As an attorney specializing in data privacy and protection, Lebogang's job entails, among others, ensuring that organizations are compliant with privacy laws and regulations, implementing policies for effective data protection in their organizations, and doing contract analysis and review to ensure that their operations align with data privacy laws. In this interview, she takes us through how she pivoted to data privacy and protection law, her take on the recently enacted Data Protection Act, her opinion on the intersection of data privacy laws and innovation and so much more!
In your own words, please tell us who Lebogang George is
Lebogang George is a girl from Tlokweng who many years ago (13/14 years ago) after completing AS at Maru-a-Pula went to the city of gold and actually found gold and has brought it home. I went to Johannesburg for the sole purpose of acquiring knowledge "gold" and learning from local and global experts so I can bring and impart that knowledge at home in order to share and add value in the spaces I will occupy as a professional. I moved back home, officially this year (2022) after being admitted as an Attorney of the High Court of Botswana.
Besides work and my obvious passion for law, tech, and data, I play as hard as I work. I enjoy dancing although I have zero rhythm. I am what you call "beat-deaf" - I am simply incapable of moving to the rhythm of music but I never shy away from the dancefloor. I enjoy laughing! I laugh a lot to a point where sometimes I never know what I am laughing at... the more sentimental me - I love my family, they have been my greatest cheerleaders. I cherish my friends who celebrate every milestone of mine and have taught me a lot about gratitude and clapping for yourself. I really wish in me telling you about myself I could share a talent I am actually good at like cooking, baking, making sushi, painting, or singing but alas, I don't have one, haha.
Briefly take us through your journey to a career in data privacy and data protection law
I got into this career path by chance. My ultimate goal and dream was to specialize in Competition Law. A principal of mine, at the time, was keen on growing the firm and establishing a data privacy and technology department.No one at the firm had in-depth knowledge of data privacy laws or had shown any overt interest in the area and as a result, she tasked me with researching and learning about data privacy laws and regulations specific to South Africa. I took the task seriously and every day I went on a rabbit hole of exploring data privacy laws in South Africa. The more I researched and read up on data privacy, cyber-security and technology the more I became interested and decided to invest in the area so I can one day call myself an expert in the field.
What inspired you to pursue this career path?
Working with organizations like the South African Tourism (it was there where my knowledge for the European Union General Data Protection Regulation ("GDPR") expanded as they have offices in the European Union), working on IT contracts on behalf of the South African Revenue Service, getting to work with the Cyril Ramaphosa Foundation entities... I was always the youngest person working with these organizations and also realized that there were few black women in this area of law. This inspired me to pursue this area and work hard on becoming an expert in this area so I could be counted amongst the valued and respected voices/opinions in the subject matter.
Please tell us what your job entails
I am also a corporate commercial attorney but let me take you through what my job entails where data privacy and data protection law are concerned. It entails, amongst other things, providing advice on data sharing, data ethics, and providing clients with tools and mechanisms to manage their data efficiently and securely. I provide training to companies with regards to data privacy laws, specifically the European Union General Data Protection Regulation ("GDPR") and the South African Protection of Personal Information Act ("POPIA") and soon, once I have familiarized myself with ancillary Botswana laws and legislation that have an impact on the retention of data, I will also be in a position to train and advise organizations in Botswana. In addition, I conduct data protection impact assessments, assist organizations to conduct a data inventory, and impart knowledge on cyber-security as it goes hand in hand with data privacy. My job basically entails ensuring that organizations are compliant with privacy laws and regulations, implementing policies for effective data protection in their organizations, contract analysis and review to align with data privacy laws and lastly providing practical tools to monitor, review, report on data breaches and improve data controls, tools they can access and use to ensure continuous compliance with laws.
In your professional opinion, for startups, how important is knowledge of laws governing tech in the country?
Extremely important! It is imperative that every organization no matter its size should familiarize itself with laws and regulations that govern them. Non-compliance with laws and regulations has dire consequences such as penalties, imprisonment in some instances of the organizations' directors as well as reputational damage where non-compliance results in a data breach of their client's or even employees' personal data, not forgetting civil suits against the start-up should there be a data breach causing some sort of damage to the data subject.
