Analyzing the Data Protection and Privacy Bill (2015) from a gender perspective.

Leave a comment

On the 7th February 2017, the Uganda Human Rights Commission (UHRC) held a focus group discussion with experts from various disciplines, sectors and institutions to allow them give their different perspectives on the Data Protection and Privacy Bill, 2015. Central to this discussion were expert’s reviews on the Bill, including; identifying existing gaps, positive aspects, recommendations on areas for improvement and how it may affect other human rights if these recommendations are not seriously considered. Copies of the Data Protection and Privacy Bill, have been made public since its first drafting in 2013. It has since then gone through a series of reviews and has been tabled in Parliament only once.

Article 27(2) of the constitution of the Republic of Uganda provides for the right to privacy of correspondence and communication. On close review of the Data Protection and Privacy Bill however, there are important components of this constitutional right that some of the experts felt the proposed law did not cater for. It was generally felt that if some of the gaps identified were not addressed while the proposed law was still in its review process, it could have long lasting impacts on citizens and particularly marginalized populations including women. Some of the identified gaps in the Bill that would directly affect women include; –

1. For data that is already out, there is lack of provision for; who is permitted by law to collect and own this data and under what circumstances (provided for with reference) they can collect it; how and who handles it, what they are likely to use it for and frameworks that would guarantee confidentiality [Part III, Clause 7(1); Part IV, Clause 18 (1)].

2. The Bill doesn’t provide for the length of time data handlers should be in possession of personal data and or give a clear explanation on disposal of this data including evidence of disposal or erasure. [Part III, Clause 14(1); Part V, Clause 24 (4)]

3. Does not specify the “lawful means” of collecting data [Part III, Clause 8]. It only lists circumstances under which data may be collected but does not make reference to legal provisions in other laws that justify these circumstances. It was generally felt that reference to other laws on such provisions need to be indicated. [Part III, Clause 4, Subsection 2b (I & II)]

4. A closer analysis of this Bill found that it lacked gender specific provisions that protect women. It also lacks clear provisions for the privacy and protection of other vulnerable groups like children, the elderly and sexual minorities.

5. Poor provisions on consent, specifically the transfer of data to third countries unless there are adequate laws in these third countries to protect this data. This raises the question on ownership of personal data and consent of the data subject to share their data with third parties. [Part III, Clause 15]

Some major concerns expressed over the Bill were identified and included the fact that;- It does not emphasize the need to include security of personal data that is in the hands of government, private institutions and individuals; and it lacks provision for the formulation of a data protection framework against unlawful deployment of data collection initiatives including compulsory SIM card registration, collection of data by visitors at private institutions and the retention of that data in a database whether manual or electronic. This was highlighted as a great threat on the right to privacy of Ugandan citizens.

On the Flip side, the Bill is not entirely without any positive aspects. In fact, experts present commended the government of Uganda for drafting a law that seeks to protect the privacy of personal data and more over one that outlines the rights of individuals and attempts to regulate the use or disclosure of personal information. Many recommended a more human rights based approach to the provisions in the Bill including; criminalizing the collection of what was suggested should be termed “sensitive” information in the Bill i.e. tribe, race, criminal record, medical history and etc. It was further noted that collecting such personal data in most cases indicates intention to discriminate. As a very significant element in a way forward or in terms of action to be taken when lobbying for these changes to be incorporated, it was noted that gender dimensions would be brought out by a consultant to be commissioned by the UHRC.

Compiled by:
H. Susan Atim
Program Assistant Information Sharing and Networking
Women of Uganda Network (WOUGNET)
Plot 360, Kiuliriza, Gaba Road, Kansanga,
Kampala, Uganda.
Twitter: @wougnet/ @zooogle