Unwanted Witness

A Global Standard for Data Protection Law

Our impact

Our campaign

Defending Democracy and Dissent

Enhancing Data Protection Standards

A win for Unwanted Witness: Uganda’s data protection authority finds ride sharing app unlawfully disclosed personal data to third parties

staff — Thu, 11 Mar 2021 17:35:02 +0000

Language English

Unwanted Witness’ research into Safeboda highlighted the company’s failure to comply with some of the law's core data protection principles, with a number of implications for the exercise of data subject rights. The enforcement action against Safeboda by National Information Technology Authority, Uganda (NITA-U) requires the company to make fundamental changes to how they handle people's personal data in order to comply with the Data Protection and Privacy Act, 2019.

This first landmark investigative report of NITA-U sets an important precedent to holding data controllers, both private and public entities, to account for their legal obligations under the Data Protection and Privacy Act, 2019.

Importantly, this development is also a true testament to the essential work being undertaken by civil society organisations to protect people and their data, utilising regulatory mechanisms to ensure existing safeguards are enforced.

Below is Unwanted Witness' statement welcoming the outcome of this investigative process and the decision of NITA-U. This statement was originally published on their website on 11 February 2021.

Unwanted Witness Uganda welcomes the first-ever data protection investigation report by the Ugandan data regulator, National Information Technology Authority, Uganda (NITA-U) into the operations of Guinness Transporters Limited, trading as SafeBoda. NITA-U has ordered SafeBoda to make fundamental reforms regarding sharing of people’s personal data with third parties.

SafeBoda has until the end of May 2021 to amend its privacy notices so that people can be provided with specific and informed consent, in particular, to clearly inform its customers of the third parties it may disclose their personal data to, in accordance with the principle of fairness under section 3(1)(b) of the Data Protection and Privacy Act, 2019. NITA-U further requires SafeBoda to specify safeguards in place for cross-border transfer of personal data.

The regulator’s report is a result of our early 2020 investigation into SafeBoda’s non-compliance with the Data Protection and Privacy Act, 2019. Our report revealed how the transportation app was sharing people’s personal data with third parties without the knowledge and consent of consumers, falling short of fundamental data protection principles.

NITA-U investigation found that SafeBoda’s Data Privacy Policy and Data Protection Policy versions of 2017 and 2019 respectively, were not transparent and failed to provide information on third-party recipients of users’ personal data. The investigation report concluded that this showed that SafeBoda did not address the non-compliance pointed out by Unwanted Witness in their report, and in order to be in compliance with the Data Protection and Privacy Act, 2019, their policy and practices needed to be amended.

The NITA-U report notes that “it was established that SafeBoda shared its users’ personal data with CleverTap – a data processor that offered Software as a Service for customer lifecycle management and mobile marketing” and “since ‘consents’ relied upon for the disclosure were not specific neither were they informed” as users were not informed about the extent of personal data collected nor the potential disclosure to third parties, NITA-U concluded that this amounted to personal data unlawfully being disclosed to a third party. The disclosure of its users’ personal data to CleverTap contravened Section 35 of the Data Protection and Privacy Act, 2019 – likely to affect millions of users.

Furthermore, in order to effectively apply its own policy and demonstrate compliance with its obligations and protections of the rights of individuals, in particular the rights to access and to an effective remedy, the report noted the need for SafeBoda to improve its process for access to information requests as well as its incident response and breach management.

Applications like SafeBoda heavily rely on collecting personal data for their operations, meaning that they must have clear policies and practices that meet required data protection standards and principles. The app must provide sufficient information to users to meet the principle of transparency, and provide the user with a choice to opt-out from their data being shared for marketing and analytics purposes.

NITA-U’s maiden data protection investigation report has thus made it clear that the consent relied on by SafeBoda to share customers’ data with third parties was invalid. SafeBoda and other data controllers shouldn’t bundle consent altogether for all purposes but ask users to provide consent in a granular and specific way. This helps users to know what they are consenting to and they are equally offered a choice to object to any processing operations that are not strictly necessary for the provision of the services.
The regulator’s report is a significant step towards restraining data exploitation and protecting personal data in Uganda. We will closely monitor SafeBoda’s implementation of all recommendations made by NITA-U.

Background.

In February 2019, Uganda passed the Data Protection and Privacy Act, regulating the processing of personal data.
Between June 2019 and 2020 Unwanted Witness conducted research assessing the compliance by SafeBoda to the data protection law, international standards, and principles of data protection.
In July 2020, UW released the report revealing concerns of personal data exploitation by SafeBoda, whose operations fail to comply with the Data Protection principles of transparency, lawfulness, fairness, purpose limitation, and data minimization.
Mid-July 2020, a petition was filed to the Speaker of Parliament against SafeBoda.
In August 2020, the Speaker ordered NITA-U through the ministry of ICT to conduct further investigations into concerns of unlawful data sharing.

Learn more

Data Protection

What Companies Do

Data Interception Environment

Location

Challenging Corporate Data Exploitation

Our fight

Safeguarding Peoples' Dignity

Target Stakeholders

Regulators and enforcement bodies

More about our partner

Building the Global Movement

Our impact

Our campaign

Protecting People

Targeting Companies

Date

Thursday, March 11, 2021

Open Letter to Facebook and Google

tech-admin — Thu, 28 Jan 2021 15:49:02 +0000

Target Profile

Google

Facebook

Audiences and Purpose

Influence key stakeholders

Change

We campaign for solutions

ryul-davidson-PcyrQsX5f4w-unsplash.jpg

Content

Advocacy

Summary

Privacy International is part of a 60+ coalition calling on Facebook and Google to provide equal and better transparency regarding political advertising on their platforms globally.

Media

Key points

We believe it is necessary for both Google and Facebook to:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

This letter is also available in Spanish.

