UW-08-22

THE INAUGURAL UNWANTED WITNESS INTER-UNIVERSITY PRIVACY MOOT

COURT COMPETITION

THE REPUBLIC OF UGANDA

IN THE HIGH COURT OF UGANDA

MISCLEANOUS CAUSE N0. 1 OF 2022

MRS. LESLIE GLEN::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: APPLICANT

VERSUS

1. KAPO BODA
2. XP LTD (3RD PARTY)
3. ECXIOM Ltd:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: RESPONDENTS

MEMORIAL FOR THE APPLICANT

COUNSEL

1. NANKINGA JALIA
2. BERNARD OTIM

This matter is brought pursuant to Articles 50 and 139 of the 1995 Uganda Constitution as
amended, Sections 11 and 98 Civil Procedure Act, and Section 33 Data and Privacy Protection
Act 2019.

1
TABLE OF CONTENT

Cover page .............. ............ Page 1

Table of contents..................page 2

List of references..................page 3

List of abbreviations.............page 3

Statement of facts ...............page 4 ,(1.0)

Statement of issues..............page 4, (2.0)

Statement of jurisdiction......page 3- 4, (3.0)

Resolution of issues .............page 4-8, (4.0)

Statement of prayers.............page 10, (5.0)

Bibliography............................page 10

2
LIST OF REFERENCES
STATUTES
National Laws
1. 1995 Constituition as amended
2. Judicature Act cap 13
3. Data protection and privacy Act , 2019
4. Civil procedure Act cap 71
International Laws
1. Universal Deceleration of human rights, 1948.
2. International Convention on civil and political rights, 1966.
INTERNET
Blacks’ law dictionary 11th edition

CASE LAW
1. Ssemakula v Serunjogi (Civil Suit 187 of 2012) [2013] UGHCLD 46 p. 4/5
2. Auto Garage v Motokov (No. 3) 1971 E.A 514
3. Elly B Mugabi vs Nyanza Textile Industries Ltd [1992-93] HCB 227
5. Lubega-Butanaziba v MTN Uganda Limited (Civil Suit 156 of 2009) [2020] UGHCCD 159
6. Uwonda and another v Total E and P (U) Limited (Civil Suit 13 of 2016) [2021] UGHCCD
176

LIST OF ABBREVIATIONS

Ltd……………..Limited

DPPA……………..Data Protection And Privacy Act

3
 1.0 STATEMENT OF FACTS

Mrs. Leslie Glen who was in need of a boda boda, downloaded KAPO BODA application
which required her to create an account by filling in an online form that required her
information including; phone number, first and last name, National Identity Number,
location, political affiliations, marital status and her next of kin and her location to
complete her registration. However in April 2022, she started receiving instantaneous
phone calls with loan offers which lasted over a month and investigations shows her data
Kapo Boda had contracted XP Ltd and gave it access to the data without putting in place
adequate data security measures which led to many security breaches by other trackers
such as XQ, PZ, AP & CPT owned by ECXIOM Ltd a company based in the Republic of
Tanzania were used to collect more information from KAPO application users without her
knowledge, Mrs Glen complained to KAPO BODA the National Data protection Office
and Minister of ICT and National guidance but no relief was given.

2.0. STATEMENT OF ISSUES

1. Whether Mrs. Leslie Glen has a cause of action?

2. Whether Mrs. Leslie Glen is entitled to any remedies?

3.0. STATEMENT OF JURISDICTION

1. Jurisdiction means, the power or authority vested in court to decide matters that are
before it or to take cognisance of matters in a formal way for its decision, Ozuu Brothers

Enterprises v Ayikoru1
. One cannot speak of jurisdiction without the power or authority to make a decision on the
merits. To have jurisdiction is to have the power to inquire into the fact, to apply the law
and to declare the relief in a regular course of a judicial proceeding

2. This matter is before court pursuant to Article 502 which allows any person who feels
his or her right or freedom has been infringed upon to apply to a court of competent

1
(CIVIL DIVISION No. 0002 OF 2016) [2016] UGHCCD 60
2
Article 50 of the 1995 Uganda Constitution as amended.

4
 jurisdiction for remedies which may include compensation. Being a matter before the high
court, Article 1393 gives the High court unlimited original jurisdiction over all matters and
such appellate and other jurisdiction as conferred upon it b law. Section 11(1) Civil
Procedure Act4 provides that, except as is provided in this Act or the Magistrates Courts
Act, suits and proceedings of a civil nature shall be instituted in the High Court. Section
33(1)5 gives a data subject whose right to protection of data and privacy has been infringed
upon to apply to a court of competent jurisdiction for compensation for any distress
suffered.

3. In Uwonda and another v Total E and P (U) Limited (Civil Suit 13 of 2016) [2021]
UGHCCD 1766, the issue was whether Section 139 of the Petroleum (Exploration,
Development and Production) Act, 2013 ousted the jurisdiction of the high court, it was
held that, high court has original unlimited jurisdiction over all matters in Uganda. In the
same manner, it is our position that, the High court has jurisdiction to address the matter
before it.

