NAIROBI, KENYA: Unwanted Witness, a privacy and data protection watchdog, has released the 2022 Privacy Scorecard Report, a monitoring toolset to determine legal protections of personal data and privacy. Presented during this year’s 4th Privacy Symposium Africa (PSA) in Kenya’s capital Nairobi, the scorecard was tailored to both Kenya and Uganda.
Conducted in partnership with Strathmore University’s Center for Intellectual Property and Information Technology Law (CIPIT), the survey was presented at the culmination of a three-day Privacy Symposium Africa 2022 at Strathmore University. The event attracted panel discussions and participants from across the continent.
The scorecard report highlighted solutions to improve data law compliance not only in the two countries concerned, but across Africa.
Speakers stressed that data protection and privacy remain contentious issues, largely a back-and-forth between accountability and responsibility across the continent. A lack of accountability continues to expose individuals to harm and businesses to deep lawsuits, and in turn harbors a risky online environment.
“It is important to note that while digital transformation holds promise, the world has turned information technology into both a powerful tool and a formidable weapon. We are in an era that will likely be marked by even more disruptive innovations such as artificial intelligence, which can be used to benefit humanity but, if not managed properly, could also be used to hurt and oppress people said Dorothy Mukasa, Executive Director, Unwanted Witness, at the closing ceremony.
In an effort to provide a safe and uncensored online environment for data controllers, processors and subjects, Unwanted Witness addressed critical privacy issues in the 2022 Scorecard Report.
The report mainly focuses on key sectors; Telecoms, E-Commerce and Financial Services in Kenya and Uganda, was welcomed by Kenya’s Data Protection Commissioner, Immaculate Kassait, who was also one of the panellists during the three-day event. She underscored the fact that data has become a new king on the block and ultimate responsibility must be secured by its collectors and managers.
The scorecard analyzes the policies and practices of these data collectors. Like a double-edged sword, the scorecard report seeks to empower data collectors to apply legitimate privacy practices while urging citizens to push for accountability around personal data protection.
In this report, Unwanted Witness also discloses the nature of the abuses and violations of the right to privacy by the rated companies in the respective countries. Also, the Uganda-based institution wants to arm citizens with a toolkit to assess data collector compliance and could rely on it to ensure better protection.
Data Protection and Privacy Statements
The report includes an assessment of the compliance of six private companies in each country, with two companies identified for analysis for each sector. Unwanted Witness, in partnership with CIPIT, awarded points for key categories that define data protection and privacy. The categories, also known as indicators, help to examine the handling of data in relation to the Data Protection Acts (DPA) in Kenya and Uganda.
For the existence of public, published, legible and perceptible privacy policies, Kenya and Uganda scored 73 percent and 70.8 percent, respectively. Uganda performed better on informed consent, showing that companies in Uganda could demonstrate more that they received data with permission from individuals for a specific use than in Kenya. Uganda scored 66.7 percent while Kenya scored 60 percent. There was a big difference in data collection and data sharing with third parties, with Kenya scoring 63 percent and Uganda 47 percent. Despite the difference in this particular indicator, this shows that many data subjects in both countries are unaware that third parties exist and what their data is being used for by those parties.
In the data security indicator, both countries performed poorly with Kenya at 41 percent and Uganda at 38.9 percent. This means that companies in both countries have no interest in protecting personal data from accidental access, deletion, alteration, disclosure or destruction. Finally. the accountability indicator in both countries was 0%. This means that in the year under review, no company in either country published a transparency report to disclose key metrics and information on data governance and enforcement actions.
The overall compliance of Kenya and Uganda was 47.4 percent and 43.6 percent, respectively. This is an indication that both countries have a lot to do to ensure that the privacy policies meet the legally acceptable parameters of personal data protection. In the 2022 scorecard report, specific sectors will be reviewed; Telecom companies, financial institutions and e-commerce show the highest and lowest levels of compliance in both countries.
According to Unwanted Witness, transparency, accountability and privacy intentionality are key elements in the three focus areas. This is intended to create a secure and intact online environment.
“We believe that sharing knowledge and best practices will strengthen our capacities and enable key stakeholders such as data protection authorities across Africa to implement the highest data protection standards on the continent,” concluded Dorothy Mukasa, presenting the 2022 Scorecard report.