This article was originally published on the website of APC member organisation Unwanted Witness.
Unwanted Witness Uganda welcomes the first-ever data protection investigation report by the Ugandan data regulator, National Information Technology Authority, Uganda (NITA-U), into the operations of Guinness Transporters Limited, trading as SafeBoda. NITA-U has ordered SafeBoda to make fundamental reforms regarding sharing of people’s personal data with third parties.
SafeBoda has until the end of May 2021 to amend its privacy notices so that people can be provided with specific and informed consent, in particular, to clearly inform its customers of the third parties it may disclose their personal data to, in accordance with the principle of fairness under section 3(1)(b) of the Data Protection and Privacy Act, 2019. NITA-U further requires SafeBoda to specify safeguards in place for cross-border transfer of personal data.
SafeBoda unlawfully shared clients’ data with a US company, according to an investigation by National Information Technology Authority – Uganda (NITA-U).
The boda boda ride app, according to NITA-U, withheld information from customers that it was sharing their data with CleverTap, a US-based data processor.
This, NITA-U said in an investigation, contravenes data protection law and the laws of Uganda.
The investigation report, authored by NITA-U into allegations of unlawful sharing of SafeBoda customer personal data by Guinness Transporters, which trades as SafeBoda, found that the transport company failed to disclose third party recipients of customer information.
“The SafeBoda privacy policy and data protection policy versions of 2017 and 2019 respectively did not provide information on recipients with whom its users’ personal data will be shared,” the report reads in part.