*Maureen O. Mapp, Ph.D.

Lecturer, University of Birmingham Law School, UK

In April 2020, Laura Nagasha Barumba gave a disturbing account of data leaks by Uganda’s Ministry for Health. Information revealing the location of people quarantined for suspected COVID-19 was widely circulated without their knowledge or consent resulting in discrimination, and harassment for those affected. Laura was lucky to be let back onto her housing estate. In Senero village, Kalangala district, four hundred residents refused to receive Engineer Banya back in the village even though he had recovered from COVID-19. Local officials faulted the Ministry of Health for failing to design a cohesive reintegration strategy.

These stories indicate a tension between contact tracing, data privacy and justice. Uganda’s Public Health COVID 19 laws do not specifically regulate manual or phone tracing, or contact tracing apps but by not anonymising data, then leaking it, the tracing method chosen to process information fails the privacy test, with dire consequences for vulnerable people. That the Ministry for Health is held responsible indicates an abuse of power by public officials.

To prevent abuse of public power, the United Nations Special Rapporteur on Freedom And Rights, David Kaye, has suggested that new COVID-19 regulations should be subject to judicial oversight (and temporal limitations). South Africa has led the way with the appointment of Justice Catherine O'Regan as the COVID-19 Designated Judge mandated to oversee the protection of personal information and data privacy by public bodies while using mobile phone location data for tracing.

It is too early to tell if Uganda will follow South Africa’s lead. Even so, to deliver data justice, Uganda’s COVID-19 judge(s) would need to investigate how data is managed at all stages of contact tracing: identification; listing; follow up; and discharge; to assess the contract tracing regime against both data privacy safeguards, and a