In the wake of the murder of the legislator and senior army officer (Retd. Col.) Ibrahim Abiriga, which has since heightened security discussions in the country, President Yoweri Museveni, the following day, while visiting the deceased’s home, proposed that vehicle owners be directed to install location tracking devices in their vehicles.
The proposal has since been endorsed by senior security officers, including Security Minister General Elly Tumwine who reemphasized it on Monday evening during a live television session involving the chieftains of Uganda’s security agencies.
But amidst the endorsements and all, there is a section of the public, including some lawyers who argue that the proposal could face tough resistance, saying it oversteps on people’s privacy rights.
Gen. Elly Tumwine reveals that each bodaboda will be embedded with a chip connected to #GPS tracking. This will most likely be legally challenged. Outright invasion of #privacy. Data #security of #wearables is also not yet settled! #SecurityUg #transport #regulation
— Silver Kayondo (@SilverKayondo) June 11, 2018
Being a fundamental human right enshrined in numerous related international policies, activities that restrict the right to privacy, such as surveillance and censorship, can only be justified when they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.
In Uganda, currently, the laws protecting the rights to privacy are mostly ambiguous; however, in 2014, the National Information Technology Authority (NITA), the Ministry of Information Communication and Technology (MoICT) and the Ministry of Justice and Constitutional Affairs (MoJCA) drafted the Data Protection and Privacy Bill, and it is currently being scrutinised by the ICT committee of parliament.
If government insists on enforcing Museveni’s proposal, this bill is the best available option, hence, it could be edited and quickly passed into law to disqualify all the bases that opponents are likely to exploit to fight the idea of installing GPS trackers in vehicles.
Below, we comb through the bill, sieving out only parts that are related to this topic; we shall also expose you to some of the existing laws; plus, we also talked to a lawyer, for expert opinion.
What the bill suggests
If passed into law, the bill seeks to protect the privacy of the individual and of personal data by regulating the collection and processing of information.
Drafters of the bill say that whereas Article 27(2) of the constitution provides that no person shall be subjected to the interference of privacy of that person’s property, there is currently no comprehensive law to safeguard personal data by regulating how personal information is collected.
There is also no measure to ensure that data is used only for the purposes for which it is collected.
They argue that, in most cases, data collected is of a private nature and can easily be abused or misused in the absence of a legal framework to govern the integrity and circumstances relating to the use, storage and processing of personal information.
The bill is therefore intended to strengthen the aforementioned Article 27(2) by providing for the principles of data protection and recognizing the rights of the persons from whom personal information is collected.
When passed into law, it will give NITA powers to monitor persons and bodies collecting data to ensure that personal information is collected, processed, stored and used in accordance with article 27(2) of the constitution taking into account the rights of the individuals to whom the personal information relates.
The bill defines data among other ways as information (text, images, sounds, codes, computer programs, software and databases) which is processed by means of equipment operating automatically in response to instructions given for that purpose.
Personal data includes nationality, age, marital status, education, occupation, financial transactions, identification numbers, symbols, or other particulars assigned to a person.
Among the principles of data protection, it is stated that the data collector should retain personal data for the period authorised by law or for which the data is required (the period is not defined).
The bill also proposes that a data collector shall not collect or process personal data without the prior consent of the data subject.
But the next section suggests that personal data may be collected or processed where the processing is authorised or required by law; or where it is necessary for among others national security. (National security is not defined and therefore open to interpretation.)
Under the section of Protection of Privacy, the bill proposes that a data collector shall collect data in a manner which does not infringe the privacy of the person to whom the data relates, implying that data should be collected directly from the subject with their consent.
However, the next statement says that data on a particular person can be collected from another source if it is necessary for among others national security.
It is also indicated that personal data shall be collected for a lawful purpose which is specific, explicitly defined and is related to the functions or activity of the person or public body.
On security of data, the bill stipulates that a data controller shall ensure the integrity of personal data in the possession or control of a person by adopting appropriate, reasonable, technical and organisational measures to prevent loss, damage, or unauthorised destruction and unlawful access to or unauthorised processing of the personal data.
The bill also specifies that a person shall not knowingly or recklessly obtain or disclose personal data or the information held or processed by a data controller or procure the disclosure to another person of the information contained in personal data.
A person who contravenes this section commits an offense and is liable on conviction to a fine not exceeding two hundred and forty currency points or imprisonment not exceeding ten years or both.
A person who sells data of any person is liable on conviction to a fine not exceeding two and forty-five currency points or imprisonment not exceeding ten years or both. (A currency point is equivalent to twenty thousand shillings.)
Existing laws
The 1995 Ugandan constitution explicitly recognises the right to privacy and calls for its protection, and Article 27 specifically notes, in this context, that no person shall be subjected to interference with the privacy of that person’s home, correspondence, communication or other property.
However, since this explicit recognition, Uganda has still not yet been able to adopt a data protection law, apart from the above proposed bill.
