Contact-Tracing in Africa Faces Unusual Challenges

By Maureen Nkatha

Are contact-tracing apps the answer to reducing the spread of COVID-19 infections in Kenya?

Continued concerns among citizens and digital privacy advocates have raised questions on whether Kenyans are ready to risk their privacy to curb the spread of coronavirus in the East African nation.

Among the laws in place to combat cybercrime in Kenya include last year’s Data Protection Act and the 2014 policies developed from the African Union’s Malabo Convention.

But Malcolm Kijirah told Digital Privacy News that implementing these laws remained a challenge in Kenya. A lawyer in private practice, he also is a research fellow at the Centre for Intellectual Property and Information Technology Law at Strathmore University in Nairobi.

Kenya recently launched a contact tracing app, mSafari, to help trace movements of suspected COVID infections. Are apps valuable in reducing the spread of coronavirus infections? 

On the face of it, you would think that it would have a net benefit and overwhelming public value.

However, the automation of this process can serve as an opportunity for its abuse from a data-privacy perspective, which could reduce their value and uptake.

When one looks at its utility and effectiveness as a whole in Kenya, there are challenges.

For example, if you consider mSafari’s ambit (it is used only for tracking passengers using public-service vehicles), what will its overall impact be, seeing as not all Kenyans use public transport?

Beyond mSafari, if you consider the uptake of all apps in general, how many Kenyans have access to smartphones to be able to download them, notwithstanding those that aren’t inclined to participate because it’s their “civic duty”?

We can take it even a step further and consider awareness: How many Kenyans have even heard or read of contact-tracing apps?

That said, yes, I do think they are a tool in reducing the spread of COVID-19 infections.

However, gaining broad Kenya-wide support for these apps requires their perceived public-health benefits to outweigh concerns of personal privacy, security and potential risk of harm.

What other challenges are involved?

It is important that apps aren’t used as the sole contact-tracing measure.

In a country where the technology penetration rate isn’t as high, it is important that they are used only as a tool to supplement the manual and labor-intensive, detective-like work of contact-tracing.

Can the Kenyan government’s surveillance measures during contact-tracing cause privacy abuses?

Absolutely. In this instance, I rely on the age-old adage that “experience is the best teacher.”

We only need to review how the public’s digital rights have been threatened through the introduction of other programs and legislation in Kenya.

The introduction of systems, programs or laws that affect citizens’ privacy have been plagued by issues around data-protection, and the opaque implementation of programs.

With the contact-tracing app, the public does not have access to information on the system design, architecture or other relevant information on how their privacy rights are safeguarded. 

Many African governments are increasingly using the internet to monitor citizens’ political benefits. Can the information from contact-tracing be used for such purposes?

Yes.

More broadly, Africa has seen a significant increase in internet users as well as cybercrimes in recent years. Does the continent have what it takes to combat these attacks and ensure data security for everybody?

Absolutely, it does. That may appear to be a naïve answer, however.

I have and continue to have confidence in the infinite potential of Africa and Africans themselves.

However, will not be an immediate change.

It will take considerable financial and human-resource allocation to this issue: activism, education and awareness, private-public partnerships and — importantly — the political and administrative leadership, will and expertise by the government to implement a conducive regulatory environment.

Cybersecurity is a dynamic issue and requires all the above entities and factors to be “switched on” 24/7. 

Many African governments often implement partial or total internet shutdown during or after elections — or in response to protests. Do these actions go against citizens’ rights?

Absolutely. The word “democracy” literally means rule by the people. The term is derived from the Greek dēmokratiā, which was coined from dēmos (people) and kratos (rule).

Elections are meant to be free and fair and conducted under democratic principles: by the people, for the people.

The implementation of partial and total internet shutdowns to curb information-sharing, censor politically unfavorable views … is a violation of citizens’ digital rights.

Beyond digital rights, they go against the very principle of democracy and are diametrically against the rule by the people.

Can people control their personal information and how it’s shared or used?

Not without the rule of law. It is paramount that there is an active, dynamic, enforceable regulatory regime to ensure that citizens have this control.

What does a fair and inclusive digital world look like?

One where digital rights are accepted and enforced unequivocally as fundamental human rights, including where barriers to accessing digital services — based on gender, disability, location, poverty — are addressed and eradicated.  

Maureen Nkatha is a writer based in Nairobi, Kenya.

Sources (external links):

• The Star: Respect Kenyans’ privacy during contact tracing, state warned
• Standard Media: App uses passenger data to trace virus path
• Afrisig: Data Protection within the Digital Age
• Mondaq: Data Protection In Kenya – What You Need To Know – Privacy – Kenya
• CIPIT: Centre for Intellectual Property and Information Technology law