LESSONS ON THE USE OF TECHNOLOGY IN ELECTIONS precedent of holding EMBs and their leadership accountable for information security failure and data breaches. The National Privacy Commission ordered COMELEC to implement new security measures, including hiring a Data Protection Officer and instituting a Privacy Management Program and a Breach Management Program. A month later a computer containing voters’ biometric records was stolen from a local election office. Being the second large scale data breach in less than a year, 69 COMELEC Chairperson Bautista was impeached in October 2017 and resigned that month. This is an example of both the institutional and personal liability that government bodies, and election officials may face regarding cybersecurity. In the 2022 election petitions in Kenya, the IEBC senior counsels called on the Data Protection Act in its response to justify that they could not publish the full audit report of the voter registry without putting data of Kenyan citizen at risks. 70 A similar expectation on data protection applies to the election court when evidence is handed over to the court in charge of conducting a scrutiny of election technology. There is a growing body of legislation on data protection, which provide obligations for government bodies to protect citizen data, for instance by protecting identity of voters or storing data on servers physically located inside the country. 71 Examples of such laws or regulations include Nigeria, 72 Uganda, 73 Zambia, 74 and the issue has received regional attention at SADC, ECOWAS, and EAC levels. 75 EMBs like in Kenya or Malawi, have already followed good practice on data protection, for instance by sharing a redacted version of the voter list with political parties or by using appropriate encryption tools, properly configured and managed. But courts should also abide by these standards to ensure protection of data when receiving, storing and making data accessible to petitioners or observers. Issue 8: The Availability of Effective Remedies The process of measuring different types of remedies and their effectiveness for different categories of disputes is complex. A “proper analysis of effective remedies requires an examination of the core elements of effectiveness to ensure that a remedy: (1) ensures that the letter and spirit of the law is realized in practice (including to restore electoral rights or otherwise undo the harm caused by a violation); (2) is provided in a timely manner; (3) is proportional to the violation or irregularity in question; (4) is enforceable; (5) leads to deterrence or a change in behavior in question; and (6) reinforces the perception of fairness and credibility of the process.” 76 Judicial decisions involving election technology reveal different approaches by courts in their orders, with some courts giving more latitude and time to the EMBs to remedy defects in election technology or clarify interpretation and understanding of its implementation. Other courts are more prescriptive, on occasion making orders that are difficult for the EMB to comply with in a short timeframe. This may be due in part to the fact that election technology is relatively new in many countries, and it takes time for EMBs and courts to develop expertise in the subject matter. NPC starts probe into COMELEC’s 2nd large scale data breach; issues compliance order » National Privacy Commission, February 20, 2017. 70 For instance, in the 2022 presidential election petition, the IEBC senior counsels explained that the IEBC could not publish the full final audit report as “doing so would compromise the integrity and security of the election technology system and violate the provisions of the Data Protection Act, 2019, which imposes a duty to protect the data of Kenyan registered voters.” 71 Terms for this practice vary – data residency, data localization – see Anupam Chander & Uyên P. Lê, Data Nationalism, 64 Emory L. J. 677 (2015). Available at: https://scholarlycommons.law.emory.edu/elj/vol64/iss3/2 72 Ibid., p. 700, paragraph K, Nigeria. 73 While not explicitly prohibiting offshore storage, the Ugandan Data Protection and Privacy Law addresses the topic, see https://pdpo.go.ug/media//2022/03/Data_Protection_and_Privacy_Act_No._9_of_2019.pdf 74 https://www.parliament.gov.zm/node/8853. 75 https://www.itu.int/en/ITU-D/CapacityBuilding/Documents/IG_workshop_August2018/Presentations/Session%207_Verengai%20Mabika.pdf. 76 Vickery, C. and Ellena, K. Measuring Effective Remedies for Fraud and Administrative Malpractice (2017). 69 25