Paul Okirig, a lawyer and drafter, said at the online consultative meeting that the regulations will among other things make it clear where the individual may refuse to give their data to a collector and incidences where they cannot refuse such as when the government wants information for planning purposes.
The Ministry of Information, Communication, Technology and
National Guidance has started drafting regulations that will be used in the operationalization
of the Data Protection and Privacy Act, 2019.
The Act, which was assented into law by President Yoweri Museveni
in February 2019, seeks to protect the privacy of the individual and the
personal data by regulating collection and procession of this data.
Paul Okirig, a lawyer and drafter, said at the online consultative meeting that
the regulations will among other things make
it clear where the individual may refuse to give their data to a collector and incidences
where they cannot refuse such as when the government wants information for
//Cue in there are certain …
Cue out: … can’t object.”//
The Act creates an office of the data protection officer to be stationed at the
National Information technology Authority (NITA) to act as an overseer of data
The holder of the office would approve applications for those that seek to
collect data but also act as an arbitrator in case there is a disagreement
between the subject of data and the collector.
Kenneth Muhangi, the chair of ICT Cluster at the Uganda Law Society said
the regulations must ensure the data protection officer is independent. He said
this is because he/she will not only be looking at individuals but also public
entities and big companies collecting information.
//Cue in When you have these…
Cue out: …government entities.//
Different companies are currently engaged in collecting information from people
for different purposes. Ride-hailing companies collect information from people
that download their applications but it’s not certain whether they keep at
collecting or they give it to third parties.
Several companies have approached those engaged in agriculture for information
on themselves and their activities. Banks and telecom companies also collect
information from Ugandans.
Through the new law, all these will have to seek permission before they collect
information. For those that use it for commercial purposes, they will have to
pay a few to the government before they are allowed to collect information.
The Act mentions medical information as one special data that may not just be
given out. Okirig said the regulations will go-ahead to classify other
kinds of data, including the criminal record of an individual among others.
He also said to get data outside Uganda, companies will be required to ensure
that the countries where the data is taken have similar laws on data protection
like Uganda. It is not clear when the regulations will be completed for the law
to start working.