Thanks to the Mauritian Data Protection Act 2017 (DPA 2017), which came into force on 15 January 2018, Mauritius is among the first African countries to have data protection legislation that is generally in line with the European Union’s General Data Protection Regulation (GDPR).

Data transfer

While the provisions relating to the cross-border transfer of personal data are broadly similar in the DPA 2017 and GDPR, certain European principles or concepts are missing from the former, which may result in its interpretation being more ambiguous.

Unlike the DPA 2017, the GDPR has extra-territorial reach and provides that any onward transfer from a third country or international organization to another third country or international organization must comply with the conditions and obligations set out in the GDPR.

For the purposes of such transfers, the European Commission has established a list of jurisdictions that provide an adequate level of protection and where data controllers/processors do not require specific authorization for transfers. Despite the various similarities in Mauritian and EU data protection legislation, the European Commission has not yet recognized Mauritius as an adequate jurisdiction.

In Mauritius, the DPA 2017 provides for transfers of data on the basis of the “appropriate safeguards” principle. This principle requires that the data protection commissioner (Commissioner) be provided proof that appropriate safeguards in a prescribed format are in place before it will approve a transfer abroad. It is important to note here that, currently, there is no guidance as to whether repeated transfers, under minimally differing circumstances, require successive authorizations. In practice, this can prove to be cumbersome and may delay the transfer process abroad.

In both the GDPR and the DPA 2017, one approved basis for transferring data abroad is where the transfer is necessary for the purpose of “compelling legitimate interests” pursued by the controller or the processor. This does not, however, exempt the transferor from its obligation to provide the appropriate safeguards to the commissioner. In practice, for example, the DPA 2017 requires a foreign auditor based in another jurisdiction and conducting a forensic audit of a Mauritian company, to seek the Commissioner’s authorization to transfer data to its employees, irrespective of the fact that the forensic audit is in the compelling legitimate interest of the controller.

Data Portability

The appropriate safeguards principle includes considerations with regard to enforceable rights of data subject and available legal remedies.

Although the main concepts of the DPA 2017 and GDPR are similar (for example, the principles relating to the processing of data, conditions of consent and duties of the controller), Article 20 of the GDPR, which provides for the data subject’s right to portability, has not been reproduced in the DPA 2017.

As set out in the GDPR, data portability is “the right to receive the personal data…in a structured, commonly used and machine-readable format and…the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided… .”

The concept of “data portability” applies where the processing is carried out by automated means, which is more and more the case as companies process and store personal data through cloud computing or other information technology methods. Data portability increases a data subject’s control and access over its personal data and allows for an easy switch between controllers, also leading to fair competition. It remains an attractive solution, although its implementation generally requires higher financial and technological investment.

Data transfer is an important aspect of the DPA 2017, and its provisions should benefit from an ongoing review by the legislator, to ensure that the concept of data transfer evolves in line with international best practice and continues to meet both the requirements of the regulators and the needs of the data controllers.