Dear Mr. Zuckerberg and Mr. Pichai,

In the past few years, you have pioneered important transparency tools to help your platform users understand, learn about and contextualise the political advertising they see. We agree that advertiser verification processes and ad repositories are key safeguards against online manipulation and misinformation. However, we are saddened to observe that these benefits have not been equally distributed among your global user base.
Each platform operates fluctuating and often widely differing transparency standards for different countries. While some users benefit from seeing political advertising in an ad repository, others do not. Where some users are offered detailed information about a political ad, others are not. There are no legitimate or otherwise publicly disclosed reasons justifying this difference in treatment.
The combined effect of these inconsistent policies is to create a two-tiered user base within each platform, with a wide regulatory gap separating the transparency haves and have-nots. We first highlighted these problems in 2019. While some progress has been made since, we are disappointed to conclude that the transparency divide persists.
Online transparency should not be a privilege of the few, but the right of all. To that end, the changes we believe are necessary are as follows:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

Region of Operation

Africa

Website

Communications Surveillance

Our campaign

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

The role of social media and search platforms in political campaigning and elections has come under scrutiny. Concerns range from the spread of disinformation, to profiling of users without their knowledge, to micro-targeting of users with tailored messages, to interference by foreign entities, and more. Significant attention has been paid to the transparency of political ads, and more broadly to the transparency of online ads.

Notably, in the lead up to the 2019 EU Parliamentary elections Facebook, Google, and Twitter, as well as the Interactive Advertising Bureau and others, agreed to take a series of steps to prevent online disinformation on their respective platforms. These measures are reflected in a self-regulatory Code of Practice on Disinformation and the companies provided the European Commission with monthly updates on their progress.

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

Learn more

Democratic engagement is increasingly mediated by digital technology, from campaigning to election results transmission. These technologies rely on collecting, storing, and analysing personal information to operate. They raise novel issues and challenges for all electoral stakeholders on how to protect our data from exploitation.

Huawei infiltration in Uganda

caitlinb — Thu, 25 Jun 2020 10:47:45 +0000

Huawei infiltration in Uganda caitlinb Thursday, June 25, 2020

The Ugandan government has a running contract with the Chinese tech giant, Huawei, to supply and install CCTV cameras along major highways within the capital, Kampala, and other cities.

While details of the contract remain concealed from the public, the Uganda Police Force (UPF) released a statement, simply confirming its existing business partnership for telecommunication and surveillance hardware, and software between the security force and Huawei. However, it is not clear whether the selection of Huawei followed legal procurement procedures. Nor is it clear how much Huawei gets out of the partnership – or how much data they will retain.

The installation of CCTV cameras in Kampala started in July 2019 after President Yoweri Museveni directed a kick off of the project following the murder of the Assistant Inspector General of Police, Felix Kaweesi in 2017.

Unfortunately, the procurement and use of the cameras is shielded from public scrutiny, which could potentially result in human rights violations. For instance, last year the Wall Street Journal reported how Huawei technicians had secretly helped security personnel to spy on political opponents. And there are other reports of police being spotted trading in personal data collected by the cameras to criminals.

Huawei is reportedly providing CCTV equipment and installation in phases. The first phase was concluded late last year and the National CCTV system was commissioned by President Museveni. The system is located at the police headquarters in Naguru, equipped with 83 monitoring centres, 522 operators and 50 commanders.

The Inspector General of Police, Martin Ochola informed Museveni during the launch of the Command center that the police plan to integrate their CCTV camera and forensic system with other key agencies' data such as Uganda Revenue Authority (URA), NITA-U, National Identification Registration Authority (NIRA) and immigration office.

In the second phase, which started rolling out early this year, 20 facial recognition cameras are expected to be installed and connected to 107 monitoring centers at different police stations within 2,319 mapped countryside municipalities and major towns.

However, key concerns around transparency and accountability of both resources and personal data remain unanswered. Unwanted Witness continues to demand the observance of international human rights law in the deployment of surveillance to safeguard human rights, freedoms and democracy in Uganda.

Learn more

Our fight

Expose Public-Private surveillance partnerships

Location

More about our partner

Generalised audience problem articulation

Our campaign

Unmasking Policing, Inc.

More about this Adversary

Huawei

Government

Audiences and Purpose

Feeding our followers

Informing the concerned

Change

drew-willson-DigT_twYyiU-unsplash.jpg

Content

Impact

News and Analysis

Stories

Media

Summary

Unwanted Witness, our partner organisation based in Uganda, explore critical questions around Huawei's surveillance dealings with the Ugandan government raise. While Huawei's relationship with the government raises concerns for human rights, many of these concerns remain unaddressed.

Key findings

The Uganda government has a contract with Huawei to supply and install surveillance equipment in cities throughout Uganda
Details about the contract remain secret - and it's not clear whether the procurement was legal or how much Huawei will get out of the project
There could be significant human rights implications to the project, Huawei technicians have, reportedly, already helped security personal spy on political opponents
Police plan on integrating these systems with other key agencies, including the revenue office, identification authority, and immigration office

Unwanted Witness - Government of Uganda must respect human rights in the use of Surveillance technologies to fight Coronavirus

staff — Wed, 20 May 2020 11:05:25 +0000

Unwanted Witness - Government of Uganda must respect human rights in the use of Surveillance technologies to fight Coronavirus staff Wednesday, May 20, 2020

Our partners from Unwanted Witness in Uganda wrote a formal letter to the Ministry of Information Communications Technology and National Guidance demanding for strict observance of human rights for any intended use of surveillance technologies to fight COVID-19.

In a letter addressed to the Permanent Secretary Ministry of ICT, Hon. Vincent Bagiire and copied to Minister Judith Nabakooba, calls on government to respect its human rights obligation and restrain from exercising excessive surveillance powers that is neither lawful, necessary nor proportionate in responding to the current health crisis.

Link: https://www.unwantedwitness.org/government-of-uganda-must-respect-human-rights-in-the-use-of-surveillance-technologies-to-fight-coronavirus-says-unwanted-witness-uganda/

Location

More about our partner

Tracking the Global Response to COVID-19

See more examples

Apps and Covid-19

Civil society's Covid response

Date

Wednesday, April 22, 2020

Content

Educational

Stories

One Year On, what has Uganda’s Data Protection Law Changed?

tech-admin — Tue, 03 Mar 2020 11:44:53 +0000

Language English

This piece was originally published by Unwanted Witness here.

