Unwanted Witness Uganda, a non governmental organisation last week released a report implicating SafeBoda – a motorcycle transport company that operates in Uganda, Kenya and Nigeria – in sharing their client’s personal data with third parties without their knowledge or permission as required by Section 7 of the Data Protection and Privacy Act of Uganda, raising legal issues as well as questions of trust.
The civil society organisation discovered that the SafeBoda app was sharing data with Facebook without the consent of the users. The startup used a Facebook business tool known as a Software Development Kit (SDK) that the social media giant uses to regularly fetch data from SafeBoda’s users through the ride-hailing app.
“The SDK collected information on SafeBoda users and sent it to Facebook servers, regardless of whether they were Facebook users or not; this meant that even if the user didn’t have the Facebook app installed on their phone or a Facebook account, the SafeBoda app would still send data to Facebook.”
Following the revelation, Unwanted Witness contacted SafeBoda for clarification, which prompted them to remove Facebook trackers from the application.
“Safeboda then proceeded to install a new tracker CleverTap. This App provides mobile app analytics – this means that every time a user uses the SafeBoda app, it still sends users’ data to CleverTap, a third-party, without their consent. It is not the first time CleverTap has been involved in cases of sharing users’ data without their consent. Privacy International, a charity based in London that works at the intersection of modern technologies and rights, discovered this tracker in menstruation applications. The users’ data that’s shared include: the user’s phone type, phone contact number, email address, location, time-zone, user-names, and their carrier (Internet Service Provider).”
Dorothy Mukasa,the Executive Director of Unwanted Witness Uganda said companies like SafeBoda must abide by the law, and the law demands transparency because users deserve to know what companies are doing with their data and companies are legally obliged to tell them.
“Safeboda should offer users a genuine choice to consent to the processing of their data for marketing and analytics purposes, including via third parties like Clevertap that may act as processors. Bundling consent negates users choice and it should have clear comprehensive privacy policies and these should be strictly enforced.
Safeboda in Uganda has over 20,000 riders and thousands of users.
Do you have a story in your community or an opinion to share with us: Email us at firstname.lastname@example.org