*Maureen O. Mapp, Ph.D.
In April 2020, Laura Nagasha Barumba gave a disturbing account of data leaks by Uganda’s Ministry for Health. Information revealing the location of people quarantined for suspected COVID-19 was widely circulated without their knowledge or consent resulting in discrimination, and harassment for those affected. Laura was lucky to be let back onto her housing estate. In Senero village, Kalangala district, four hundred residents refused to receive Engineer Banya back in the village even though he had recovered from COVID-19. Local officials faulted the Ministry of Health for failing to design a cohesive reintegration strategy.
These stories indicate a tension between contact tracing, data privacy and justice. Uganda’s Public Health COVID 19 laws do not specifically regulate manual or phone tracing, or contact tracing apps but by not anonymising data, then leaking it, the tracing method chosen to process information fails the privacy test, with dire consequences for vulnerable people. That the Ministry for Health is held responsible indicates an abuse of power by public officials.
To prevent abuse of public power, the United Nations Special Rapporteur on Freedom And Rights, David Kaye, has suggested that new COVID-19 regulations should be subject to judicial oversight (and temporal limitations). South Africa has led the way with the appointment of Justice Catherine O'Regan as the COVID-19 Designated Judge mandated to oversee the protection of personal information and data privacy by public bodies while using mobile phone location data for tracing.
It is too early to tell if Uganda will follow South Africa’s lead. Even so, to deliver data justice, Uganda’s COVID-19 judge(s) would need to investigate how data is managed at all stages of contact tracing: identification; listing; follow up; and discharge; to assess the contract tracing regime against both data privacy safeguards, and a social cohesion principles.
Using the necessity principle, a judge needs to interrogate the design of the contract tracing system in respect to how personal data was anonymised; retained, and what happens to it after the quarantine ends. Data collection and transmission should not go beyond what is necessary to meet public health aims of reducing COVID-19 infections. By linking de-anonymised identifiers like phone numbers to (home) location data for example, the data fails the necessity test.
Regarding reintegration strategies, the inquiry could draw on Principle 3 (f) Data Protection Act on transparency and participation of individuals in the processing of personal data including by non-automatic methods, and apply social cohesion principles of transparency and participation. Transparency begins with communication, using orality and local languages. So, measures to protect data and privacy of individuals, and communal interests should be explained in local languages. Similarly, individuals and locals should participate in discussions on tracing, including reintegration after names are removed from the follow up list. To guarantee data justice, judicial oversight needs to test the current contact tracing regime against necessity, transparency and participation principles. This approach should also be extended to contact tracing apps whose effectiveness is yet to be demonstrated.
*The views expressed in this entry belong entirely to the author.