A proposed health data-sharing deal between the United States of America (USA) and Uganda has triggered alarm over privacy, sovereignty, and legal clashes.
Critics warn that the agreement could hand the US government unchecked access to sensitive health records, side-lining Uganda’s own regulators and laws. The pact stems from a proposed memorandum of understanding (MoU) on health collaboration, pushed by the US government. It targets African countries that are currently struggling to sustain their health systems due to a decline in donor funding over the years, worsened by the recent dismantling of the US Agency for International Development (USAID) by the Trump administration.
Uganda has been heavily reliant on foreign donations to fund its health system, despite government records showing that over Shs9 trillion — equivalent to the health sector budget for two years — is lost to corruption per year. This pact’s core is a 25-year Data Sharing Agreement granting the US government direct entry into Uganda’s digital health systems. The pact’s preamble nods to mutual benefits. ‘This agreement aims to ensure transparency, accountability, and the effective use of resources to achieve shared objectives in health, while delineating the understandings and intentions of the parties regarding the storage, access, protection, and use of data,’ reads the proposed MoU. Uganda, according to the proposed MoU, will be able to build a ‘durable and resilient health system,’ due to funding and human resource support provided by the US government as per the agreement.
In turn, it will manage to curb global health threats and reduce the burden of common diseases like HIV, malaria, and tuberculosis in the countries of interest, like Uganda. Both parties celebrate gains. However, legal and data safety experts appear unconvinced and sense many risks. Ms Anifa Kawooya Bangirana, the State Minister for Health, confirms that discussions are ongoing between the two countries, but deflects when asked how far this has gone and the implications. ‘My senior Minister of Health, Dr Jane Ruth Aceng, is the one who has been following up and working closely, and she is the one who has to sign,’ she told Daily Monitor. Dr Aceng was unwilling to comment on the matter when our reporter reached out to her. Kawooya’s deferral to Dr Aceng signals caution.
Data sovereignty questions
Mr Gilbert Ssettuuma, a legal officer at the government’s Personal Data Protection Office (PDPO), describes the US government’s proposal as a power grab. ‘Looking at the MoU – what we have been calling the Proposed Data Sharing Agreement — one of the clauses says that it will be construed in accordance with US federal law,’ he explained in a Thursday night X space discussion on the matter, organised by Lawpoint Uganda. ‘The essence of this basically is that it is going to undermine the role of any regulator in any of those African countries where it will be signed,’ he adds. In this agreement, he states, the US government does not recognise Uganda’s PDPO.
‘So basically, they are taking away the regulator’s role, and Ugandans whose data is being transferred or used in any way will not have anywhere to run to.’ Mr Ssettuuma says the deal demands ‘real-time access to our health information systems,’ yet it ignores Uganda’s new Digital Health Guidelines, released in September, by the Ministry of Health. The Digital Health Guidelines set strict interoperability standards -how systems exchange data while staying secure. ‘And looking at the MoU, many of those have not been given due regard,’ Mr Ssettuuma says. He fears a clash. ‘Now, without such standards being met, we run the risk of, first of all, the US systems and our own colliding. And who suffers at the end of it? All that is our personal information, which is being traded for foreign aid.’ Ms Joanita Nagaba, a lawyer and Artificial Intelligence (AI) policy researcher, perceives more serious threats.
Her non-profit organisation, Uzawi Initiative Limited, focuses on AI, society, and democracy. She describes the deal as a full overhaul of Uganda’s health system. ‘It will introduce an electronic data management system, a pharmacy management system, and a laboratory management system. It will also ensure that we have a national data warehouse,’ she says. The US gets keys to it all, according to experts. ‘These systems are data-intensive. They will be collecting a lot of special personal data under the Data Protection Act, specifically health data,’ Ms Nagaba warns. That includes HIV status, tuberculosis records, and data on pregnant and breastfeeding women on antiretroviral drugs (ARVs).
‘It is very unfortunate that we are having this discussion a few days after commemorating World Aids Day. Here we are, trying to negotiate an agreement that risks undermining the data of patients, or rather, people who are living with HIV,’ she observes. Privacy, she stresses, enables other rights. ‘Data protection and privacy are enabling rights for other fundamental human rights. Without them, association and expression could suffer.’ Ms Nagaba also fears AI misuse. ‘It is possible that this personal data could be used to train AI systems, and we do not know what decisions these systems could make about Uganda’s citizens,’ she notes.