Today marks exactly one year since Uganda passed its data protection law, becoming the first East African country to recognize privacy as a fundamental human right, as enshrined in Art 27 of the 1995 Uganda Constitution as well as in regional and International laws.

The Data Protection and Privacy Act, 2019 aims to protect individuals and their personal data by regulating processing of personal information by state and non-state actors, within and outside Uganda.

The law expands the rights of individuals to control how their personal data is collected and processed, placing a range of obligations on those processing, which includes both public bodies and companies, personal data to be more accountable for data protection. It further regulates and limits the processing of special categories of personal data, including tribe, religion and health, amongst others.

But, for all these achievements, what has the law actually changed?

Unregulated data processing still on-going and augmenting

So far, the existence of Uganda’s data protection law has not in any resulted in state or non-state actors taking measures to change their policies and practices as per the obligations under the Act.

Incredible amounts of personal data, including sensitive personal data continues to be collected by both government and companies in a manner which disregards the standards set by the data protection law.

What we are actually observing is that the government has intensified their mandatory collection of sensitive personal data as seen with the National ID system, as well as different government agencies like the Uganda Police Force already unveiling plans to integrate CCTV forensic systems with National ID data and immigration.

Furthermore, a centralized local data Centre for all government agencies and departments was built with the aim of increasing efficiency and effectiveness of government. Through the system, different government agencies and departments share information about citizens without their knowledge. By failing to respect the principles and obligations provided for in the law to regulate such processing, it is negating personal data safeguarding.

Section 10 of the Data Protection and Privacy Act, 2019 prohibits the collection and processing of personal data in manner that infringes on the privacy of a data subject. It is therefore essential to review the deployment of such a data centre which will include amongst other changes limiting the purpose for which a database is built and used.

Similarly, the trend of collecting personal data has increased among companies particularly telecommunication service providers countrywide.

The 2018 report by Unwanted Witness pointed to weak policies and terms of reference, of telecommunication providers which were compromising costumers’ communication privacy and personal data, but even with the data protection law in place, we have not seen companies reviewing their policies and practices to ensure that they meet the standards and obligations provided by the Act.

Meanwhile the telecommunication providers continue to collect biometric and bio-data as a requirement for SIM card registration, which has been reported to result into repeated identity theft scandals.

The Absence of regulations

The failure to effectively Implement the new law has been the biggest impediment over the past year. This in turn continues to expose millions of citizens to data exploitation.

The Ministry of Information Communications Technology and National Guidance has the mandate to formulate regulations to provide for the accountability and enforcement mechanisms of the data protection law. The Data Protection Office, who should be in charge of the overall implementation of the law, providing for administrative, civil or criminal sanctions and penalties among others, has yet to be established.

Throughout the year Unwanted Witness has continuously reminded the ministry of its obligation to expeditiously formulate enforceable regulations to ensure that the law effectively protects people and their personal data.

The prolonged and unnecessary delays in formulating regulations for effective implementation of Uganda’s data protection law, is not only a continuous threat to citizens’ right to privacy and dignity but compromises the country’s trade relations and investors’ confidence.

Unauthorized processing of personal data can lead to grave violation of human rights, therefore a data protection law becomes critical in safeguarding fundamental rights and freedom of persons.

Involvement of different stakeholders through an open and transparent process of drafting regulations is key to ensuring an effective implementation of the law.

What we expect next

As we mark the first anniversary of the Data Protection Act, we take the opportunity to call on the government to take active measures to effectively implement the law to ensure that it complies with its national and international obligations to protect people, their privacy and their data.

To keep up to date with the work by Unwanted Witness, follow them: http://www.unwantedwitness.org/

Find out more about Privacy International's work with Unwanted in Uganda here

Location

Safeguarding Peoples' Dignity

Our fight

Target Stakeholders

Government

More about our partner

A Global Standard for Data Protection Law

Our impact

Building the Global Movement

Our campaign

Targeting Governments

Protecting People

Targeting Companies

Date

Tuesday, February 25, 2020

An open letter to Google

tech-admin — Wed, 08 Jan 2020 15:19:16 +0000

Target Profile

Google

Audiences and Purpose

Influence key stakeholders

Change

We campaign for solutions

Pi-Android-mock-up-3-1-photo correct.png

Content

Advocacy

Summary

Privacy International and over 50 other organisations have submitted a letter to Alphabet Inc. CEO Sundar Pichai asking Google to take action against exploitative pre-installed software on Android devices.

Media

Key points

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

Note: This letter is also available in French and Spanish

Dear Mr. Pichai,

We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.

And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.

These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store.

These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.

We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.

The changes we believe are needed most urgently are as follows:

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.

We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

Yours sincerely,

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Latin America

Website

Asociación por los Derechos Civiles

Coding Rights

Coding Rights is a Brazilian-based think tank that aims to advance the enforcement of human rights in the digital world. Its goal is to ensure that policy-making affecting technological development and digital rights is informed by actual technological knowledge, and that technological development is guided by fundamental human rights.

Country of Operation

Brazil

Region of Operation

Latin America

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Asia

Website

DRF

Foundation for Media Alternatives

The Foundation for Media Alternatives (FMA) is a non-profit service institution that supports citizens and communities—in particular civil society organisations and other development stakeholders—in their strategic use of Information and Communication Technologies (ICTs). It was founded in 1987 and is based in Manila.