Last year, Botswana finally put into effect the Data Protection Act of 2018. How significant do you think such legislation is for both users of technology solutions and tech innovators themselves?
We keep hearing that data is the new oil, alluding to the value and worth of data. It is only inevitable that where such value and worth is put on data there need to be regulations of the sharing and collecting of data.
Users of technology solutions now have the upper hand and control over how their data is processed (used, collected, and/or shared). Users are able to ensure that their data is used lawfully, in a legitimate manner, and for an explicitly stated and relevant purpose. A User under section 19 of the DPA has the right to revoke his/her consent for the collection/processing of their data at any time as long as they have legitimate grounds compelling him/her at that particular time for revocation. This highlights the shift of control where data is concerned. A user, therefore, has legal recourse should their data not be processed in accordance with the DPA. Privacy legislation plays a very significant role in upholding a user's constitutional right to privacy where an organization would use their personal data for commercial gain. However, there is a school of thought that argues that data privacy laws limit the creativity of innovators.
This is because the digital economy is powered by the parsing of large amounts of data, which allows companies to hone, target, and refine their product offerings to individual consumers. For example, search engines rely on data from successive searches an individual makes both to personalize the search results the individual sees and to refine the search algorithm for other users. The new data economy has obvious benefits for both firms and individuals, but it raises privacy concerns. This school of thought is convinced that there is a trade-off between innovation and privacy but I would like to argue that the privacy laws allow for out-of-the-box innovation and thinking. Privacy laws are there to ensure the ethical use of data and balance the rights of data subjects where their personal data is concerned with the freedom to create and innovate. Tech innovators are able to create solutions that respect the privacy of users, maintaining the trust and loyalty of their users.
Without these privacy laws and regulations, these innovations would be in short supply because anyone could have access to the information being accessed at the development and research stage and expropriate or steal these ideas before the innovator has had the chance to go to market and sell the product. When there are privacy laws that create boundaries and minimization of personal data to be processed, an equal playing field gets created with innovation always being the winner and benefiting the economy. Lastly, privacy legislation ensures that there are checks and balances in place. It creates a system to ensure that there is no abuse of power. The end result is a balance between needs being met, freedoms being experienced, and power being shared. The new tech innovators do not get to be pushed out of the tech economy by the tech giants who tend to abuse their power due to their size and financial dominance.
Legal advice does not come cheap. How do you think tech startups, who are already struggling to stay afloat, can strike a balance between compliance with the new Act and also not breaking the bank in legal fees?
One of the advantages of the digital age is accessibility. Accessibility of information at a click. The digital revolution has made certain subjects, which were once esoteric, simple, and available to everyone. Tech startups can obtain information from various websites and podcasts. With the advent of the digital revolution companies, law firms and technology experts have been on top of technology and privacy developments in terms of posting and sharing articles on their websites, creating free podcasts where lawyers and industry experts are interviewed. These podcasts and articles are actual educational tools for listeners and readers to use and they assist in elucidating the relevant privacy laws and regulations applicable to them and their country. There is no reason for tech start-ups to not be compliant when there are a plethora of these free platforms with knowledge and information. Tech start-ups will not be exempt from non-compliance with the DPA by virtue of size and not having the financial muscle or appetite to invest in legal advice especially where there are free tools mentioned above to aid them in complying with the law.
Most local innovators have dreams of expanding usage of their products to elsewhere outside our borders, be it the SADC region, Africa, or even the world. Expansion and growth come with the need for compliance to different legal and regulatory environments. With regards to this, as a legal professional, what advice can you give to startups who have such expansion ambitions?
Research on the different privacy laws and regulations of that specific jurisdiction you wish to conduct business in, where the laws are not as stringent as the DPA ensure that you exercise the stringency of the DPA to ensure that personal data is protected in terms of a higher standard or duty of care. Enter into an agreement (data sharing agreement) with the country you are sharing data with so that they are held to the highest standards of data protection and security and understand that they will be accountable and held liable for any data breach and non-adherence to the standards set out in the contract. Sought the explicit consent of the data subject as their consent is paramount.
