VPNs with servers in Ethiopia

Personal Data Protection Proclamation No. 1321/2024 requires every data controller or processor to store personal data collected or obtained locally on a server or data centre located in Ethiopia (art. 22).

Under the same article the Ethiopian Communications Authority may prescribe categories of critical personal data that may be processed only in Ethiopia, and the cross-border transfer of sensitive personal data needs its prior approval. Whether either proclamation reaches a VPN operator is not established.

The Hate Speech and Disinformation Prevention and Suppression Proclamation No. 1185/2020 (Federal Negarit Gazette No. 26, 23 March 2020) prohibits hate speech (art. 4) and the dissemination of disinformation (art. 5). An enterprise providing a social media service must endeavour to suppress and prevent both on its platform, and must act within twenty-four hours of a notification to remove or take out of circulation such speech or posts (art. 8).

Under art. 7 of Proclamation 1185/2020, hate speech is punishable by simple imprisonment of up to two years or a fine of up to 100,000 birr, and by one to five years where an attack on a person or group results. Disinformation is punishable by up to one year or a fine of up to 50,000 birr.

Where either offence is committed through a social media account with more than 5,000 followers, or through broadcast or print media, imprisonment may reach three years or the fine 100,000 birr, and disinformation that leads to violence or public disturbance carries two to five years’ rigorous imprisonment. Where no violence or disturbance resulted, a court may order community service instead (art. 7).

The Ethiopian Communications Authority, established by the Communications Service Proclamation No. 1148/2019, enforces Proclamation 1321/2024. It may prohibit, suspend or condition cross-border transfers (art. 21) and inspect a controller’s security measures where processing may entail a specific risk to privacy (art. 45).

Proclamation 1148/2019 (art. 51) requires telecom operators to keep customer communications confidential, with government surveillance for criminal or national-security investigations subject to a court order. The order of the rows is the security score, and a server’s location is not a recommendation.