• Cancellation right – A consumer should be granted the right to cancel a contract for certain types of goods and services, without reason and within a specified time period. • Payment fraud – A consumer should be granted certain protections from liability for fraudulent payments made in the consumer’s name, unless the vendor or payment service provider can prove that the consumer has been grossly negligent in the operation of the payment mechanism. • Performance obligations – The vendor should be obliged to perform the contract within a minimum specified period of time or be liable to fully refund the consumer. In addition, existing rules governing the content and techniques used to advertise and market goods and services should be reviewed and amended to take into account innovative online mechanisms, such as ‘pop-ups’, that may fall outside the current regime. The Task Force recommends the following: 2.5 • That the EAC Secretariat and Partner States give due consideration to consumer protection issues in cyberspace within a broader consumer protection framework, at both a national and regional level. • That reforms should encompass information requirements, cancellation rights, payment fraud and performance obligations. • That the EAC Secretariat and Partner States initiate programmes to raise consumer awareness about the benefits and risks of transacting in cyberspace, including such things as labelling schemes. • That the EAC Secretariat and Partner States give further consideration to the regional and national implications of electronic money or digital cash and the need to develop an appropriate regulatory framework (R.18). Data Protection and Privacy For the purposes of the Framework, ‘data protection’ is used here to describe those obligations placed upon those entities that process information about living individuals, generally referred to as ‘personal data’. A data protection regime will also grant certain rights upon individual data subjects. The application of data protection rules may be limited only to private sector entities or public bodies. A sectoral regulatory response may be appropriate to address specific uses and abuses of personal data, whether driven by domestic or foreign concerns, such as the financial services sector. In terms of the entity responsible for the processing, the following minimum obligations represent international best practice in the area: 17