Country of Operation

Region of Operation

Africa

Website

Influence key stakeholders

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

When you buy a brand new lower cost phone (like a Tecno Y2 or MYA 2 for example), it's likely to come pre-installed with insecure apps and an outdated operating system. What this means is that your or your loved ones could be left vulnerable to security risks or to having their data exploited.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Lettre ouverte à Google

tech-admin — Tue, 07 Jan 2020 15:23:23 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

Pi-Android-mock-up-1-1-photo.png

Content

Advocacy

Summary

Privacy International et plus de 50 autres organisations ont soumis une lettre au PDG d'Alphabet Inc., Sundar Pichai, demandant à Google de prendre des mesures contre les logiciels préinstallés sur les appareils Android qui exploitent les données des utilisateurs.

Media

Key points

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Vous pouvez trouver la lettre ci-dessous. Ajoutez votre voix à cette campagne en signant notre pétition si vous pensez qu'il est temps que Google cesse d'activer l'exploitation.

Ce contenu est également disponible en anglais et en espagnol.

Cher M. Pichai,

Nous, les organisations signataires, sommes d’accord avec vous :
la vie privée n’est pas un luxe, offert seulement à ceux qui en ont les moyens.

Pourtant, les « Android Partners » – qui utilisent la marque déposée Android – fabriquent des téléphones avec des applications préinstallées qui ne peuvent pas être supprimées (connues sous le nom de bloatware). Ces applis rendent les utilisateurs très vulnérables : leurs données sont collectées, partagées et exposées sans leur consentement ou même sans qu’ils en aient conscience.

Ces téléphones portent le label « Google Play Protect » alors qu’une étude montre que 91 % des applis préinstallées ne sont pas proposées sur Google Play – Google App Store.

Ces applis préinstallées peuvent avoir certaines autorisations du fabricant qui les laissent fonctionner en-dehors du système de sécurité Android. Ces autorisations, définies par l’appli elle-même (incluant l’accès au microphone, à la caméra et à la géolocalisation), ne déclenchent aucune notification d’alerte de sécurité d’Android. Les utilisateurs n’ont absolument pas connaissance de ces intrusions majeures.

Nous sommes préoccupés par le fait que les utilisateurs de téléphones bon marché sont livrés à ces pratiques commerciales inquiétantes dans le monde.

Les changements que nous demandons en urgence sont les suivants :

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Nous, les signataires, pensons que ces changements justes et raisonnables auraient un impact considérable pour des millions de personnes dans le monde, qui ne devraient pas avoir à renoncer à leur vie privée et à leur sécurité en achetant un smartphone.

Nous vous demandons, puisque vous êtes un acteur influent du système, de mieux protéger les personnes et d’empêcher les fabricants de les utiliser abusivement, dans cette course effrénée aux bas prix des smartphones.

Je vous prie d'agréer, Monsieur, l'expression de nos sentiments distingués.

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

Country of Operation

Region of Operation

Africa

Website

Social Media Surveillance

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Data Privacy Week: Confronting the Corporate Gaze

staff — Tue, 29 Jan 2019 08:47:26 +0000

Data Privacy Week: Confronting the Corporate Gaze staff Tuesday, January 29, 2019

The Privacy International Network is celebrating Data Privacy Week, where we’ll be talking about how trends in surveillance and data exploitation are increasingly affecting our right to privacy. Join the conversation on Twitter using #dataprivacyweek.

It is no mystery that data exploitation is part of most consumer-oriented tech companies’ business models. A big part of our lives is recorded and exploited, from our web searches, to our personal communications, location, and our shopping habits, just to name a few data points, to generate even more data about us, through the observation of the data trail we leave behind.

Our lives are then not only under the scrutiny of governments and their (mass) surveillance activities, but also under the eyes of corporations looking to extract value from our data and interactions. All of this is happening at a global scale, and in many cases with little or non-existent safeguards.

The Privacy International Network is working to expose companies that fail to protect their customers’ data, analysing their terms of service and practices, exploring how users perceive social media platforms, and studying how these platforms are being leveraged for intelligence purposes.

Telecommunications: How do they (not) defend our data?

How transparent are telecommunication companies about their collaboration with law enforcement agencies? Red en Defensa de los Derechos Digitales (R3D) posed that question in their report “Who does not defend your data” (available in Spanish). It examines a new federal telecommunications law in Mexico that imposed obligations for telecommunications companies to collaborate with law enforcement agencies, many of them poorly drafted and undermining the right to privacy.

In Uganda, Unwanted Witness had a similar question. They researched the existing legal framework on telecommunications and privacy to explore how companies were protecting their customers’ data. Their subsequent report is pretty self-explanatory: Your Communication and Personal Data is not Safe Anymore, and highlights the lack of regulation to protect the rights of the users of telecom companies and Internet Service Providers, which is compounded by the absence of data protection legislation.

(In)visible followers: Social and state surveillance enabled by social media

Our relationship with social media is becoming increasingly complex: while providing new audiences to promote our messages and defend our causes, it also enables unprecedented levels of surveillance of our actions.

7iber focused their attention on that tension, investigating why people in Jordan are increasingly migrating from Facebook to Twitter (available in Arabic). Their research found that, among other factors, users' perception of social surveillance from their families on Facebook had triggered that decision.

Meanwhile, the Argentina-based Asociación por los Derechos Civiles researched the use of open source intelligence in their report “Followers we don’t see” (available in Spanish). They analysed the government's monitoring of social media to investigate crimes, and detailed how this ‘cyber patrolling’ had eroded the right to privacy and freedom of expression, creating a chilling effect for social media users.

In some cases the scale of the surveillance is bigger. In a report launched this week, 7amleh, a partner organisation from Palestine, describes how the Israeli government restricts key telecommunications infrastructure in Palestine, including access to frequencies and key network equipment. This control of key infrastructure facilitates violations of Palestinians’ right to privacy and freedom of expression.

Digital platforms: How accountable are they?

Finally, there is the question of the accountability of digital platforms. Two members of the PI Network have studied this issue: Dejusticia, in Colombia, researched the accountability of Google and other big Internet companies, while Digital Rights Foundation (DRF) prepared a report about ride-sharing apps in Pakistan.

