Introduction
On Friday August 2, 2024, Women of Uganda Network(WOUGNET) together with the Data Protection and Privacy Office (DPPO), Pollicy, Association for Progressive Communications(APC) and other practitioners gathered at the Protea Hotel in Kampala to engage in the Uganda Internet Governance Forum 2024 and specifically for a compelling session organised by the Sandra Aceng, Executive Director, WOUGNET titled “One Step Further: Data Justice Insights and Lessons from Uganda and Beyond.” The session panel consisted of Esther Nyapendi from WOUGNET, Phillip Ayazika from POLLICY and Stella Alibateese from DPPO. This discussion was moderated by Peace Oliver Amuge from APC bringing together a diverse panel to explore the intersection of data, social justice, and technology, with a focus on Uganda.
Session Overview
The session aimed to dissect the emerging field of data justice by examining how data governance intersects with social justice and the broader implications for the community, policymakers and developers.
Key Insights and Lessons
The discussion framed the concept of data justice where Esther Nyapendi emphasised that data justice is about fairness in how people’s data is used and represented. It is crucial to ensure that data collection, processing, and usage are equitable and respect individual human rights. Nyapendi highlighted how data justice in Uganda has evolved, focusing on the disparities in data representation and access. She highlighted that WOUGNET’s research revealed that data justice involves understanding and addressing the social impacts of data practices, including privacy and representation.
Phillip Ayazika shared real-world applications and innovations through a practical example of how data justice principles are being applied. He discussed various projects that aim to align technological solutions with social justice goals. One notable example was an innovative approach to water access in schools, where data-driven solutions were used to improve sanitation by integrating community feedback into the design process. Ayazika’s insights stressed the importance of involving communities in data governance to ensure that technological solutions address real needs and promote social equity.
Stella Alibateese provided an overview of Uganda’s Personal Data Protection and Privacy Act, 2019 highlighting the Legal Frameworks and Challenges. She discussed how this legislation aims to uphold data justice by enforcing transparency and accountability in data handling practices. Alibateese acknowledged the challenges in implementing these protections, especially for marginalised groups. The law’s effectiveness in promoting data justice hinges on continuous efforts to educate and empower these communities, ensuring they understand and can exercise their data rights.
The panellists collectively emphasised the need to address power imbalances in data governance highlighting that data justice is not only about protecting privacy but also about ensuring equitable access to data benefits. He discussed how data governance frameworks must be designed to prevent exploitation and ensure that all stakeholders, especially marginalised communities, have a voice in how their data is used.
Understanding Data Protection and Privacy: Insights from the Discussion
In our latest discussion on data protection and privacy, we explored the critical aspects of handling personal data, especially under Uganda’s Data Protection and Privacy Act. Here’s a summary of the key points covered:
The Data Protection and Privacy Act, 2019 under Section 3 provides for the key principles of Data Governance were namely: [1] Accountability by Data controllers and processors who must demonstrate such by implementing proper policies, such as a privacy policy. This document should outline how data is collected, used, stored, and secured. Transparency is crucial, and privacy policies should be accessible in multiple languages to ensure understanding among all data subjects. [2] Data Quality, the quality of collected data directly impacts decision-making and service provision. For example, incorrect date of birth information can lead to incorrect service access, highlighting the importance of accurate data collection. [3] Transparency and Participation, data subjects must be informed about the collection process and the intended use of their data. They should have a say in how their data is utilised and have access to their data to correct any inaccuracies.[4] Lawful Processing: Data must be collected and processed based on a lawful basis, such as legal obligations or legitimate interests. Documentation and transparency about the lawful basis are required. [5] Data Security: Once data is collected, it must be secured against unauthorised access or breaches. This principle ensures that personal information is protected from misuse. [6] Direct Collection: Data should ideally be collected directly from the data subject. This approach involves the data subjects in the data collection process, ensuring they are informed and can make decisions about sharing their data.
Challenges and Solutions
Despite the Data Protection and Privacy Act being in place since 2019 and operational since 2021, there is a lack of awareness among the public and organisations. Efforts are being made to raise awareness through various platforms, but funding constraints limit the reach and effectiveness of these initiatives. Secondly, the Personal Data Protection Office (PDPO) faces challenges due to limited human and financial resources. Efforts to train and support organisations are ongoing, but there is a need for more comprehensive funding and resources. Many digital services and infrastructure are controlled by foreign companies. This creates challenges for data sovereignty and enforcement. Collaboration with international and regional regulatory bodies is crucial to address these issues. Lastly, ensuring that global companies comply with local data protection laws is challenging. The DPO engages with international networks to address these concerns and ensure that global practices align with local regulations.
Key Takeaways
Both individuals and organisations need to educate themselves about data protection and privacy. Understanding and compliance with the Data Protection and Privacy Act are crucial for safeguarding personal information. For more detailed information and updates, follow the ongoing webinars and resources provided by the Data Protection Office.
As data subjects, individuals have a role in protecting their personal data. Being informed and asking questions about how data is collected and used can help ensure better data practices.
The journey towards effective data protection is ongoing. Continuous efforts are needed to raise awareness, educate stakeholders, and adapt to emerging challenges in the digital landscape.
In conclusion, the discussion emphasised the importance of accountability, transparency, and security in data protection. The session provided a comprehensive view of data justice, highlighting the need for a nuanced approach to data governance that integrates social justice principles. The discussions underscored the importance of community involvement in the data lifecycle, the challenges of implementing data protection laws, and the need for continued advocacy to address power imbalances.
Despite the challenges, ongoing efforts and collaborations aim to improve data protection practices and ensure that personal data is handled responsibly. As the panel concluded, the call to action was clear: For data justice to be effective, its 6 pillars- Power, Access, identity, equity, participation, and knowledge must be rooted in transparency, community engagement, and equitable practices. By adopting these principles, we can move one step further in ensuring that data serves as a tool for social justice and empowerment.
Compiled by
Esther Nyapendi, WOUGNET
