹⁶⁷ and infrastructure sharing to defray limited resources.¹⁶⁸

In parallel, the AU Data Policy Framework provides principle-based guidance to AU Member States in their domestic adoption of the continental data policy.¹⁶⁹ It considers the digital economy as a means of introducing ‘huge opportunities for more interconnected and interoperable markets and offers avenues for tech start-ups and e-businesses to flourish’.¹⁷⁰ This instrument specifically aspires to align with international law and the values of the AU to achieve greater unity and solidarity between African States and their peoples.¹⁷¹ As such, some of the high-level principles guiding the framework include cooperation, fairness and inclusiveness.¹⁷²

B. Creating Regulatory Frameworks in Three Key Areas

The relevant elements of these and other digital trade-related instruments, including those adopted by RECs and AfCFTA State Parties, are discussed below in relation to the three main issues currently impacting digital trade: cross-border data flows; data protection; and cybersecurity. These instruments form an important basis for building a digital trade community in Africa and thus should also embody the spirit of Ubuntu in African regional integration. However, building such a community also entails challenges. For example, certain African States are simultaneously adopting restrictive domestic policies and legislation to regulate aspects of the digital economy. As argued above, the existence of multiple, overlapping and sometimes conflicting legal instruments can result in fragmentation and thus weaken the digital trade community that is necessary to realise the African Digital Single Market.

1. A regional framework for cross border-data flows

Data flows have become invaluable and central to businesses and business practices everywhere,¹⁷³ including in Africa. However, paradoxically, the adoption of cross-border data restrictions, particularly data localisation requirements, is increasing globally, including in Africa.¹⁷⁴

A data localisation requirement is a regulatory mandate that data generated within a State's borders must be stored, processed or managed within that State. These laws are typically designed to ensure that sensitive information, particularly personal data or data critical to national security, remain under the jurisdiction and control of the government. Therefore, the cross-border transfer of such data may be restricted. As of December 2023, 27 States maintained approximately 140 data localisation requirements.¹⁷⁵ In Africa, Nigeria maintains strict data localisation requirements in five areas: payments; subscriber and consumer data; sovereign data; and for national security and economic development purposes.¹⁷⁶ Other African States have adopted strict data localisation requirements based on other rationales. For example, section 70(1) of Zambia's Data Protection Act prohibits the cross-border transfer of ‘sensitive’ personal data.¹⁷⁷ Some States have adopted sector-specific restrictions. Uganda¹⁷⁸ and Rwanda¹⁷⁹ maintain restrictions in financial services, and Rwanda¹⁸⁰ (and Nigeria in respect of subscriber and consumer data, as mentioned above) has adopted restrictions in telecommunications. Burkina Faso has imposed restrictive requirements for health data.¹⁸¹

At the continental level, the Digital Transformation Strategy adopts a pro-data localisation stance. It considers the adoption of these measures a means to achieve self-sufficiency in the African data economy. It emphasises the narrative of digital/data colonialism, highlighting that most digital offerings consumed in Africa originate outside Africa and reiterating the need for regional data centres for a robust African data-driven economy. This instrument thus extols data localisation as a means of respecting data sovereignty and emphasises the urgent goal of the storage of the personal data of all African residents within Africa.¹⁸² To facilitate this transition, the Digital Transformation Strategy explicitly recommends the adoption of a data localisation regulatory framework.¹⁸³

In contrast, the Data Policy Framework's approach to data localisation is moderate. It highlights that localisation rules limit the cross-border flow of information and thus weaken the data economy in Africa.¹⁸⁴ However, it also acknowledges that data localisation can be an ‘expression of state sovereignty’.¹⁸⁵ It thus advocates a cost–benefit analysis for data localisation measures, taking into account the context of the control measures, practical challenges (such as capacity constraints) and possible human rights violations.¹⁸⁶ This framework also recognises that policies like data localisation are not possible without the necessary infrastructure and institutional frameworks.¹⁸⁷ Moreover, it offers a more nuanced position, requiring cross-border provisions for cloud computing, data centres and data localisation to be contextualised to broader economic and development priorities.¹⁸⁸