After analysing privacy policies from more than 30 companies with business models based on data exploitation, Dejusticia found that their practices were not properly addressed by the current personal data framework (available in Spanish). Moreover, they concluded that many of these practices, like user profiling, need to be further addressed by legislative and regulatory reform.

In Pakistan, DRF prepared a detailed study on the practices of Uber and Careem in the country, highlighting the need for better complaints mechanisms and security procedures, which are particularly necessary from a gender perspective and the specific impacts that such policies have over women. They also found that both companies’ privacy policies lack basic guarantees such as data breach disclosures and contain unspecified data sharing provisions, among other flaws.

Countering the hidden data ecosystem

Alongside the work of its partners, Privacy International has been active in countering corporate exploitation. Last year, we presented a complaint against seven companies for wide-scale and systematic infringements of data protection law.

We also launched a report outlining how how apps on Android share data with Facebook, finding that at least 61 percent of the apps that were tested automatically transfer data to Facebook the moment a user opens the app, regardless of whether people have a Facebook account or not.

The fight to confront and counter the corporate gaze is only beginning, and we will keep working with the Network to expose and push back against exploitative practices that impact our privacy, freedom, and autonomy.

Learn more

Data Protection

What PI is fighting for

Expose Data Exploitation: Data, Profiling, and Decision Making

Our fight

Safeguarding Peoples' Dignity

Location

Jordan

Palestine

Mexico

More about our partner

Dejusticia

Digital Rights Foundation

La Asociación por los Derechos Civiles

Red en Defensa de los Derechos Digitales

Our campaign

Our data is not for trade

When Big Brother Pays Your Benefits

When Social Media makes you a target

Content

News and Analysis

Reports

State of Privacy Uganda

tech-admin — Sat, 26 Jan 2019 15:57:59 +0000

State of Privacy Uganda tech-admin Saturday, January 26, 2019

Introduction
Right to Privacy
Communication Surveillance
Data Protection
Identification Schemes
Policies and Sectoral Initiatives

Introduction

Acknowledgement

The State of Privacy in Uganda is the result of an ongoing collaboration by Privacy International and Unwanted Witness.

Key privacy facts

1. Constitutional privacy protection: The constitution contains an explicit protection of the right to privacy (Art. 27).

2. Data protection law: There is no specific law or regulation that regulates data protection. The draft 2015 Data Protection Bill has been passed by parliament, but is not yet law.

3. Data protection agency: Uganda has no specific body mandated to enforce and oversee data protection.

4. Recent scandals: The security services have been linked to targeted campaigns of extrajudicial surveillance against domestic opponents.

5. ID regime: The 2015 Registration of Persons Act harmonizes existing laws on the registration of persons and establishes a single central registration body and a mandatory national identification register for all Ugandans.

Right to Privacy

The constitution

The 1995 Ugandan constitution explicitly recognises the right to privacy and calls for its protection. Article 27 states that "(1) No person shall be subjected to—

(a) unlawful search of the person, home or other property of that person; or

(b) unlawful entry by others of the premises of that person.

(2) No person shall be subjected to interference with the privacy of that person's home, correspondence, communication or other property."

Regional and international conventions

Uganda is a signatory of several international conventions with privacy provisions, including:

Communication Surveillance

Introduction

In March 2017, Uganda had 23.5 million mobile telecommunications subscribers, representing a teledensity of 63.8 %, according to statistics collected by the Uganda Communications Commission (UCC). There were 14.8 million mobile internet subscriptions, 153,150 fixed internet subscriptions and an estimated 20.3 million internet users.

The government does not collect official statistics on social media use, though several platforms including Facebook and Twitter are widely popular among Ugandans. In 2013, the National Information Technology Authority (NITA) issued guidelines to government departments to encourage and regulate the use of social media as a communication tool by government bodies.

Surveillance laws

Communications surveillance is primarily regulated by the Regulation of Interception of Communications Act (RICA) 2010. Other acts also grant the security services wide-ranging communications surveillance powers.

RICA requires intelligence officials and the Police to seek judicial authorisation for the interception of communications. The law authorises intelligence officials to apply to intercept specific communications subject to a warrant that is issued by a designated judge. However, RICA does not replace the provisions for interception contained in the Anti-Terrorism Act (2002) – it appears to contradict them. This law gives almost unfettered discretion for state officials to conduct surveillance without the need to obtain judicial authorisation. The powers of surveillance are broad. These include the interception of phone calls, emails or other communications, ‘electronic surveillance’, as well as monitoring of meetings, or doing “any other thing reasonably necessary” for the purpose of surveillance (Article 19(5)). The justifications of such surveillance are very broad, including safeguarding public interest, and protecting the national economy from terrorism (Article 19(4)).

There is no clear oversight mechanism to either RICA or the Anti-Terrorism Act.

Section 11 of RICA requires service providers to retain metadata, although the terms and conditions of the retention are not specified in the Act.

The Act also provides for the establishment of a Monitoring Centre under the control of the Minister – the “sole facility through which authorised interceptions shall be effected” (Section 3). As of late 2015, the monitoring centre was not operational though seven international firms were invited to bid for the project. It had been delayed in part because service providers have contested Government orders that they pay to connect to the future system, according to sources in the technology industry. However, Israeli firm NICE Systems is reported to have won the contract, according to Intelligence Online.

RICA requires service providers to foot the bill of connecting to the new centre or otherwise complying with the Act, a considerable cost. Current data retention capacity of the main networks including MTN Uganda was estimated at around 6 months' worth of call metadata in 2015.

Surveillance actors

The power to gather intelligence and conduct surveillance are concentrated around three institutions: the Uganda People’s Defence Force (UPDF), the Uganda Police Force (UPF), and the Office of the President (State House). The President exercises control over sensitive intelligence operations while day-to-day spying for intelligence gathering appears less centralised. Senior leaders and technical experts within intelligence circles are often reshuffled and reassigned among these agencies on Presidential direction.

Intelligence and security agencies

The 1987 Security Organisations Act established the Internal Security Organisation (ISO) and External Security Organisation (ESO). These two agencies are directed by Directors General appointed by and accountable to the President, and exist to collect intelligence and provide advice on Uganda’s security directly to him.

