"This report has documented the surveillance measures and practices in Kenya and Uganda during the first year of the COVID-19 pandemic. The key trends include poor oversight over COVID-19 data collection, the lack of independent data protection authorities, the use of telecommunications data to ‘t
...
rack and trace’ individuals, the surveillance of public spaces using CCTV and biometric technologies, the possession of broad search powers by medical and public health officers, and a lack of transparency and accountability by state and nonstate actors. Also, the coronavirus apps deployed in both countries presented new challenges including their limited impact and effectiveness, non-compliance of the apps with privacy standards, their inadequate privacy policies, and a lack of transparency in partnerships. While international human rights law and the constitutions in both countries guarantee the protection of the rights to privacy, data protection, and freedom of expression and information, these were not complied with during the pandemic period. The result is an overall expansion of the surveillance environment in Kenya and Uganda, leading to interference with, and infringements and violations of these rights, a situation which is worrying if left unchanged." (Conclusion, page 20)
more
"Between 2016 and 2021, 68 shutdowns have been documented in 29 African countries. This demonstrates that government-mandated internet disruptions are an established norm in the region, despite very little scientific or social evidence demonstrating their effectiveness. A number of pointers and fact
...
ors signal the likelihood of an internet shutdown occurring. These include jurisdictions with authoritarian regimes, the duration of a president’s term in office, facilitating laws and policies, protests, national exams, and the election season. In practice, shutdowns are typically ordered by the executive arm of government and implemented by private actors, namely telecom operators and internet service providers (ISPs). Six primary methods are used to implement full and partial shutdowns, including throttling, IP blocking, mobile data shutoffs, domain name system (DNS) interference, server name identification blocking, and deep packet inspection (DPI)." (Executive summary)
more
"This report assesses the extent to which the public participated in three recent ICT policy and law-making processes. These include the National Information Communications and Technology (ICT) Policy, 2019, the Computer Misuse and Cybercrimes Act, 2018, and the Data Protection Act, 2019 [...] Gener
...
ally, the government is yet to put in place a holistic, multi-disciplinary, multi-stakeholder, mechanism for public participation. For example, the Public Participation Bill, 2019 which could provide the framework for effective public participation, has not yet been enacted. Specifically, the three ICT processes were marked by cross-cutting inconsistencies in the interpretation and application of public participation. State agencies failed to: inform the public with objective, baseline research to enable stakeholders to understand the problem or need to be addressed by a process, and solutions proposed; consult stakeholders, and provide them with sufficient time to contribute to public calls for input, or give feedback on the consideration of stakeholder submissions; involve stakeholders to contribute to the processes from the beginning, avail equal opportunities for different stakeholders to contribute to the processes, or avoid duplication of processes; and, collaborate with stakeholders in decision-making to ensure consensus and balancing special interests against stakeholders’ inputs, evidence and facts." (Executive summary)
more
"Of the eight countries surveyed here, only four have comprehensive data protection privacy acts in place: Kenya, South Africa, Togo and Uganda. But as these research reports suggest, this is not necessarily a strong indicator of whether a country is committed to privacy rights, or of the efficacy o
...
f a country’s legislative environment in ensuring the right to privacy and data protection. Instead, reading across the reports, what can be described as an asymmetry between legislation and practice is evident at different levels. This asymmetry can be political – for example, Togo, an effective constitutional dictatorship marked by fierce government crackdowns on opposition and recent reports of surveillance of religious and political leaders, enacted a data protection law in 2019, and is one of the few countries in Africa to have ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention). Yet, as the country author suggests, “This interest [by policy makers in digital rights] is not necessarily to protect the citizens but rather out of concern to adapt state policies to the global digital situation.” This asymmetry also concerns the regulatory framework for the implementation of a data protection act. Amongst the countries surveyed here, South Africa was the first to pass a protection of personal information act (in 2013), but still has not implemented the necessary regulations to give practical force to the law. In contrast, while Nigeria’s privacy law is still in draft form, it already has what the country author describes as “watershed” privacy regulations." (Introduction, page 5)
more