Unwanted Witness Uganda, a non governmental organisation last week released a report implicating SafeBoda – a motorcycle transport company that operates in Uganda, Kenya and Nigeria – in sharing their client’s personal data with third parties without their knowledge or permission as required by Section 7 of the Data Protection and Privacy Act of Uganda, raising legal issues as well as questions of trust.
“We carried out research about SafeBoda’s privacy policy and its practice. When reviewing their privacy policy and comparing it to how the app actually operates, a number of discrepancies were identified,” Unwanted Witness said in its report.
The civil society organisation discovered that the SafeBoda app was sharing data with Facebook without the consent of the users. The startup used a Facebook business tool known as a Software Development Kit (SDK) that the social media giant uses to regularly fetch data from SafeBoda’s users through the ride-hailing app.
“The SDK collected information on SafeBoda users and sent it to Facebook servers, regardless of whether they were Facebook users or not; this meant that even if the user didn’t have the Facebook app installed on their phone or a Facebook account, the SafeBoda app would still send data to Facebook.”
Following the revelation, Unwanted Witness contacted SafeBoda for clarification, which prompted them to remove Facebook trackers from the application.
“Safeboda then proceeded to install a new tracker CleverTap. This App provides mobile app analytics – this means that every time a user uses the SafeBoda app, it still sends users’ data to CleverTap, a third-party, without their consent. It is not the first time CleverTap has been involved in cases of sharing users’ data without their consent. Privacy International, a charity based in London that works at the intersection of modern technologies and rights, discovered this tracker in menstruation applications. The users’ data that’s shared include: the user’s phone type, phone contact number, email address, location, time-zone, user-names, and their carrier (Internet Service Provider).”
Dorothy Mukasa,the Executive Director of Unwanted Witness Uganda said companies like SafeBoda must abide by the law, and the law demands transparency because users deserve to know what companies are doing with their data and companies are legally obliged to tell them.
“Safeboda should offer users a genuine choice to consent to the processing of their data for marketing and analytics purposes, including via third parties like Clevertap that may act as processors. Bundling consent negates users choice and it should have clear comprehensive privacy policies and these should be strictly enforced.
“The company should exhaustively specify the third-parties and the exact personal data it shares with them in its privacy policy. It is recommended that efforts be taken to establish “pathways” that can be followed by data subjects to allow them, if interested, to understand how their personal data may be being processed by the company and any third parties,” said Ms Mukasa.
Safeboda in Uganda has over 20,000 riders and thousands of users.
Do you have a story in your community or an opinion to share with us: Email us at Submit an Article