The National Security Council, established in 2000, reports directly to the President and comprises cabinet ministers, ISO, ESO, army and police officials, most of which are appointed by the President and up to five additional members, also appointed by the President and approved by Parliament. The Joint Intelligence Committee, composed of security experts appointed by the President and chaired by the Minister of Internal Affairs, reportedly meets once a week to share intelligence on national security threats. An Information and Communication Technologies (ICT) Technical Committee within the Joint Intelligence Committee advises on technology purchases and is responsible for many decisions related to defence and intelligence procurement. These powers are discussed in more detail in a report by Privacy International.

Law enforcement agencies

The 2004 Police Act gives the President the power to appoint the Inspector General of Police and his deputy, as well as the majority of the members of the Police authority which oversees police functions, and veto power over any potential dismissals of senior-ranking officials. As Commander-in-Chief of the defence forces, the President may appoint the Chief of Defence Forces and virtually all high-ranking officials. The President enjoys discretionary powers over the activities of the High Command.

Surveillance capabilities

The Regulation of Interception of Communications Act (2010) provides for the establishment of a monitoring centre. In late 2015, the monitoring centre was not operational though seven international firms had been invited to bid for the project. These seven firms included: ZTE and Huawei (China), Verint Systems Ltd and NICE Systems (Israel), Macro System (Poland), RESI Group (Italy) and Gamma Group International (UK). The monitoring centre project had been delayed in part because service providers contested government orders that they pay to connect to the future system, according to sources in the technology industry. NICE Systems was reported to have obtained the monitoring centre contract in November 2015. It is unknown if the monitoring centre is operational.

In recent years the security services have invested heavily in cyber defence. In 2013, a new forensic lab for the analysis of computer crime opened in Kampala and the UCC launched a Computer Emergency Response Team to investigate cybercrime. Despite these developments, the police’s ability to actually conduct forensic analysis on devices and trace cybercrimes is rudimentary. The police and investigating agencies often turn to private forensic companies to assist in complex investigations, according to an October 2015 investigation by Privacy International.

In 2014, the UCC opened a media monitoring centre with “digital logger surveillance equipment”. This appears to be targeted at recording and analysing public radio, television and print media rather than private communications. The police also signed an accord with the UCC to cooperate more closely on the investigation of cybercrime.

In August 2016, the government announced that it had contracted a South Korean company to supply a "pornography detection machine" with the budget of 2.6 billion Uganda shillings. The purchase was intended to aid the Parliament's anti-pornography committee to monitor and implement Uganda's anti-pornography laws by detecting pornographic pictures, videos or graphics taken or saved on individual phones, computers or cameras.

Surveillance oversight, checks and balances

We are not aware of any oversight mechanisms related to surveillance in Uganda. Please send any tips or information to: research@privacyinternational.org

Surveillance case law

We are not aware of any surveillance case law in Uganda. Please send any tips or information to: research@privacyinternational.org

Examples of surveillance

State authorities have proactively cultivated the popular perception that surveillance is systematic, centralised and technically sophisticated. This is not the case; not yet, at least. Nevertheless, human rights defenders and activist groups are regularly targeted for physical surveillance and break-ins and seizure of digital material by the police are common.

According to a Privacy International investigation in 2015, the attributes that have made Uganda’s human intelligence network strong and allowed it to infiltrate opposition and other circles considered threatening to the government are poorly suited to conducting communications surveillance on a large and automated scale. Poor levels of technical training, low pay and a culture of bribe-taking has alienated the few educated and technically competent engineers that would be required to operate a nationwide surveillance system beyond monitoring a relatively small number of high-value targets, according to industry and government sources.

The government has also reportedly placed agents within the telecommunications switching centres, but their skills vary and assignments appear to be relatively simple – for example, the generation of call and contact lists, the location of callers using cell tower data, and audio recordings of specific lines based on human intelligence.

In late 2011, officials of the Chieftaincy of Military Intelligence (CMI) and Uganda Police Force (UPF), acting on presidential orders, used an intrusion malware, short for malicious software, to infect the communications devices of key opposition leaders, media and establishment insiders. The secret operation was codenamed Fungua Macho (‘open your eyes’ in Swahili), according to documents acquired by Privacy International. The tool chosen as the ‘backbone’ of the operation, FinFisher, is intrusion malware that was at the time manufactured by the Gamma Group of companies, headquartered in the UK.

The police also attempted to procure further technologies from intrusion malware supplier and rival to Gamma Group, Hacking Team, in mid-2015. The local contact for the Hacking Team potential deal was Kin Kariisa, a business executive considered among Museveni’s close contacts, according to documentation obtained by Privacy International. Kariisa was the President’s special advisor on ICT from 2000 to 2009.

Earlier, in April 2014 after the Anti-Homosexuality Bill was signed into law, the LGBTI community in Uganda was reportedly targeted by Zeus malware, a spyware often used to steal banking information through techniques including keystroke logging and form grabbing. Human rights defenders routinely report office break-ins, thefts of servers and other computer material and hacking of websites.

In July 2018, MTN Uganda - a division of the South African telecoms firm MTN - claimed that government security personnel raided one of their data centres. They claimed that security personnel kidnapped one of their employees to gain access.

Data Protection

Data protection laws

There is no specific law or regulation that regulates data protection in Uganda. However, in late 2014, the National Information Technology Authority (NITA), the Ministry of Information and Communication and Technology (MoICT) and the Ministry of Justice and Constitutional Affairs (MoJCA) issued a draft Data Protection and Privacy Bill for public comment. During the consultation, the ICT Policy Centre for Eastern and Southern Africa (CIPESA) submitted observations that the broad justifications for collecting personal data – namely "proper performance of a public duty by a public body" and "national security" – were overly broad and vulnerable to misinterpretation. It noted that the retention of data for national security purposes was concerning for the security and use of personal data because the term 'national security' had not been defined.