Uganda also ratified the International Covenant on Civil and Political Rights (‘ICCPR’), whose Article 17 provides that “no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation”.
The Human Rights Committee has noted that states party to the ICCPR have a positive obligation to “adopt legislative and other measures to give effect to the prohibition against such interferences and attacks as well as to the protection of this right [privacy].”
The Regulation of Interception of Communications Act (RICA) 2010 regulates communications surveillance and it was adopted three days after the twin bomb attacks in Kampala in July 2010. Other acts including the 2015 Anti-Terrorism(Amended) Act grant the security services wide-ranging communications surveillance powers. The 2002 Act gives almost unfettered powers for state officials to conduct surveillance, without the need to obtain judicial authorisation.
RICA requires intelligence agencies and the Police to seek judicial authorisation for the interception of communications under Section 5. The law authorises officials to apply for a warrant that is issued by a designated judge to intercept specific communications. However, the threshold for issuance of a warrant to be established, some analysts argue, is very low given that law enforcement must only demonstrate “reasonable” ground for unspecified and broad threats to national security, national economic interests and public safety.
Section 8 of RICA requires that telecommunications and internet service providers ensure that their services are technologically capable of allowing lawful interception, and in such a way that the target of the interception remains unaware of it.
The power to gather intelligence and conduct surveillance are concentrated around various institutions: the Uganda People’s Defence Force (UPDF) and the Uganda Police Force (UPF). The President exercises control over sensitive intelligence operations while day-to-day spying for intelligence gathering appears less centralised.
Comments
Whereas lawyers like Silver Kayondo know there is a gap for an extensive legal battle over the proposal, he acknowledges that the current situation “gives government more powers over surveillance on bodas and passengers.”
He says that the court battle has potential since “there are decided court cases that have dealt with legal principles relating to breach of privacy basing on common law”, adding: “So, the non-enactment of the Data Protection and Privacy Bill will not forestall any legal action in case of breach or invasion of privacy.”
For Charlotte Kwitonda, a law student at Makerere University, she says “in my opinion”, “the proposed system is a good move.”
She argues that whereas the GPS or any other tracking system is an infringement on article 27(2), she “thinks it will help curb the rampant public transport kidnappings and robberies and help with the investigations.”
She, however, cautions that, considering our country’s history, the move could have negative consequences.
“However, based on Uganda’s past experience, everything that could potentially go wrong will indeed go wrong; If the GPS system information ends up in the wrong hands it could potentially make it way easier to carry out the heinous crimes that are already crippling the country since locating the subjects would be so easy,” she says.
“More so, in this country of political subterfuge, how sure are we that this information won’t be used to further oppress opposition activities or something much, much worse,” she goes on.
“More so, allowing this move will be giving the government more leeway and in future it may not just be GPS, but phone tracking, messages or whatever… It’s like giving them a piece of cake and not wanting them to have the whole cake.”
Barry Ainomugisha, also a law student at Makerere university wonders how this will work, yet government failed to register boda bodas.
On his part, Claver Muwanguzi says the privacy breach can’t be a valid argument since government has previously installed CCTV cameras on streets, and it did not create any opposition.
Emmanuel Okia, who is also pursuing a Bachelor of Laws at Uganda Christian University Mukono, wrote this:
Prima facie The Ugandan Constitution under Article 27 provides for a right to privacy. However, its only good sense to read that Article together with Article 43 about limitations of rights. Its first of all important to know whose privacy is being allegedly infringed on, is it the motorists or the passengers?
It’s my averment that this is a move made in ubberimae fidei (good faith) to curb the rampant killings in Uganda. The move is done in public interest and falls within the confines of not only Article 43 but also the landmark case of Charles Onyango Obbo v AG where Justice Mulenga set the 3-part test. It will be an effective method in curbing down the use of motorcycles in crimes. This is not an isolated case, many Governments such as our neighbors Kenya and many Western governments have attached GPS to public means of transport. Take an example of planes that have black boxes, is it logical to say it is an infringement of their privacy? I opine not. We should not blind ourselves to the fact that many governments have surveillance where they literally know where everybody in their country is at what time. It is notable that the information is a reserve of intelligence services and is done to ensure security in their countries. This is an issue of good sense not even law.
The information of these public means of transport is a reserve to Government just like other information such as NIRA stuff, and surveillance reports. This GPS system could even help in tracking stolen motorcycles and the sort. Generally, the registration and tracking of motorcycles will bring security, safety and sanity to this country
I guide you to the wise counsel of Lord Denning MR, in his judgement Council of Civil Service Union – V – Minister for the Civil Service [1985] AC 374.;
“But this is no ordinary case. It is a case in which national security is involved and our history shows that when the state itself is endangered, our cherished freedoms may have to take a second place. Even natural justice itself may suffer a setback.”
It will be very unwise if we act like its new and an isolated case. Actually Ugandans should ask why we didn’t do this earlier.
Compiled by Nicholas Asingwire and Julius Wasajja
