Data privacy: EAC govts told to break barriers to data sharing

Tanzania-based Engineer Daniel Murenzi was last week left red-faced when he was bombarded by a barrage of questions from an immigration officer at the Entebbe International Airport.

The engineer was asked why he was visiting Uganda and the length of his stay in the Pearl of Africa. However, Murenzi retorted that he is an East African citizen and didn’t have to respond to any of the queries because he has an EAC passport.

He reminded the officer about the EA common market protocol which allows the free movement of people and goods. However, his woes were compounded when he had to surrender all his details afresh to acquire a Ugandan SIM card.

Kenya cybersecurity expert Mutheu Khimulu, Uganda MP Racheal Magoola and Koech-Kiwatu interacting during the forum at the Kampala Serena Hotel.

Murenzi’s experience is not unique for many East Africans crossing borders from their countries of origin as they face similar questions from border officials from all EAC member state officials.

The engineer, who is the principal information technology officer at the EAC Secretariat based in Tanzania, argues that these experiences are uncalled for and, therefore, should stop to ease the movement of people and goods within the EAC.

According to him, this can end if all EAC member states agree to break barriers in data sharing under the guise of data protection.

He is, therefore, calling for a data protection harmonisation law for all EAC countries. The law calls for EAC to have one data protection and privacy law.

Rosemary Koech-Kiwatu from the Kenya Internal Governance Forum MAG making her remarks.

“You find you have got a diagnosis in Mulago National Referral Hospital, Kampala, but when referred to Nairobi, another test has to be conducted because personal data sharing is illegal,” he says, adding that this makes medical treatment expensive.

He says even accessing bank services in another country is very difficult because of the regulations.

“Because every country works in silos, they pass their own laws, which is impacting the trade, movement of goods and services in the digital agenda. We request that we forge one regional approach on how to deal with digital issues, digital direction in terms of giving the best services to East Africans,” Murenzi says.

Experts argue that the move will eliminate collection of similar personal data across the border(s). This multiple collection of similar personal data can be seen in Murenzi’s experiences as he was entering Uganda and as he attempted to acquire a SIM card locally.

This data is already stored in the country of origin and, therefore, all that was needed was a data sharing framework for him to seamlessly travel and do business in any other EAC country rather than Tanzania.

Break the silos

Rosemary Koech-Kiwatu from the Kenya Internal Governance Forum MAG, who is the chairperson Trustee Kenya ICT Action Network, proposed that to shape a unified data privacy framework in EAC, “we must break the silos that exist”.

To achieve this, Koech says the region needs a collaborative approach to data protection.

The experts made the call on September 11, 2024, during day one of the 11th East African Internet Governance Forum (EAIGF) 2024 at the Kampala Serena Hotel.

The two-day event, which was themed: Building Our Multi Stakeholder Digital Future for East Africa, attracted Members of Parliament from several EAC member states including Tanzania, Kenya and Uganda and Members of EALA. It also attracted digital and data gurus in the public and private sectors from EAC.

The forum has been organised by the EAIGF in conjunction with the ICT and national guidance ministry of Uganda, EAC Secretariat and partners including the Internet Society of Uganda Chapter, Smart Africa, RENU, Oxfam, CIPESA, KICTANET and EAIGF Youth.

The stakeholders argued that the key steps for integration of data among the EAC, include standardised data protection regulations across countries, harmonising legal frameworks and ensuring cross-border data flows is secure and consistent.

They also argued that the laws should be designed to benefit regional systems by ensuring they are robust, adaptable and aligned with international best practices. This, according to them, will strengthen data privacy and foster digital growth.

Kenya cybersecurity expert Mutheu Khimulu argued that computer misuse and cybercrimes laws should stay relevant by keeping in sync with technology advancements.

Several legislators, including Ugandan MP Sarah Opendi (Tororo District, NRM) and Masindi Woman MP Florence Akiiki Asiimwe, supported the harmonisation of laws across EAC member states.