The bill seeks to protect the privacy of the individual and personal data by regulating the collection and processing of personal information. It outlines the rights of individuals whose data is collected and the obligations of data collectors and data processors; and it regulates the use or disclosure of personal information. The Bill was tabled before Parliament in April 2016.

Telecommunications and internet service providers are required to ensure that their services are technologically capable of allowing lawful interception, and in such a way so that the target of the interception remains unaware of it, according to Section 8 the Regulation of Interception of Communications Act (2010).

In December 2018, the Parliament of Uganda passed the Data Protection and Privacy Bill, 2015 after conducting a two days debate on the committee report. As of January 2019, the passed bill is pending the presidential signature before becoming law.

Accountability mechanisms

We are not aware of any accountability mechanisms related to surveillance in Uganda. Please send any tips or information to: research@privacyinternational.org

Data breaches: case law

We are not aware of any case law related to data breaches in Uganda. Please send any tips or information to: research@privacyinternational.org

Examples of data breaches

In June 2017, the New Vision reported that confidential data held by the National Identification and Registration Authority (NIRA) could have been breached following a serious case of financial fraud. The case was condemned by Ugandan civil society group Unwanted Witness. The government denied any suggestion that NIRA's databases had not been adequately secured.

Identification Schemes

ID cards and databases

In 2015, the Ugandan parliament passed the Registration of Persons Act to harmonize existing laws on the registration of persons, establish a single central registration body and a national identification register of all persons in Uganda, and provide rules to govern the access and use of this information. The act established the National Identification and Registration Authority, which oversees the issuing of national identity cards. The act makes it compulsory for all Ugandan citizens to register with the Authority and to register minors in their care.

Commentators noted that the act does not contain data protection clauses. This could potentially lead to violation of Article 27 of the Uganda constitution, which guarantees the right to privacy.

In 2016, Ugandan media reported that according to internal memos circulated to all ministries heads of departments, as well as chief administrative officers and town clerks across the country, public servants who failed to obtain national identity cards by July 1 would have their names removed from the government payroll.

On 22ndMay 2018 the British Government, through the Department for International Development (DfID), donated biometric machines to government of Uganda worth half a million pounds. The machines were meant to monitor the attendance of public servants were installed in public facilities like hospitals and education centres in selected districts.

Voter registration

According to the Electoral Commission, all Ugandan citizens over the age of 18 are entitled to vote. Voters must reside or originate from the parish in which they intend to vote. Voters must be registered in the Photo-Bearing Voters’ Register (PVRIS or NVR) which holds the following data: photograph, names, electoral areas including polling station, date of birth, sex, and voter's code number.

SIM card registration

Registration of SIM cards has been mandatory in Uganda since March 2012, following a campaign by the Uganda Communications Commission, citing the Regulation of Interception of Communications Act (2010).

The UCC stated that SIM registration information would be stored confidentially by telecommunications operators in a secure database. The UCC justified the initiative as necessary to “[h]elp law enforcement agencies to identify the mobile phone SIM card owners”, “[t]rack criminals who use phones for illegal activities”, “[c]urb other negative incidents such as; loss of phone through theft, nuisance/hate text messages, fraud, threats and inciting violence”, and “[h]elp service providers (network operators) know their customers better.” In 2015, the Ministry of Security reportedly ordered the UCC to verify information provided by telephone users in the SIM card registration exercise by matching data collected during the National Identity card registration exercise with that gathered in the SIM card registration exercise.

The UCC ordered telecommunications providers to deactivate all unregistered SIM cards by 30 August 2017. The UCC directive ordering the verification exercise had previously been challenged by the Uganda Law Society.

In March 2018, Uganda Communications Commission issued a directive banning the sale of new SIM cards with fresh guidelines requiring all telecom service providers to put in place National ID card readers so as to verify information electronically against the database maintained by the National Identification Registration Authority (NIRA), a body which is a custodian of citizens’ National ID data. The directive followed a spate of murders in the country with government linking the criminals to unregistered SIM cards. The ban was however lifted on 13 April after NIRA gave 50 biometric machines to telecom companies to aid in capturing of users’ data.

Policies and Sectoral Initiatives

Cybersecurity policy

Uganda has a national cybersecurity policy, the National Information Security Policy, published in 2014. The policy outlines the mandatory minimum security controls that must be applied by all public and private sector organisations that use, own and/or operate protected computers, and handle official communications and personal data to reduce their vulnerability to cyber threats. The policy also defines 'critical infrastructure' and 'critical information infrastructure'. Uganda also has a National Information Security Strategy (NISS), according to the National Information Technology Authority (NITA). The National Information Security Strategy (NISS) does not provide specific actionable directives related to cybersecurity.

As regards privacy, the National Information Security Policy requires all organisations to "Ensure that remote access solutions, including contracts with IT suppliers, comply with applicable legislative or regulatory constraints in particular the Official Secrets Act, 1964 and the Access to Information Act, 2005 regarding the handling of information, which is likely to prejudice the security of the State or interfere with the right to the privacy of any other person."

The Uganda National Computer Emergency Response Team (CERT-UG) was established in 2014 to coordinate cybersecurity incident response.

In July 2017, the Daily Monitor reported that the Chinese government had agreed to offer Uganda a comprehensive cybersecurity solution through a statutory company. The solution would reportedly include technical capacity to monitor and prevent social media abuse.

Cybercrime

Cybercrime is largely regulated by the 2011 Computer Misuse Act. The act comes after the first known case of a person (a blogger in 2010) reportedly being charged for offences relating to free expression on the internet.

The Computer Misuse Act makes provisions for the safety and security of electronic transactions and information systems. The act creates several computer misuse offences, for example, unauthorized modification of computer material, unauthorised access, access with intent to commit or facilitate commission of further offence. It also outlines mechanisms for investigation and prosecution of the offences, as well as appropriate sentences for each offence.

Encryption

There does not appear to be any restriction on the use of encryption in Uganda. The use of end-to-end encrypted messaging applications, particularly WhatsApp, are popular.

