Gov't asked to develop regulations on data protection and privacy law

TECHNOLOGY  DATA PRIVACY

The Ministry of Information and Communication Technology (ICT) has been implored to come up with regulations to govern the implementation of the data protection and privacy law.

The law which was passed by Parliament recently was assented to by President Yoweri Museveni on February 28, but its implementation faces hurdles due to lack of regulations.

"Having a data protection law for Uganda is positive step towards recognizing and upholding citizens' constitutional right to privacy that has for decades been violated in the wake of intrusive surveillance technologies, and it will be disheartening to note that the law is in shelves without operational regulations" Dorothy Mukasa, the Chief Executive Officer unwanted witness said.

To effect the law, unwanted witness, wants the line minister, Frank Tumwebaze to formulate the regulations whose, absence has made the implementation work of the law hard.

According to the organization, the law was long overdue and it is a landmark to realisation of privacy rights and protection of personal data as it regulates collection, storage and use of personal data by different entities including government agencies, corporations and private institutions operating within and outside Uganda.

Mukasa pledged support towards the consultation process to ensure that the law meets the necessary, proportionate and legitimate principles of data protection as well as international best practices on human rights.

On the implementation phase, Mukasa calls for an independent data protection commission that would be free from external or undue influence such as political pressure that might otherwise compromise the right to privacy of the data subject.

The law talks of an independent data protection office to be headed by the national personal data protection director whose major role will be to oversee people's personal data and implementing this Act.

‘' How sure are we that when push comes to shove, this director, who most likely will be a political appointee, won't easily surrender people's personal information to security agencies or other government bodies without following the now laid-out procedure" Mukasa asked.

She further noted that the law falls short of accountability as it does not compel data controllers to have appropriate technical and organizational procedures, which include suitable privacy policies and keeping sufficient records of their processing activities.