Ugandans could have surrendered their data privacy to unknown people over the last two weeks since the government shut down social media access.
The shutdown of the internet on the eve of the presidential and parliamentary elections forced Ugandans to find ways of communicating, and the Virtual Private Networks (VPN) came in handy.
“Privacy, data safety and trust are eroding in Uganda as government censorship intensifies”, says Unwanted Witness, a human rights advocacy group, as the world marked the international Data Privacy Day. The day aims at raising awareness about respecting privacy, safeguarding data and enabling trust.
However, the day is being marked at a critical moment when privacy, data safety and trust is eroding amidst intensified government censorship and surveillance in Uganda.
On election eve government shut down the internet on grounds of maintaining public order, and although the internet has partially been restored, social media platforms remain restricted.
“Using VPNs in our daily lives creates an addiction but they siphon our data in form of names, addresses to do behavioral analytics for marketing and profiling.
This information is transferred to third party users or the makers without the users’ consent”, says Chris Kalema, the Lead Technologist at Unwanted Witness.
He adds that VPNs are designed with codes that have trackers that the users may never know and unfortunately Ugandans are using them without any clarity. “VPN applications are free but they have permissions and pre-installed trackers that users cannot control or uninstall by design and therefore cannot be trusted”, he adds.
The group says that throughout the election process, Unwanted Witness observed increased use of technology by security agencies for surveillance on street protests and opposition political rallies, with an intent to limit dissenting voices.
“This has resulted in arrests and disappearance of an unidentified number of youths and scores of deaths.”
The elections also posed another risk to people’s privacy, as there was lack of public scrutiny in the use of biometric machines to verify voters, and unknown results transmission system-generated mistrust between citizens and the Electoral Commission, jeopardizing the credibility of the process, according to Unwanted Witness.
“Political parties were not transparent about their data processing activities, including publicly identifying the mechanisms they used to engage with voters, like social media, websites, and direct messaging, and how they collected people’s data, what data they collected, and the sources of it and how they used it.
“The Electoral Commission failed to have in place effective safeguards (Binding code of conduct/Regulations) that reflected changes in digital campaigning.
By doing this they would have fulfilled their mandate established under Article 60 and Article 61 of the Constitution of the Republic of Uganda 1995 (as amended) to organise, conduct and supervise regular, free and fair elections and referenda, among other functions” Says Dorothy Mukasa the Executive Director of Unwanted Witness Uganda.
She notes that one of the qualities of a trusted data collector is the ability to be transparent and accountable to the data subjects as enshrined in Section 3 (a) and (f) of the Data Protection and Privacy Act 2019.
They also allege that statutory agencies that use people’s data, like the Electoral Commission or NIRA which gather, use, disclose and manage a person’s data, do not have a Privacy Policy.
“This lack of transparency led to voters missing out on the voting exercise because the voters’ register was unclean with voters’ names repeated, name-face mismatches and deletion of some voters’ names from the register”, the statement claims.
It also urges the government of Uganda to expedite the enactment of Data Protection and Privacy regulations for effective enforcement of the Data Protection and Privacy Act 2019 and to fully restore internet to avoid data manipulation risks that come with the use of VPN.