Licensing of industry

Uganda's telecommunications industry is governed by the Uganda Communications Commission (UCC). The Commission's mandate is to develop "a modern communications sub-sector and Infrastucture in Uganda, in conformity with the operationalization of the Telecommunications Policy."

The National Information Technology Authority is an autonomous statutory body established under the NITA-U Act (2009), to coordinate and regulate Information Technology services in Uganda. It is supervised by the the Ministry of Information and Communication Technology (MoICT).

Uganda's main mobile network providers are a mixed group of Ugandan, African, and international providers. These include:

MTN Uganda (a subsidiary of South African company MTN);
Airtel Uganda (a subsidiary of Indian company Bharti Airtel);
Uganda Telecom (partially government-owned and partially owned by a subsidiary of the Libya Africa Investment Portfolio);
Africell Uganda (formerly Orange, Africell is an African company founded in The Gambia);
Smile Telecom (an African provider incorporated in Mauritius);
Sure Telecom (a subsidiary of Time turns Holding Ltd, Cyprus);
K2 Telecom (a private Ugandan company);
Smart Telecom (owned by the Industrial Promotion Services (IPS) Kenya, which is part of the Aga Khan Fund for Economic Development); and
Vodafone Uganda (a subsidiary of the British Vodafone group).

E-governance/digital agenda

The National Information Technology Authority-Uganda (NITA-U) is mandated by the NITA-U Act of 2009 to "promote and provide technical guidance for the establishment of e-Government, e-Commerce and other e-Transactions in Uganda."

The government is engaged in various e-governance initiatives including: the Nationwide ICT Backbone and e-Government Infrastructure and central government intranet system; the Ministry of Finance's Integrated Financial Management System (IFMS); the Uganda Revenue Authority's tax filing system; the Ministry of Health's Health Management Information System; and the Ministry of Public Service's Integrated Personnel and Payroll System (IPPS).

Health sector and e-health

Patients of Uganda's overburdened health sector often have little privacy; maintaining confidentiality is difficult in circumstances where multiple patients are often treated in the same rooms. A draft Patients' Rights and Responsibilities Bill (2015), reportedly contains some provisions ensuring patient privacy and the confidentiality of medical information.

Smart policing

The Ugandan government has been investing heavily in CCTV. The number of cameras in the capital Kampala appears to have increased over the last several years and the government periodically announces new purchases of CCTV technology, primarily in Uganda's main cities.

In 2014, it was reported that a Chinese telecommunications technology company, Huawei, had donated a multi-tracking system worth US$ 750,000 to the Kampala Capital City Authority of the Ugandan government. In March 2017, President Museveni announced that new CCTV cameras would be installed in all major towns of Uganda and along highways following the murder of a senior police officer. In February 2015, the Ugandan Parliament reportedly spent UGX 28 billion (over US$ 9.8 million) on CCTV cameras and other security measures provided by Chinese technology firm ZTE. Nevertheless, the police requested a further investment of 203 billion UGX (US$ 43 million) in CCTV in April 2017,

In early 2017, the Uganda Police Force launched a new smartphone app to encourage citizens to report crimes. Civil society groups including PI partner Unwanted Witness raised concerns about the wide range of access permissions the app requires from its users.

Transport

We are not aware of any privacy issues related to transportation in Uganda. Please send any tips or information to: research@privacyinternational.org

Smart cities

The 2015-2019 strategic plan of the Kampala Capital City Authority announced a 700,000 USD initiative to turn Uganda's capital into a "smart city". The KCCA considers a "smart city" to be "a city that uses Information and Communication Technology (ICT) as an enabler to the services that a city delivers in dimensions such as smart payments, smart planning, smart transportation, smart environment, smart education, smart communities and social services and smart governance."

Among the proposed initiatives are setting up ICT Infrastructure (called “K-NETWORK”): Wide Area Network connectivity, structured Local Area Networks and system power, enterprise licenses management for server/client computers and a modern data centre.

In August 2017, the Speaker of the House, Rebecca Kadaga, met with officials from Chinese audiovisual surveillance company Dahua to discuss collaboration on safe city projects, according to media reports.

Migration

We are not aware of any privacy issues related to migration in Uganda. Please send any tips or information to: research@privacyinternational.org

Emergency response

We are not aware of any privacy issues related to emergency response in Uganda. Please send any tips or information to: research@privacyinternational.org

Humanitarian and development programmes

We are not aware of any privacy issues related to humanitarian and development programmes in Uganda. Please send any tips or information to: research@privacyinternational.org

Social media

The Ugandan government has shown a strong desire to monitor social media over the past several years.

In April 2011, the UCC reportedly instructed ISPs to block access to social networking sites Facebook and Twitter for 24 hours “to eliminate the connection and sharing of information that incites the public,” allegedly at the request of security agencies concerned over demonstrations linked to the ‘Walk to Work’ protest movement.

On 30 May 2013, Security Minister Muruli Musaka announced the formation of a Social Media Monitoring Centre allegedly “to weed out those who use it to damage the government and people’s reputations.”

On 18 February 2016, shortly before the Presidential election, the UCC shut down access to social networking sites Facebook and Twitter and instant messaging service WhatsApp, citing unspecified security concerns and directives.

The Ugandan government has unsuccessfully attempted to block Tom Voltaire Okwalinga (TVO), a vocal pseudonymous critic of the government who publishes frequently on Facebook. In March 2017, the government appealed a ruling by the High Court of Ireland, where Facebook is headquartered, which refused the government's attempt to force Facebook to reveal TVO's identity.

In June 2018, Parliament passed the Excise Duty Amendment Bill 2018 which among others introduced a tax on the access of social media. The amendment which commenced on July 1st 2018 imposed a daily payment of UGX 200 (5 US cents) for service access but exempting educational or research purposes. This move received criticism from human rights activists.

List Icon (DO NOT USE)

List Image (DO NOT USE)

Location

Related learning resources

State of Privacy

More about our partner