Machine Learning and Artificial Intelligence technologies, which are a key part of the 4IR which Botswana has ambitions of being a part of, rely on the collection of huge amounts of data, personal or otherwise, for best results. As a country, how can we ensure that we do not sacrifice privacy, which is a fundamental human right, for technological advancement?
Equip yourselves with the necessary knowledge - read the DPA. It is a short Act, 22 pages long or so, and it is easily interpretable. It is the responsibility of data subjects (an individual who is the subject of the personal data), data controllers (a person who processes the personal data), and data processors (person who processes personal data on behalf of the data controller in terms of a mandate), to learn how to process data in a lawful and reasonable manner so as not to infringe on a data subject's privacy rights. It is important to know what is considered lawful and what is considered unlawful in the processing of data. Processing of data is a wide catch-all definition that simply and deliberately includes anything and everything that you can do with a person's personal data i.e. collect, share, destroy, alter, record, archive, store, erase, etc... When you know what is lawful and what is considered unlawful you will be able to competitively participate in the 4IR and innovate within the precepts of international laws as well.
What has been the proudest moment of your career so far?
Being invited as a panelist at the Oliver & Adelaide Tambo Foundation (talking about Growing up on the Internet and Youth Socialization in the Digital World). I have been fortunate enough to be invited to webinars as a panelist hosted by South African Black Women in Law and being a panelist and moderator on The Legal Show South Africa for various data privacy, data compliance guidelines, cyber-security, and cyber-attacks topics.
What’s something you know now that you wish you knew earlier in your career?
The formidable hurdles I faced; I wish someone would have prepared me for this. The first of many hurdles was looking for and finally securing articles after completing my LLB at the University of Witwatersrand, writing the South African Attorneys' Admission Examinations, then having to relocate and write the Botswana Bar Exams, getting admitted, learning the different laws and legislative framework in Botswana since I have studied in SA law and lived in SA for 13/14 years. I was never ready for the tumultuous journey and regulatory roadblocks I had to adhere to which may have, had I been properly advised and to a different outcome in some instances.
If any, what is the best advice you have received in your career?
Know every field of the law. Even if you're not an expert in all areas, have some knowledge of each area. Explore each area when starting out so as to gain experience and have general knowledge and appreciation of it. Approaching your career like this is invaluable. Specialize once you have had some sort of reasonable career mileage.
What advice can you give to young girls who are interested in pursuing a career in tech law?
Go for it! It is an exciting area of law, ever-evolving. Who wouldn't want to be on top of developments in the digital era we are currently in? Look at what metaverse has created - a virtual real estate phenomenon - where land located online is purchased for millions and property can be rented. Where digital assets are being traded. Imagine the lawsuits emanating from that. Imagine drafting the sale of virtual land agreements and drafting lease agreements on behalf of your client who wishes to rent out their virtual property. Imagine policies and laws that would need to be developed to regulate this virtual world. Who wouldn’t want to be a part of that?
Look at Big tech companies as they are constantly breaching data laws and regulations in Europe. The rise of cyber-attacks in both the private and public sectors, the privacy implications of wearable technologies i.e. Ray-Ban glasses with a camera and audio features, smartwatches, the introduction of digital money/currency - cryptocurrencies. We are seeing developments in the internet of things (IoT) where again it would be interesting to be at the forefront and observe how regulatory authorities deal with this nuanced area and how they would ensure that innovators and developers are held accountable should they breach the rights of data subjects... We are living in the future we used to only imagine not so long ago, a world of Autonomous Vehicles (self-driving cars), robotics, artificial intelligence - where legal experts would have to consider questions of liability, insurance, data protection, and privacy and intellectual property rights, etc... To the young girls, if this is now, imagine in 5 years or 10 years from now.
Lastly, please share with our readers your contact details in case they want to get in touch with you?
They can email me at lebogang_george@yahoo.com. My email is also on my LinkedIn profile. Alternatively, they can directly message me on LinkedIn. I am always happy to help, impart some knowledge, and offer advice where I can.
NB: Interview has been slightly edited for clarity