The above policy divergences on data localisation possibly reflect the shifting ideological preferences within Africa. The Digital Transformation Strategy was launched in 2020 and the Data Policy Framework in 2022. The COVID-19 pandemic took place in the intervening period. It exposed Africa's vulnerabilities and African States realised that they were underprepared to adopt strict data localisation as the only viable policy option. Reflecting this change in policy thinking, Article 22.1 of the AfCFTA DTP expressly prohibits the adoption of data localisation measures by State Parties. It is qualified by an exception that allows State Parties to adopt such measures if necessary ‘to achieve a legitimate public policy objective or protect essential security interests’.¹⁸⁹ While prohibiting data localisation, the AfCFTA DTP has a unique provision that encourages State Parties to support the establishment and use of data centres in their territory to ‘promote the development of local digital infrastructure and access in line with the objectives of this Protocol’.¹⁹⁰ The negotiated compromise evident in this provision underlines that the dynamism and evolution of community values can allow for the reflection of practical realities while laying the groundwork for Africa's data sovereignty.

The AU centralises the AfCFTA as a forum for digital economy rulemaking to establish standardised rules on cross-border data flows. At the same time, other institutions in Africa, including RECs, are involved in deliberating upon policies and initiatives on digital transformation and growth at a Pan-African level. Regulating data flows entails looking at multiple dimensions of regulation. Therefore, by adopting a multi-institutional model of digital trade regulation and integration, the African community recognises the critical and unique role that different stakeholders must play in the community. This model also upholds the Ubuntu philosophy in which individual community members and their associated bodies have a sense of collective responsibility. Further, a natural consequence of this model is that different stakeholder bodies have a voice in setting the most appropriate rules for data flows in the region, contextualising their socio-economic needs and circumstances.

In creating African data standards, the Data Policy Framework further recognises another essential value in developing a strong community: consensus.¹⁹¹ It highlights the necessity of developing data standards to facilitate cross-border data cooperation. However, in doing so, the relevant bodies should reference current international standards while adjusting and adapting them to Africa-specific needs.¹⁹² These considerations can and should be integrated into the Annex on Cross-Border Data Transfers to create an African data transfer regime that is attuned to Africa's unique circumstances and priorities.

2. Emerging consensus on data protection and privacy

The relevance of privacy and data protection as an African value or policy priority is often debated.¹⁹³ For instance, it has been proposed that the collective nature of African culture, where individualism is subverted to the family, clan or community, can imply that individual freedoms like privacy are fundamentally antithetical to the African way of being. Moreover, several scholars have argued that the absence of any reference to privacy in the African Charter on Human and Peoples’ Rights (AfCHPR)¹⁹⁴ reflects the lack of a privacy culture in Africa.¹⁹⁵ However, international values like freedom and privacy have found their way into the constitutions of African States and/or their domestic laws as part of their colonial inheritance and engagement in international relations.¹⁹⁶ Further, scholars have recently argued that privacy values can be read into the AfCHPR.¹⁹⁷

In addition to legal arguments and the fact that communitarian values are predominant in Africa, there are pragmatic reasons to incorporate privacy norms in the African regional context to address changes in the digital world. In 2004, Bakibinga asserted that ‘[o]ne can have privacy and still be part of the community’.¹⁹⁸ Her statement is emphatically supported by Banisar, who has argued that privacy is inextricably linked to information technologies and, thus ‘differences in cultural understanding’ must not be overstated in the context of digital privacy.¹⁹⁹

The legal reality is that privacy and data protection are fait accompli in Africa—at the continental, REC and individual-State levels. Data protection is widely regulated in Africa. Pursuant to Article 21 of the AfCFTA DTP, State Parties are required to adopt or maintain a data protection regulatory framework.²⁰⁰ To operationalise this framework, the State Parties have invoked the spirit of community/Ubuntu and seek to ‘develop collaboration mechanisms and frameworks for technical assistance, enforcement, and awareness creation on personal data protection’ and ‘maintain dialogue on personal data protection and sharing of knowledge, research and best practices with other State Parties’.²⁰¹ These elements could be developed in the Annex on Cross-Border Data Transfers to ensure that data flows with security and trust within Africa.

At the continental level, the African Union Convention on Cyber Security and Personal Data Protection 2014 (Malabo Convention) sets out a framework for data protection and seeks to establish an intra-African data transfer regulatory framework.²⁰² Its entry into force on 8 June 2023, nine years after its signature, was a significant milestone and symbolises how multiple stakeholders successfully rallied around a single policy objective. Although dated,²⁰³ African States have been encouraged to ratify it over the years,²⁰⁴ and it is widely referenced in continental policy documents.²⁰⁵ The Malabo Convention establishes an African conditional flow regime under Article 14(6), which only permits the transfer of data to non-AU Member States if they have ‘an adequate level of protection of the privacy, freedoms and fundamental rights of persons’, unless the data controller obtains authorisation from the national Data Protection Authority (DPA). It is likely that this provision would even facilitate cross-border data transfers to AU Member States who have not ratified the Malabo Convention.

