The Uganda Internet Governance Forum (UIGF) convened at Protea Hotel in Kampala, on August 2, 2024, drew attention to critical issues surrounding digital identities, data protection and their broader implications for the media industry.
This year’s discussions were particularly timely, given the recent data breach at Next Media Services, where a disgruntled former employee leaked sensitive information, including names of staff, their salaries and tax identification numbers (TINs). While the media organisation refuted the information as fake, a quick search on the Uganda Revenue Authority portal shows that the TINs were real.
This incident, alongside the African Centre for Media Excellence (ACME) report examining the impact of Biometric Digital Identity (BDI) programmes on independent journalism in Uganda, set the stage for a deeply reflective and urgent conversation about data governance, privacy, and the future of journalism in a digitised world.
As one of the panellists astutely pointed out, we now live in a “data-fied” world where everything—from our online searches to our daily movements—is reduced to data. This data, however, is not just an abstract concept; it is a commodity, often traded without the knowledge or consent of those to whom it belongs. The question of who benefits from this data, and how it is being used, is at the heart of the debate on digital identities and data justice.
Another panellist emphasised the importance of transparency in data collection, urging organisations to clearly articulate their privacy policies and the intended use of collected data. However, the reality remains that many people, particularly in Uganda, may not fully understand these policies, often due to language barriers or the complex legal jargon used. This raises concerns about informed consent and the power dynamics at play when individuals surrender their personal information.
The recent report by the African Centre for Media Excellence (ACME) on the impact of BDI programs on journalism in Uganda paints a troubling picture. These programmes, while ostensibly designed to streamline identity verification processes, have also facilitated increased surveillance and intrusion into the lives of journalists. The ability of the state to track individuals in real time has had a chilling effect on independent journalism, with many journalists reporting threats and intimidation related to their work.
The report highlights several disturbing trends, including the rise of self-censorship among journalists who fear reprisal for their reporting. This is not merely a theoretical concern; it is a lived reality for many in the field. For instance, an editor from the Acholi sub-region described how the risk of government retaliation has led to a cautious approach to covering stories that may cast the state in a negative light. Similarly, a reporter from central Uganda recounted how an anonymous threat forced them to abandon a critical security story in 2019.
These accounts underscore the profound impact of surveillance on press freedom and the broader implications for democracy in Uganda. When journalists are unable to report freely and fearlessly, the public’s right to information is severely compromised.
The recent data breach at Next Media Services serves as a stark reminder of the vulnerabilities that exist within our increasingly digitalised work environments. This incident highlights the critical need for robust data protection measures within media houses and other organisations. It also raises questions about the adequacy of current digital security practices, particularly in the media sector, which is often at the forefront of handling sensitive information.
Panelists at the UIGF 2024 emphasised the importance of digital resilience, particularly in the media industry. As one panelist pointed out, many media houses have yet to conduct thorough digital security analyses or implement comprehensive data protection policies. The lack of dedicated data protection officers and systems to safeguard sensitive information leaves media organisations vulnerable to breaches, with potentially devastating consequences for both individuals and the institution’s credibility.
In light of these challenges, ACME’s report on BDI programs offers several recommendations aimed at safeguarding media freedom and protecting personal data. These include urging the data protection authority to review ongoing biometric digital ID collection programs to ensure they comply with personal data protection principles, particularly in terms of integrity and confidentiality.
Furthermore, there is a pressing need for journalists and media houses to be equipped with the necessary skills and tools to mitigate the effects of surveillance. This includes the use of encryption, two-factor authentication, and other digital security practices that can help protect against unauthorized access to sensitive information.
