Data privacy violation conviction reached in historical Ugandan court case
Uganda's Personal Data Protection Office Takes Action Against Google and Local Business
Uganda's Personal Data Protection Office (PDPO) has made significant strides in enforcing data protection laws, with two notable developments in recent months.
Firstly, Ronald Mugulusi, director of digital lending company Nano Loans Microfinance and operator of the Quickloan app, has been criminally convicted for breaches of Uganda's Data Protection and Privacy Act of 2019. Mugulusi failed to register his company with the PDPO and unlawfully processed individuals’ data without consent or legal justification. This conviction marks the first-ever criminal enforcement action under Uganda’s six-year-old data protection law.
Secondly, Google LLC has been ordered to register as a data controller and data collector within 30 days by the PDPO. This decision was prompted by a complaint filed by four Ugandan citizens who alleged that Google operated without proper registration and transferred personal data outside Uganda without adequate safeguards, violating the Data Protection and Privacy Act. The PDPO found that Google qualifies as a data controller and collects a broad range of personal data.
While the PDPO currently lacks powers to impose binding fines or compensation, these actions demonstrate a firm commitment to holding data controllers and processors to account. The decision against Google serves as a precedent for enforcing compliance by global tech companies with Uganda’s data protection laws.
The PDPO's action against Google is a reflection of its increased enforcement efforts. The decision was sparked by a complaint submitted by four citizens in November 2024, alleging that Google had processed their data without registering with the PDPO and had transferred their data outside of the country without complying with the Act.
In addition, the PDPO has ordered Google to provide contact details of its designated Data Protection Officer. The PDPO has also ordered Google to submit within 30 days evidence of its compliance procedures for the cross-border transfer of Ugandan citizens' personal data.
The PDPO's acting national personal protection director, Baker Birikujja, has emphasized the importance of victims providing evidence and following through to prosecution in such cases. He commended the complainant's courage in pursuing the case against Mugulusi to the end and stated that this conviction shows that when victims cooperate, offenders can be held accountable.
These developments demonstrate Uganda’s commitment to data protection and privacy, sending a strong and clear message that non-compliance with data protection and privacy obligations is a criminal offence and will be prosecuted. The PDPO's actions are intended to protect the rights and privacy of Ugandan citizens in the digital age.
- The PDPO's order for Google to register as a data controller and data collector within 30 days underscores the increasing role of technology in data management, emphasizing the need for global tech companies to comply with Uganda’s data protection laws.
- The PDPO's actions against data breaches, such as the conviction of Ronald Mugulusi and the case against Google, underscores the importance of technology in protecting personal data, demonstrating a commitment to enforcing data protection laws in the digital age.
