Why Uganda’s first prosecution under data law is a big step for privacy rights
Uganda has, for the first time, convicted someone under its data protection law.
This marks an important milestone as the country begins to crack down on how personal information is handled in the digital age.
The Personal Data Protection Office (PDPO), the body that oversees enforcement of the law, confirmed that the conviction followed years of monitoring and failed warnings issued to the offender.
The case involved the misuse of personal information in a digital lending business.
The man convicted is Ronald Mugulusi, a director at Nano Loans Microfinance, which operates the mobile lending app Quickloan.
He was found guilty of failing to register with the data authority and of using a borrower’s personal information without permission.
Investigators said he shared a video via WhatsApp that showed a customer’s name, photograph and phone number, threatening to post it on TikTok if the person did not repay a loan.
The incident, which occurred in Kampala, prompted a criminal investigation led by Uganda’s data office in collaboration with police and state prosecutors.
After pleading guilty and agreeing to a plea bargain, Mugulusi was fined 300,000 Ugandan shillings (about 80 US dollars) by a court in the capital.
“This conviction sends a strong and clear message that non-compliance with data protection and privacy obligations is a criminal offence and will be prosecuted,” said the PDPO in a public statement.
Uganda’s Data Protection and Privacy Act came into effect in 2019 but had not been used in court until now.
Meanwhile, Kenya has also moved to tighten data privacy rules, introducing new draft regulations in late 2023 as governments across Africa step up enforcement in the digital space.
This story is written and edited by the Global South World team, you can contact us here.
