Despite updates in legislation, organisations in Uganda struggle with data protection and privacy compliance · Global Voices
<PERSON>, Manager Data Protection Affairs at the Uganda Personal Data Protection Office, speaks during the 3rd Africa Privacy Symposium in Kampala. Screenshot from Unwanted Witness YouTube channel.
While Ugandan legislation was recently updated to include more provisions aimed at protecting digital privacy, reality on the ground shows the majority of Ugandans are not guaranteed those rights in daily practice.
When Uganda’s Data Protection and Privacy Act came into force in May 2019, then-executive director of the National Information Authority Uganda (NITA-U), <PERSON>, while commenting on the privacy law said , “the law provides the much-needed protection for personal identifiable information which is key in this digital age. It provides important safeguards that will protect Ugandan citizens as they use online services .’’ Aside from the broad constitutional guarantees on the right to privacy of person, property and correspondence, Uganda did not have any specific safeguards on the privacy of citizens’ data, and the law was supposed to give force to the provisions in the 1995 Constitutional Bill of Rights on the right to privacy, with specific regard to the privacy of data.
However, a new report, titled “A Privacy Policy Scorecard Report: The Scorecard Approach,” reveals glaring gaps in most Ugandan organisations’ compliance with data protection and privacy laws. The report was released on November 5, 2021, by Unwanted Witness, a Ugandan digital rights organisation, at the 3 rd Africa Privacy Symposium in Kampala.
The report specifically details how the Ugandan government and 32 major data collectors in Uganda are complying with privacy and data privacy standards as outlined in the Privacy and Data Protection Act 2019. The non-state entities covered include telecom companies, banks and e-commerce platforms. Each organisation is assessed against five crucial areas: practising robust data security, complying with privacy best practices, providing information to users before collecting their data, indicating the third parties with whom personal data will be shared, and disclosing third-party requests for data.
The average score of companies assessed was 35 percent, a worrying start for compliance with Uganda’s Privacy and Data Protection Act , in an already troublesome broader context of a clamp down on digital rights and digital surveillance by the government . More than half of the organisations assessed had robust data security, and 40 percent comply with privacy best practices. However, when it comes to providing users with information before collecting their data, indicating the third parties with whom that data will be shared, and disclosing how much data will be provided to those parties (including the government and law enforcement), the organizations perform poorly across the board. 779
Only 8 percent of organisations mention third parties with whom personal data is shared but all declined to reveal how much data was requested and shared with third parties such as government bodies and law-enforcement agencies.
Sealing a regulatory gap
The enactment of the data protection law was crucial as more Ugandans were starting to use the internet. As of January 2021, Uganda’s internet penetration was at 26.2 percent , a 14 percent growth in one year. This is despite a 12 percent excise tax the government introduced on the purchase of data in 2021, and a social media tax in 2018. The growth in the number of internet subscribers implies more data is being collected and processed, not just by the government and telecom companies, but also the numerous e-commerce companies and ride hailing apps present in Uganda.
Uganda’s government began its first ever mass enrollment for government-issued national identity cards in 2014. In 2017, the Uganda Communications Commission and Uganda Police issued a mandatory requirement for all persons in the country to re-register their SIM-cards using national identity cards. This re-registration implied sharing the personal data of millions of citizens between telecom companies and the government, which raised concern among citizens: .
Hope telecom companies are not breaching Uganda's Data Protection and Privacy Act 2019 by sharing our data to <PERSON> & her COVID-19 Task Force.@mtnug @Airtel_Ug @africellUG @SmileComsUG @K2Uganda…this is a national concern over legal protections of Ugandans’ electronic data. pic.twitter.com/giZvRNSUHc
— #FreeBobiWine 🇺🇬🇺🇸 (@HillaryTaylorVI) June 22, 2021
Conversely, the government’s recent questionable decision to install digital trackers on all vehicles, and concerns about surveillance of political opponents demonstrate that it may not be trusted to comply with privacy and data protection laws, as some netizens point out:
Uganda's increased State surveillance is always deployed onto those with opposing views. <PERSON> promising digital trackers for all cars and motorbikes is a scary policy proposal and should be challenged in court. 665