Content of proposed agreement
Signing the MoU will grant the US ‘secure, uninterrupted access to Covered Data Systems’ for 25 years.
‘This includes provision of login credentials of other secure access mechanisms, maintenance of system functionality to ensure data availability, notification of any planned system outages or updates that may affect access,’ the proposed MoU reads. Under data use and confidentiality, the MoU states that the US government shall use the data accessed under this agreement solely for purposes consistent with metrics or activities referenced, such as performance metric monitoring and audits.
‘Data provided will be archived, stored, or disposed of in accordance with US federal records requirements. The US government shall take all reasonable measures to protect the confidentiality of information contained within the Covered Data Systems in accordance with US data protection standards,’ the proposed MoU further reads.
‘Where covered data are potentially identifiable, the US government agrees to maintain the confidentiality of the covered data to the fullest extent required by US laws,’ it reads further. Ownership stays with Uganda, according to the MoU. ‘The US government acknowledges that [INSERT COUNTRY NAME] retains sole ownership of the data,’ the deal states. But experts say granting the US government that level of access would mean Uganda has lost control. ‘In other words, individuals and the country at large lose control of their personal data. So, what it is basically doing, and the way it is being negotiated by our authorities, is putting the cart before the horse,’ Mr Ssettuuma argues, calling the timing reckless.
The MoU paints a rosy picture. It cites 20 years of US aid saving ‘hundreds of thousands’ of lives and strengthening the health system in the country of interest. It promises to fund Uganda’s health sector, which has been heavily relying on foreign donations, contributing over 50 percent of its total budget. The country’s health sector is buckling under a catastrophic drop in donor support, with external (donor) funding for the national health budget declining from 49 percent in 2022 to 23 percent this year, according to a joint report by the Uganda National NGO Forum and the Centre for Health, Human Rights and Development (CEHURD). The sharp decline in donations, amid insufficient increases in domestic resource allocation to plug the gaps, and increasing health needs, the report shows, has eroded service quality and left many vulnerable Ugandans struggling to access essential care.
The goal of the MoU, according to the preamble, is to strengthen disease detection, prevention, and response to existing and emerging infectious diseases. But critics see the aid as bait.
‘I understand that we find ourselves between a rock and a hard place. Efficient systems need funding, yet rights hang in the balance. We need the funding, but we risk undermining other fundamental human rights, including the right to protect personal data,’ Ms Nagaba admits.
Mr Ssettuuma echoes the trade-off, saying databases must meet security thresholds for data movement. ‘I would expect this MoU to take into account such things, and maybe make mention of them in the same document. But this is not the case,’ he cautions.
The deal prefers aggregated data. ‘To the maximum extent practical, should not provide individual-level data or personally identifiable information,’ it reads. However, Ms Nagaba sees collective stakes. ‘Over time, we have looked at data protection as an individual right, but it has collective benefits for the country. The pact attempts to undermine data sovereignty in Uganda. That is why it is very important that we continue having these discussions and also hold our ground as far as protecting personal data,’ Ms Nagaba urges. For Ugandans, the risks hit home. HIV patients, malaria cases, and mothers on treatment are all exposed if safeguards fail.
In the proposed MoU, the US promises confidentiality ‘to the fullest extent required by US laws.’ Yet 25 years of access feels eternal, and system upkeep falls to Uganda. This includes accuracy, timeliness, and security. ‘Who is the data protector? Who is the data processor? Who is the data controller? Who is the data subject? What rights do they have and how can they ensure these rights are protected?’ Ms Nagaba asks. Mr Ssettuuma sees a collision ahead. ‘We are putting ourselves on a collision course, first, with the existing laws, but then undermining the rights of people whose information is going to be shared,’ he says.
Ms Nagaba wants Ugandans to not only focus on the negative.
‘If you cannot get an efficient system and provide the health services that we should be providing to a certain standard, we risk undermining other rights, such as the right to health,’ she notes.