In addition to the Malabo Convention, privacy protection and related policy interests are also articulated in other sub-regional instruments and thus enjoy a high level of community-level support. For instance, the East African Community (EAC) was the first REC to adopt an instrument to regulate the digital economy, with the adoption of the EAC Framework for Cyberlaws in 2010.²⁰⁶ This instrument also recommended further work, inter alia, on designing institutional and legislative measures for protecting internet privacy in Africa, including by taking account of international best practices.²⁰⁷

Further, the Member States of the Economic Commission of West African States (ECOWAS) have adopted the ECOWAS Supplementary Act on Personal Data Protection (ECOWAS Supplementary Act).²⁰⁸ It applies to, inter alia, data processing carried out within ECOWAS and the West African Economic and Monetary Union (WAEMU). The ECOWAS Supplementary Act requires data processors in the region to make declarations and authorisations to process certain types of data, including personal data like biometric data, health information and criminal records.²⁰⁹ Further, like the Malabo Convention, Article 36 of the ECOWAS Supplementary Act permits the transfer of personal data to non-ECOWAS States upon fulfilling adequacy requirements. In March 2023, the ECOWAS Court found the ECOWAS Supplementary Act to be a human rights instrument protecting privacy and personal data.²¹⁰

Finally, the Southern African Development Community (SADC) has issued a Model Law on Data Protection, which was adopted by the ministers responsible for telecommunications, postal, and information and communications technology (ICT) services in 2012.²¹¹ Regarding data flows to non-SADC members, Article 44 provides a mechanism for the flow of personal data inter alia, upon the consent of the data subject or to fulfil contractual obligations between the data controller and a third party. Although it is not binding on the parties, its principles have nevertheless been adopted into sub-regional national privacy laws.

Moreover, individual African States have been particularly prolific at adopting data protection regulations. United Nations Trade and Development (UNCTAD) indicates that of the 54 African States included in its database, currently 33 (or 61 per cent) have data protection legislation, 6 (or 11 per cent) have draft legislation, 10 (or 19 per cent) have no legislation, and there are no data on 5 States (9 per cent).²¹² Additionally, contributing to the complex landscape of data protection laws applicable to African States, Cabo Verde, Mauritius, Morocco, Senegal and Tunisia have ratified the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108).²¹³

There is a clear expression of data protection as a community value in Africa, but how this will be realised at the continental level is unclear, especially given the degree of regulatory heterogeneity. Therefore, focusing on shared values to foster creative cooperation is necessary to ensure that data flows with trust and security in Africa. A common feature of many domestic African data protection laws is the adoption of the adequacy/conditional flow regime of the Data Protection (General) Regulations (GDPR).²¹⁴ This allows data transfers to a third country, provided they have an ‘adequate’ level of data protection. For example, Articles 48, 49 and 50 of the Kenya Data Protection Act²¹⁵ permit the cross-border transfer of data if adequate protection exists, or if the data subject has consented, or the transfer is necessary for a contract, or required in the public interest. Other States like Chad,²¹⁶ Senegal,²¹⁷ South Africa,²¹⁸ Tunisia,²¹⁹ Uganda²²⁰ and Zimbabwe²²¹ have adopted a similar approach to data protection.

Individual African domestic adequacy regimes can frustrate the goal of establishing a Digital Single Market and splinter the community. Moreover, the AfCFTA DTP has not rectified the uncertainty by providing a clear benchmark. It merely requires the State Parties to adopt or maintain data protection regulations without providing further guidance. It nonetheless seeks to ensure regulatory best practices and to encourage some harmonisation by requiring State Parties to consider ‘the relevant principles and guidelines adopted by regional, continental and international organisations’²²² when adopting their data protection instruments.

