A lawyer has accused the Electoral Commission (EC) of unlawfully collecting, processing, and storing voters’ personal data despite not being registered with the Data Protection Office, as required by law.
In a petition dated January 7 and addressed to the EC chairperson, Mr Michael Aboneka argued that Section 29 of the Data Protection and Privacy Act, 2019 mandates all entities that collect, process, or store personal data to register with the Personal Data Protection Office.
Mr Aboneka said the Commission routinely handles sensitive personal information of Ugandans during voter registration and management of the national voters’ register, including biometric data and national identification details such as age, date of birth, and location, hence needs to be registered.
‘However, the Commission is not registered as a data collector, processor, and controller,’ Mr Aboneka states in his petition. He argues that while the EC is a constitutional body entrusted with safeguarding citizens’ data, it must still comply with the country’s data protection framework.
Mr Aboneka has demanded that the Commission immediately register with the Data Protection Office to ensure the safety of his personal data and that of other registered voters.
‘The purpose of this communication is to demand that the Electoral Commission immediately comply with the law. Take note that failure to act shall leave me with no option but to pursue appropriate legal remedies available under the law to ensure full compliance,’ the petition reads.
When contacted, the EC Spokesperson, Mr Julius Mucunguzi, said the Commission is aware of data protection requirements and uses voters’ data in accordance with the law.
‘The Commission is very cognizant of the need for data protection and uses the data collected in line with the laws of the land,’ Mr Mucunguzi said.
He added that Article 61 of the Constitution mandates the EC to compile, maintain, and update the voters’ register, and that the Commission remains open to complaints from citizens regarding its operations.
The Data Protection and Privacy Act, 2019, was enacted to regulate the collection and processing of personal data and to protect the privacy of individuals by requiring accountability from data handlers.