Why Par­lia­ment should pass the Data Pro­tec­tion and Pri­vacy bill 2015 to end dig­i­tal ex­ploita­tion

By: Godfrey Mwesigye

The dig­i­tal era, which has swept across the whole world, is upon us as is ev­i­dent in the num­bers of peo­ple who have switched from ana­log to dig­i­tal.

Ugan­dans, es­pe­cially the youth, have in­cred­i­bly em­braced the scrolling of elec­tronic pages on their smart-phones, tablets, and other elec­tronic gad­gets. This dis­pen­sa­tion has lured the older gen­er­a­tion too with a size­able num­ber of this de­mo­graphic go­ing dig­i­tal.

We have in­te­grated so­cial me­dia plat­forms into our day-to-day com­mu­ni­ca­tions and in­ter­ac­tions us­ing What­sApp, Twit­ter, Face­book, In­sta­gram, and more to share per­sonal in­for­ma­tion and data.

Be­cause of this, there are un­prece­dented vol­umes of per­sonal data that are shared across these plat­forms, and with tele­com com­pa­nies, banks as well as gov­ern­ment. How­ever, the ques­tions we do not pause to ask are; who is in con­trol of our in­for­ma­tion? Who can ac­cess it or how dan­ger­ous can it be if our pri­vate data falls into wrong hands?

The safety of per­sonal data and pri­vacy has in­creas­ingly come un­der threat. For in­stance, one of the most trend­ing con­cerns on so­cial me­dia is the leak­age of nudes and re­venge porn. Many of the per­pe­tra­tors go un­pun­ished yet vic­tims are left dev­as­tated.

In Sep­tem­ber last year, Ac­tion Aid In­ter­na­tional of­fices in Uganda were stormed by uniden­ti­fied se­cu­rity agen­cies, searched and some of their pri­vate in­for­ma­tion on their data­bases was ac­cessed. Most re­cently, in March this year, the Uganda Rev­enue Au­thor­ity asked the com­mer­cial banks in Uganda to send all the fi­nan­cial records they hold on all Ugan­da’s banked pop­u­la­tion. How­ever, com­mer­cial banks un­der their um­brella body Uganda Bankers As­so­ci­a­tion de­fied this or­der.

This brings us to the crit­i­cal de­bate on per­sonal data, com­mu­ni­ca­tion, and the right pri­vacy.

Where is the prob­lem?

Cur­rently, Uganda does not have a com­pre­hen­sive pol­icy on data pro­tec­tion and pri­vacy. This leaves many; es­pe­cially in­ter­net users, vul­ner­a­ble. Some po­ten­tially could end up be­ing ar­rested and pros­e­cuted in Courts of Law.

The ex­ist­ing laws in the coun­try are too weak to pro­tect the cit­i­zens who use the in­ter­net and other forms of elec­tronic data. Whereas, Ar­ti­cle 27(2) of Ugan­da’s Con­sti­tu­tion pro­vides that no per­son shall be sub­jected to the in­ter­fer­ence of the pri­vacy of per­sons home, cor­re­spon­dence or com­mu­ni­ca­tion, the coun­try has no com­pre­hen­sive law to safe­guard per­sonal data.

There is a lot of room for ex­ploita­tion of the right to pri­vacy in the ab­sence of proper reg­u­la­tions on how per­sonal in­for­ma­tion is col­lected, processed or utilised in an ap­pro­pri­ate way which re­spects the rights and the dig­nity of the sub­ject from which the data is col­lected. Worse still, some of the laws on the books, like the Reg­u­la­tion of In­ter­cep­tion of Com­mu­ni­ca­tions Act (RICA) 2010 which pro­vided for in­ter­cep­tion of com­mu­ni­ca­tions, can eas­ily be used by the state to cur­tail peo­ple’s right to pri­vacy.

Over the last few years, there have been in­creased con­cerns of sur­veil­lance on po­lit­i­cal dis­si­dents, jour­nal­ists, and the hu­man right de­fend­ers with­out their con­sent and un­der no clear reg­u­la­tions.

The weak­nesses in the ex­ist­ing le­gal frame­work con­cern­ing data and pri­vacy prompted the tabling of the Data Pro­tec­tion and Pri­vacy bill 2015 in Par­lia­ment, which in­tends to pro­tect per­sonal data and the right to pri­vacy through its pro­vi­sions.

Sec­tion 4 (1) of the Bill, pro­vides that be­fore any­one ac­cesses per­sonal in­for­ma­tion, the sub­ject from whom data is col­lected must con­sent and Sec­tion 6 stip­u­lates that a data col­lec­tor, data proces­sor, data con­troller shall col­lect or process data in a man­ner which does not in­fringe the pri­vacy of the per­son to whom the data re­lates.

Even in cases in­volv­ing na­tional se­cu­rity, where per­sonal in­for­ma­tion may be needed for in­ves­ti­ga­tions and pros­e­cu­tions, those in au­thor­ity can ac­cess the per­sonal in­for­ma­tion as pro­vided for in Sec­tion 7 sub­sec­tion (2)(e)(i) of the Bill.

Also im­por­tant to note is that Sec­tion 3 (c) of the bill pro­vides that a data col­lec­tor shall col­lect ad­e­quate and rel­e­vant data but pro­hibits the col­lec­tion of ex­ces­sive and un­nec­es­sary data. How­ever, how to mea­sure that some­one is col­lect­ing ad­e­quate, rel­e­vant and not ex­ces­sive or un­nec­es­sary per­sonal data may be chal­leng­ing.

Nev­er­the­less, the data col­lec­tor or proces­sor should han­dle it in a way that does not cause any harm to the sub­ject from whom it is col­lected. For ex­cep­tions such as col­lect­ing per­sonal data in or­der to en­sure na­tional se­cu­rity, I strongly agree that this should be han­dled still within the lim­its of the law. For in­stance, there should be a court or­der call­ing for that and the data should serve only that pur­pose for which it is col­lected.

In my opin­ion, if the bill is passed, it will cre­ate har­mony where per­sonal in­for­ma­tion is pro­tected and it can only be ac­cessed as stip­u­lated un­der the law.

Way to go

It’s my hum­ble plea that Par­lia­ment passes the Data Pro­tec­tion and Pri­vacy Bill, 2015, con­sid­er­ing the rate at which Ugan­dans are switch­ing to the use elec­tronic me­dia and trans­ac­tions, to en­sure the right to pri­vacy is pro­tected. The In­ter­na­tional Covenant on Civil and Po­lit­i­cal Rights cat­e­gorises pri­vacy as a fun­da­men­tal hu­man right, rat­i­fied by 167 coun­tries Uganda in­clu­sive.

This ar­ti­cle was first Pub­lished in the In­de­pen­dent Mag­a­zine