To foster the collective will of the African community to build a regional data protection framework, a pragmatic direction is necessary that addresses policy confusion among State parties. The Annex on Cross-Border Data Transfers presents a significant opportunity to ensure that personal data will be protected in every African jurisdiction. One option is for African States to converge around the adequacy/conditional flow data protection model, allowing for State-specific differences in the form of flexible harmonisation. All AfCFTA State Parties would agree to grant each other adequacy and would also follow the same conditional flow/adequacy model when transferring African data to third-party States so as not to erode the higher levels of protection agreed upon within the AfCFTA DTP. This model could be operationalised by ensuring that national and continental DPAs are adequately resourced, and an Africa-wide agency could be identified for further support, monitoring and evaluation (thus strengthening the provisions of the Protocol discussed in the previous paragraph). In addition to building a strong digital trade community aligned with African values, this would provide African entities trading outside of Africa with an additional layer of legitimacy and trustworthiness. These changes could be highly relevant given the absence of trust in data protection and cybersecurity environments in individual African States.

Another arguably more Africa-attuned data protection model has been proposed in the AU Data Policy Framework. It recognises that some models of data protection widely used elsewhere, like informed consent, may not work in Africa because of low levels of literacy, including digital illiteracy. Granting access to personal data by ticking a box after reading a long text may not be representative of proper consent in the African context. The Framework proposes other means of data stewardship, such as data trusts, to ensure that the rights of the public are upheld. The Framework also recognises that the framing of data protection with individual privacy may not always be adequate in Africa because of community and collective rights that might be just as important to protect as the individual right to privacy. It thus proposes framing data protection as data justice (which also includes cybersecurity, the rule of law and institutional accountability).²²³ This is a clear example of developing African digital economy regulation through a community lens and elevating collective rights over individual rights that symbolises the concept of Ubuntu. This model of protecting collective rights in digital trade regulation is not unique to Africa. New Zealand has recognised the collective rights of the Maōri, including data protection, in its PTAs to fulfil its obligations under the Treaty of Waitangi.²²⁴

3. Towards a community model of cybersecurity regulation

Although digital interdependence has its benefits, the ever-growing dependence on information technology also creates vulnerability related to cyber-attacks and cybercrime.²²⁵ This situation is even more severe in Africa, where 90 per cent of businesses operate without the necessary cybersecurity protocols, resulting in significant financial loss if targeted.

In 2021, cybercrime reduced Africa's GDP by 10 per cent, or approximately US$4.12 billion. In 2016, cybercrime cost the Kenyan economy approximately US$36 million, the Nigerian economy US$500 million, and the South African economy US$573 million. South Africa has the third-highest number of cybercrime victims per year in the world and is the most affected African State. The COVID-19 pandemic further accelerated cybercrime, exacerbating the digital divide and cybersecurity vulnerabilities across the region. The growing rate of digital transformation in Africa continually facilitates the emergence of new cyber-attack vectors and opportunities for cybercriminals.²²⁶ To manage the risks and losses associated with cyber-criminality and to maximise the gains from the Digital Single Market, it is thus critical that African States collaborate to develop an effective cybersecurity regulatory framework.

On cybersecurity matters, the AfCFTA DTP requires State Parties to adopt or maintain measures to ensure cybersecurity and combat cybercrime. In doing so, State Parties must take into account standards and guidelines in relevant regional, continental and international instruments.²²⁷ In operationalising this undertaking, State Parties reflect community values and the multistakeholder approach by endeavouring to: (i) build capacities of domestic authorities or bodies responsible for cybersecurity; (ii) develop collaboration mechanisms for technical assistance and capacity building with other State Parties; (iii) strengthen existing cybersecurity incident collaboration mechanisms with other State Parties; (iv) engage industry, civil society, academia and other stakeholders in matters of cybersecurity; and (v) exchange with each other and share best practices and information on cybersecurity issues.²²⁸ Finally, State Parties must require their domestic enterprises to ‘identify and protect against cybersecurity risks and to detect, respond to, and recover from cybersecurity incidents’.²²⁹

The Malabo Convention also establishes procedures for combatting cybercrime in Africa. Central to these provisions is Article 28 on international cooperation, which requires State Parties to adopt legislation or regulations on cybersecurity that will ‘strengthen the possibility of regional harmonization of these measures’, follow the principle of mutual assistance agreement in cybercrime, encourage the establishment of Computer Emergency Response Teams or Computer Security Incident Response Teams to exchange information on cyber-threats, and make use of existing means for international cooperation to strengthen cybersecurity. At the REC level, the EAC Framework for Cyberlaws²³⁰ and the ECOWAS Regional Cybersecurity and Cybercrime Strategy²³¹ include frameworks for addressing cybersecurity in the two sub-regions.

