Advocating for Ugandans to be protected by the highest data protection safeguards

At the core of data protection debates, there is a power play between empowering individuals to control their data and empowering those who use (or want to) use their data. By regulating data processing, it provides avenues for individuals to exercise their rights if there is any unlawful interference in this power play.

It is crucial for any regulatory framework to be centred around the protection of human rights, autonomy and dignity, and therefore essential to ensure that legislative processes leading to the adoption of a data protection framework are open, inclusive and transparent.

This is particularly important given that, in Uganda, like in many other countries across the world, individuals are being increasingly embedded, by design — not by choice — into ever-more data-intensive systems. In Uganda these have taken the form of compulsory enrolment in a mass identification system, mandatory SIM card registration, and the large-scale monitoring of citizens in public spaces as a result of the deployment of CCTV systems. To find out more about how these are being deployed in  Uganda, we invite you to refer to our joint collaborative analysis, ‘the State of Privacy in Uganda’ (last updated in January 2018).

Civil society across the world has been engaging in legislative processes in order to ensure that comprehensive robust data protection laws are adopted and that they provide for the highest data protection standards and principles. If there is no regulation, or if it is weak, inefficient or abused, personal data turns into yet another mechanism for those in power to exert and retain control of our data, and ultimately many aspects of our lives, which is compounded by the deployment of data-intensive systems.

Unwanted Witness and Privacy International have been engaging in the legislative process to adopt a data protection law in Uganda, initiated in 2014 when the National Information Technology Authority (NITA), the Ministry of Information and Communication and Technology (MoICT) and the Ministry of Justice and Constitutional Affairs (MoJCA) issued a draft Data Protection and Privacy Bill for public comment. We welcomed the effort by the Government of Uganda to give life to and specify the right to privacy, already enshrined in Article 27 of the Constitution of Uganda, to deal with modern technologies and data processing.  Unwanted Witness and Privacy International provided feedback on the draft bill highlighting a number of significant shortcomings and submitted various recommendations to ensure that the law would provide for the effective protection of privacy and would comply with international data protection standards and principles.

Following the consultation, the Data Protection and Privacy Bill, 2015 was published by the government in November 2015 and the Bill was tabled before Parliament in April 2016. The legislative process was interrupted first by the 2016 presidential elections and then by the temporary dissolution of the ICT Ministry, responsible for the legislative process of the Bill, in 2017.

The legislative process was finally opened for public consultation once again in February 2018, and Unwanted Witness and Privacy International presented their updated analysis of the bill. Whilst certain areas of the bill were improved from the 2014 draft, the bill tabled before Parliament still fell short of providing effectively protecting the data of those in Uganda.

In our joint analysis, we outline some of those main shortcomings which include, amongst many others:

1. the need to clarify the scope of the Bill both in terms of who it applies to but also its extra-territorial application,
2. to refine various definitions provided for in order to avoid misinterpretations of the Bill,
3. to review the Bill to ensure it presents clear and coherent data protection principles,
4. to clarify conditions for processing and ensure adequate safeguards are in place, and to limit exemptions to these,
5. to ensure the Bill upholds the rights of individuals, as well as
6. to provide for independent oversight and
7. access to effective remedies.

We invite you to read our submission which elaborates on these and areas of concern and improvements under each Part of the Bill.

Privacy International looks forward to engaging, in collaboration with Unwanted Witness, in the next steps of this legislative process and calls on any other parties, in particular civil society organisations, to directly engage with the ICT Ministry to share your concerns and recommendations. This is an important opportunity for those advocating for the respect and promotion of fundamental rights across disciplines to reflect on how their work could be advanced as a result of the adoption of a new regulatory framework to protect the processing of personal data which will ensure that processors, both public and private entities alike, are compelled to be transparent, are subject to checks and balances, and respect the rule of law.

We remain available to provide interested parties with further expertise to ensure that Uganda adopts a robust, comprehensive data protection law which will ensure its citizens will be able to enjoy their right to privacy and their data will be subject to the highest safeguards.