Introduction

In today’s era of rapid technological advancement, it is crucial to examine the changes it has introduced and the legal frameworks governing technology in various jurisdictions. Technologies such as Artificial Intelligence (AI) have created significant opportunities, including innovation, digitalisation, and enhanced global connectivity, with notable impacts in Africa. While digitalisation offers immense benefits, it also poses risks, particularly to the right to privacy. AI, in its quest to drive technological progress and innovation, has the capability to access both accurate and inaccurate information, massive collection of data often to the detriment of data users. This raises concerns about the potential abuse of privacy rights, as AI systems can inadvertently or intentionally compromise individuals’ personal data.

This article explores the impact of Artificial Intelligence on data protection and privacy in Uganda. It will highlight the relevant provisions of Uganda’s data protection laws and discuss the necessary reforms to enable AI and privacy rights to coexist harmoniously. Additionally, the article will examine the European Union’s AI Act and its role in safeguarding data rights. Finally, the article will conclude with recommendations to ensure that technological innovation does not come at the expense of individual privacy rights.

What are the rights of data subjects according to Uganda’s Data Protection Laws.

 In order to establish the rights of data subjects, it’s prudent to ascertain the principles of data protection which shall be the basis of the analysis. These principles are; accountability, fair and lawful collection of data, adequate and relevant personal data collection, retention of data in its stipulated time, quality and transparency of data and security safeguards in respect of the data.

Data protection and privacy in Uganda are governed by the Data Protection and Privacy Act, Cap 97 (DPA), which derives its foundation from Article 27 of the Constitution of Uganda. Article 27 guarantees a person’s right to privacy, and the DPA further elaborates on the rights of data subjects, as discussed below.

The Right to Access Personal Information

Section 24 of the DPA grants data subjects the right to access their personal data. This includes details about the data itself, its description, and information on any other person or entity that has had access to it. In ensuring this right, the data controller plays a critical role by protecting both the data subject’s rights and the rights of any other individuals who might be affected by such access.

The advent of Artificial Intelligence (AI) systems has introduced challenges to strict adherence to these protections. For instance, AI systems may withhold information, provide inaccurate data, or otherwise fail to ensure transparency, thereby jeopardizing the rights of data users and increasing the risk of data breaches.

To address these challenges, lawmakers should consider amending the DPA to include specific provisions requiring AI systems to disclose how they process data. Such amendments should promote transparency, allowing data subjects to understand how AI models use their data and to challenge AI-driven decisions effectively.

 Rights in Relation to Automated Decision-Making

Section 27 of the DPA aims to safeguard data subjects against decisions made solely through automated processes without human oversight. This provision recognizes that automated decisions, particularly those driven by AI, can result in inaccurate outcomes or unfair conclusions due to inherent biases within the AI system.

To mitigate these risks, high-risk AI systems should be designed to incorporate effective oversight by natural persons during their operation. Although this provision predates the widespread use and evolution of AI, it remains relevant in ensuring that decisions made through AI systems uphold fairness, accountability, and the rights of data users.

Rectification, blocking, erasure and destruction of personal data.

Section 28 of the DPA emphasizes the collection and processing of accurate data. It provides that any inaccurate data can be erased, updated, or rectified by the relevant authorities, with such corrections communicated to affected parties.

The process of rectification or erasure is typically carried out by a data controller under the instructions of the relevant authority. This requires direct human intervention to establish and investigate the inaccuracies before making any changes. However, with the increasing reliance on AI systems to perform such tasks, there is a risk that these systems may not handle privacy concerns or transparency as effectively as human oversight.

AI systems may erroneously delete critical data or replace it with incorrect data if not properly regulated or ethically managed. Furthermore, AI lacks the nuanced understanding required to address complex privacy issues, potentially compromising the quality and accuracy of such operations.

To address these challenges, legislators should ensure that AI systems are designed to accommodate requests for data updates and deletions with clear, transparent procedures for processing such requests. Additionally, human oversight must be mandated for AI systems to ensure compliance with data protection principles, safeguarding accuracy and accountability.

What is the role of the EU AI Act in safeguarding data rights.

The EU AI Act seeks to balance innovation with the protection of fundamental rights, establishing a global benchmark for AI governance. It prioritizes fairness, non-discrimination, privacy, and safety while fostering innovation by categorizing AI systems based on risk. This framework positions the EU as a leader in ethical, human-centric AI and sets the stage for global standards. It also encourages other jurisdictions to adopt similar approaches, promoting responsible AI development worldwide. The EU AI Act has several provisions within it to ensure that the data rights of users are protected among these are;

Transparency and Accountability

The EU AI Act imposes obligations on providers and deployers to ensure transparency in both complex and less complex AI systems. Providers must design AI systems that interact with individuals in a way that makes it clear to those individuals that they are engaging with an AI system. This requirement promotes transparency and helps build trust between users and AI systems.

Data Governance

The EU AI Act establishes provisions to ensure robust data governance, quality, and management, aligning with the principles of fairness, accuracy, and transparency. These provisions apply particularly to high-risk AI systems and address practices such as: Identifying and addressing data gaps or shortcomings; ensuring proper data collection practices and documenting the origin of the data; assessing the suitability of datasets for their intended purposes; and formulating and validating assumptions against the information that the data is intended to measure and represent. By addressing these aspects, the Act seeks to mitigate risks associated with biased or inadequate data, ensuring AI systems operate ethically and effectively.

Human Oversight.

The EU AI Act also ensures that high-risk AI systems must be designed to allow for human oversight during their operation. It ensures that human judgement can intervene when necessary, preventing adverse outcomes that could infringe on individuals’ rights, including data protection rights.

Conformity with Data Protection Laws

The EU AI Act also points out how AI systems should not only conform to existing data protection laws but also ensure that the right to personal data protection is safeguarded through complying to data protection standards hence ensuring the safeguarding of data rights.

Conclusion and Recommendations.

The integration of Artificial Intelligence into various sectors offers tremendous opportunities for innovation and development, but it also poses significant challenges to data protection and privacy in Uganda. The Data Protection and Privacy Act (DPA) provides a foundation for safeguarding these rights; however, it requires amendments to address AI-specific concerns. Explicit provisions mandating transparency in AI data processing, enabling individuals to challenge AI-driven decisions, and strengthening accountability through human oversight are essential to ensure fairness and accuracy. Drawing inspiration from the European Union’s AI Act, Uganda can adopt best practices that emphasize transparency, fairness, and the alignment of AI systems with existing data protection laws.

To harmonize innovation with privacy protection, Uganda should also strengthen data governance practices by addressing data gaps, ensuring accurate data collection, and validating assumptions in AI processes. Promoting public awareness and building capacity among AI developers, regulators, and the public is critical for fostering trust and compliance with privacy laws. By implementing these measures, Uganda can create an environment where technological advancements coexist with robust data protection, ensuring that individual privacy rights are upheld in the age of AI.

About The Author

Paul Kwiringira

See author's posts