4.0 RESOLUTION OF ISSUES

1. Whether Mrs. Leslie Glen has a cause of action?
7
Cause of action was defined in Semakula V Serunjoji as every fact which is material to be
proved to enable the plaintiff succeed or every fact which if denied, the plaintiff must prove in
order to obtain judgment.
For one to claim any cause of action, the plaint should point to the fact that,
1. The plaintiff enjoyed a right
2. The right was infringed upon and that
3. It’s the defendant and no other who is responsible for the infringement into the plaintiff’s
right as was discussed in Auto Garage v Motokov8.

3
Article 139 1995 Uganda Constitution as amended
4
Section 11(1) Civil Procedure Act Cap 71
5
Section 33(1) Data and Privacy Protection Act 2019
6
Uwonda and another v Total E and P (U) Limited (Civil Suit 13 of 2016) [2021] UGHCCD 176 6,
7
Ssemakula v Serunjogi (Civil Suit 187 of 2012) [2013] UGHCLD 46 p. 4/5
8
Auto Garage v Motokov8 (No. 3) 1971 E.A 514

5
 1.As to whether Mrs Glen Leslie enjoyed a right, Chapter IV9 provide for the bills of
right and in particular Article 2010 provides for fundamental human rights and freedoms
putting duty on all persons and authorities to observe and uphold human rights of others,
fundamental or other rights and freedoms.
Article 27(3)11 provides for right of privacy of persons and in particular protects a person’s
right to privacy of correspondence, communication, or other property.
The preamble of the Data Protection and privacy Act12 provides for protection of privacy of the
individual and of personal data by regulating the collection and processing of personal information;
to provide for the rights of the persons whose data is collected and the obligations of data
collectors, data processors and data controllers; to regulate the use or disclosure of personal
information; and for related matters.

At international level, the right to data and privacy protection is provided for under Article 1213
which states that, No one shall be subjected to arbitrary interference with his privacy, family,
home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to
the protection of the law against such interference or attacks, the same position is reelected in
Article 1714 .
Looking at the facts above, Mrs Leslie Glen gave in her data Kapo Boda through its application
and therefore she had a right of protection of that data and privacy.

2. Whether her right to personal data protection and privacy was infringed upon, for the
right of the plaintiff to be violated, it must be shown that, the defendant either through an act or
omission did an act which undermined the protected right of the plaintiff as was held in Elly B
Mugabi vs Nyanza Textile Industries Ltd15, in the instant matter, the omission by the 1st
defendant to put in place required security measures as mandated by Section 2016 led to security

9
1995 Uganda Constitution as amended
10
Ibid
11
Ibid
12
Data and Privacy Protection Act 2019
13
Universal Deceleration of Human Rights
14
International Convention on Civil and Political Rights.
15
Elly B Mugabi vs Nyanza Textile Industries Ltd [1992-93] HCB 227
16
Data Protection and Privacy Act 2019

6
breach by 3rd defendant when it unlawfully obtained the plaintiffs data which was in possession
of 1st defendant thereby undermining her right to privacy.

In Lubega-Butanaziba v MTN Uganda Limited17, where the plaintiff’s phone call data was
unlawfully given out to the defendants, court held that, it had infringed into his right to privacy of
data. In the instant matter, the plaintiff lawfully gave out her personal data to the 1st defendant but
this data was misused by the 3rd defendant and other anonymous people in carrying out direct
marketing contrary to section 1018 which led to constant disturbances by the unsolicited loan offers
which violated her right. It is therefore our contention that, indeed the plaintiff’s right to data
protection and privacy was violated by the defendants severally, to writ, by 1st defendant when it
failed to put in required security measures to guarantee protection and integrity of applicants data
under its control contrary to Section 20 (supra) and the 3rd defendant when it unlawfully obtained
data belonging to the applicant contrary to Section 3519 thereby exposing it to persons who did
direct marketing contrary to Section 2720 thereby infringing on the right to privacy and that of data
protection of the applicant.

3. As to whether it’s the defendants and no other who is responsible for the infringement of
the plaintiff’s right

Section 221 defines data collector” to mean, a person who collects personal data
Section 222 (Supra) equally defines data controller to mean a person who alone, jointly with
other persons or in common with other persons or as a statutory duty determines the purposes for
and the manner in which personal data is processed or is to be processed;
Meanwhile data processor, means a person other than an employee of the data controller who
processes the data on behalf of the data controller, Section 223.
In the matter at hand, it is not in dispute that, the first defendant through its application is
responsible for collecting data from the data subject( plaintiff), it is equally not disputed that, the
1st defendant stored the said data albeit without required data security measures, neither is it in

17
Lubega-Butanaziba v MTN Uganda Limited 17 (Civil Suit 156 of 2009) [2020] UGHCCD 159
18
Supra
19
Data and Privacy Protection Act 2019
20
Ibid
21
Supra
22
Ibid
23
Supra

7
contention that, the 3rd defendant unlawfully obtained the plaintiffs personal data from the 1st
defendant and used it for direct marketing when it made loan offers to the plaintiff through phone
calls and emails, it is therefore our position that, the defendants and no other person was
responsible for the breach in the right to privacy of the plaintiff. In Conclusion, it is our position
that, Mrs Glein Leslie has cause of action against the defendants when their actions and
omission severally led to misuse of her personal data which was collected by the 1st defendant.

