Ssekamwa Frank & 3 Others v Google LLC

A landmark decision testing whether a global technology company providing digital services to Ugandan users is subject to Uganda’s data protection framework, and securing concrete compliance from one of the world’s largest technology companies.

Case background

The complaint concerned Google LLC’s collection, use, and international transfer of the personal data of people in Uganda. The complainants challenged Google’s failure to register with the Personal Data Protection Office and its transfer of their personal data outside Uganda without demonstrating compliance with the safeguards governing cross-border data transfers under Ugandan law.

Brief facts

Our founding Executive Director, Frank Ssekamwa, together with Sharon Pamela Leni, Raymond Amumpaire, and Mercy Awino, filed a complaint alleging that Google collected and processed their personal data, including names, email addresses, dates of birth, online identifiers, browsing histories, location data, and health data, through services offered in Uganda while remaining unregistered.

The complainants had attempted to raise concerns directly with Google but received no response. Google acknowledged that it provided services to users in Uganda and processed their data, but argued that it was not required to register because it was not physically located in Uganda.

Issues

• Whether Google LLC qualified as a data controller, collector, or processor under Ugandan law.
• Whether Google was required to register with the PDPO and whether its failure to do so was a violation.
• Whether Google’s transfer of personal data outside Uganda breached cross-border transfer requirements.
• Whether Google’s conduct caused or was likely to cause damage or distress to Ugandan users.

Holding

The PDPO found that Google LLC was both a data processor and data collector. It held that registration under section 29 of the Act and regulation 15 was mandatory, and rejected Google’s argument that the law applied only to entities physically based in Uganda, noting that the Act expressly applies to persons outside Uganda that process the personal data of Ugandan citizens. On cross-border transfers, Google had not provided records demonstrating compliance and was found in breach of section 19 and regulation 30.

Orders

• Declared Google LLC a data collector and data processor under Uganda’s Data Protection and Privacy Act.
• Ordered Google to register with the PDPO within 30 days and provide the details of its Data Protection Officer.
• Ordered Google to submit documentary evidence of its cross-border data-transfer compliance framework.
• Held that the PDPO lacked jurisdiction to award compensation, which would have to be pursued before a court.

Impact

Concrete compliance. Following the decision, Google LLC registered with Uganda’s PDPO and complied with the regulatory orders, demonstrating that Uganda’s framework can be enforced against even the world’s largest technology companies.

A precedent for accountability of foreign entities. Foreign entities cannot avoid Ugandan data protection obligations merely because they lack a physical presence. This precedent is increasingly relied upon nationally and regionally to pursue accountability from foreign digital platforms operating across African markets.

Exposing gaps and informing reform. The case exposed weaknesses in Uganda’s framework, including the regulator’s inability to award compensation or impose proportionate sanctions on large multinationals, gaps now informing policy dialogues on reform.