Domestically, African States have also been actively adopting legislation on cybersecurity. Of the 54 AU Member States included in UNCTAD's database, 39 (72 per cent) have legislation, 2 (4 per cent) have draft legislation, 12 (22 per cent) have no legislation, and there are no data on 1 State (2 per cent).²³² Countries like Rwanda²³³ and Zambia²³⁴ have adopted data localisation requirements to prevent cybercrimes. Moreover, Cabo Verde, Ghana, Mauritius, Morocco and Nigeria are parties²³⁵ to the Budapest Convention on Cybercrime and its Additional Protocols.²³⁶

The AfCFTA DTP does not envisage a Cybersecurity annex. However, Article 29.2 contemplates the negotiation of an Annex on Online Safety and Security. The annex has the potential to cover cybersecurity and could incorporate some of the existing regulatory and policy frameworks that reflect the collective will and values of African State Parties on cybersecurity. For example, the Digital Transformation Strategy recommends the support of interventions to strengthen cybersecurity at the national level. This includes developing and adopting national cybersecurity strategies and laws and enabling policymakers and law enforcement to strengthen cybersecurity. The Data Policy Framework invokes Ubuntu to address cybersecurity in the African region. It contemplates a multistakeholder collaborative approach. This would include the establishment of an AU Cyber Security Strategy and Operational Cybersecurity Centres to mitigate common risks and threats related to cyberattacks, data breaches and the misuse of sensitive information. Enhanced cooperation amongst the AU Member States, other AU organs and the AU Mechanism for Police Cooperation (AFRIPOL) is also contemplated. Moreover, it is foreseen that AU Members would cooperate to develop cybersecurity standards and adopt a joint sanction regime for cyber-attacks.²³⁷

The push to regulate cybersecurity collaboratively in Africa is already visible. The aim is to mitigate the potentially great losses suffered by victims of cybercrime, who are mostly among the vulnerable populations in Africa. However, the increasing regulatory fragmentation can undermine efforts to adopt rules on robust cooperation and capacity building that further nurture and support the growing digital community to address the rampant cyber-insecurity in Africa.

The above discussion on cross-border data flows, data protection and cybersecurity indicates that community values, as embodied in the African philosophy of Ubuntu, have been significantly integrated into efforts to regulate the digital economy. This is despite cross-border data regulation being one of the most complex policy areas in digital trade regulation. Although most existing initiatives are soft-law instruments and flexible policy frameworks, they present considerable opportunities for the African region to emerge as a cohesive and robust digital trade community. Soft law has the advantage of being an alternative means of ensuring community and solidarity in Africa without the risk of legal challenges if a State Party cannot comply due to domestic incapacity and other constraints. It has also permitted the values of multistakeholderism and consensus to be incorporated into certain initiatives. The negotiation of the Annex on Cross-Border Data Flows will provide another opportunity for the continent to create novel mechanisms and institutional bodies that can identify common interests and foster meaningful cooperation in these areas by relying upon the core values of the African digital trade community.

V. CONCLUSION

This article sets out the importance of shared values and emerging solidarity in digital trade communities for building and implementing a robust and sustainable framework for digital trade law. While the notion of community values may seem vague at first sight, this article argues its malleability is crucial for States seeking an anchor to develop an inclusive and holistic model of digital trade integration. Similarly, although solidarity has often been a contested legal concept, it can provide direction for the development of relevant regulatory cooperation and technical assistance and support mechanisms in digital trade law. In addition, specific to the African context, the article highlights how community interest may be further strengthened in the African digital market by relying upon the philosophy of Ubuntu in developing and implementing various digital economy frameworks in the region. The article then examines the possibility of building upon shared interests in this manner to foster regulation of cross-border data flows, data protection and cybersecurity under Africa's digital economy regulatory framework, including the AfCFTA DTP.

Ultimately, whether in the context of Africa, other regions or even the WTO, the development or strengthening of a viable digital trade community (or communities) will prevent governments from the slippery slope of digital sovereignty and protectionism which hampers global and domestic economic welfare.²³⁸ Emerging digital trade communities can thus become fora for meaningful deliberation on transnational digital policy concerns and could be especially critical in designing the institutional and policy interventions necessary to operationalise shared values and collective interests in the global digital economy. It is thus concluded that for the development of both rules and institutions in digital trade law, trade policymakers must continue to identify and strengthen commonly shared values to provide a solid foundation for the regulation of the global digital economy.