1.1 Issue 2,
Whether Mrs Leslie Glen is entitled to any remedies?
According to the Black’s law Dictionary24 a legal remedy is a means by which court prevents
violation of a right, or it redresses its breach by compensation or other means. Section 33
Judicature Act25, gives the high court powers to offer remedies to a party whose right has been
violated. Section 33(1) Data and Privacy protection Act, gives powers to an aggrieved person
whose right to data and privacy protection has been violated to apply to high court for redress.
Accordingly, Mrs Leslie Glen is entitled to the following remedies,

1. Compensation inform of general damages

Section 38 of the Data protection and privacyAct26 provides for offences by corporation when
it willfully or knowingly authorize contravention of the Act. Section 35 provides for compensation
when a corporation unlawfully obtains data and is entitled to pay compensation not exceeding two
hundred and forty currency points, from the facts, it is not in dispute that, the 4 th defednat
unlawfully obtained data of the applicant using its various applications, Mrs Glen is therefore
entitled to compensation by the defendants severally.
2. Injunction
This is an order of high court stopping the defendant from further violation of the applicant’s
rights. Section 38 Judicature Act27 empowers the high court to issue an injunction against the
defendants. Section 25 Data protection and privacy Act28 gives a data subject the right to stop

24
Black’s Law Dictionary 11th Edition
25
Judicature Act Cap 13
26
Section 38 Data and Privacy Protection Act 2019
27
Section Judicature Act Cap 13
28
Section 25 Data and Privacy Protection Act 2019

8
processing of personal data, Section 26 Section 25 Data protection and privacyAct29 equally
gives a data subject right to prevent processing of personal data for direct marketing. According
to the facts of the case, the 4th defendant unlawfully obtained data of the plaintiff from the 1st
defendant, which data was accessed by hackers who used it for direct marketing when it contacted
Mrs. Glen with their loan offers, Mrs Leslie Glen therefore has a remedy of an injunction
preventing the 3rd and 4th defendants from further unlawful obtaining and processing Mrs Glen’s
personal data for direct marketing.
3. Mandamus
Mandamus is an order of the high court commanding a defendant to take a positive step towards
observation of right of a plaintiff. Section 37 Judicature Act30 mandates the high court to issue
an order of mandamus. Section 20 Data protection and privacyAct31 mandates a data collector,
processor, or controller to put adequate security measures in order to protect the data and privacy
of the data subject. From the facts, the 1st defendants failed in their duty of providing adequate
security to the data obtained from Mrs Glen, she therefore has a remedy of an order of mandamus
to compel the 1st defendants to put in place adequate security measures to avoid further security
breaches.
4. Declaration
This is a remedy of court which makes pronouncements as to violations of rights of the plaintiff
and who is responsible, Section 33 Judicature Act32, the plaintiff is therefore entitled to a
declaration by this honorable court to the effect that, the defendants severally violated the
plaintiff’s right to data protection and right to privacy.

29
Section 26 Data and Privacy Protection Act2019
30
Section 37 Judicature Act Cap 13
31
Section 20 Data and Privacy Protection Act 2019
32
Judicature act cap 13

9
5.0 STATEMENT OF PRAYERS
It is the applicant’s prayers that, this honorable court finds and declares that,
1. The right of the applicant to privacy and data protection has been violated by the
defendants.
2. The 1st defendant failed in its legal duty to secure the data it obtained from the plaintiff
thereby violating data protection principle as provided in Section 3(1) e of the Data
protection and privacy Act 2019
3. The second defendant failed to perform its statutory duty there by abetting further breach
of the defendants’ rights.
4. The applicant is entitled to the remedies sought
5. The applicant is entitled to cost of the suit.

BIBLIOGRAPHY
STATUTES
5. 1995 Constituition as amended
6. Judicature Act cap 13
7. Data protection and privacy Act , 2019
8. Civil procedure Act cap 71

INTERNET
Blacks’ law dictionary 11th edition

CASE LAW
1. Ssemakula v Serunjogi (Civil Suit 187 of 2012) [2013] UGHCLD 46 p. 4/5
2. Auto Garage v Motokov (No. 3) 1971 E.A 514
3. Elly B Mugabi vs Nyanza Textile Industries Ltd [1992-93] HCB 227
5. Lubega-Butanaziba v MTN Uganda Limited (Civil Suit 156 of 2009) [2020] UGHCCD 159
6.Uwonda and another v Total E and P (U) Limited (Civil Suit 13 of 2016) [2021] UGHCCD
176,

10
11