Sudan’s Data Protection Dilemma: A Critical Moment for Privacy Rights

======================================================

As Sudan embarks on a three-year transition towards democracy and civilian rule, the country finds itself at a critical juncture in terms of privacy rights. The former totalitarian regime, deposed after a series of pro-democracy protests, is now facing intense scrutiny over its violations of citizens’ privacy.

Surveillance Tactics

The regime used various tactics to spy on users and citizens, including imported surveillance technologies sold by Western companies. In 2013, Citizen Lab identified the presence of Blue Coat ProxySG devices on Canar network, a privately-owned Sudanese internet service provider. These devices allowed for the interception of users’ encrypted sessions on the internet.

In 2017, another report by Citizen Lab mapped the use of spyware sold by Hacking Team to governments across the world, including repressive regimes. The study found that 21 governments, including Sudan, used the company’s Remote Control System (RCS) to intercept and monitor users’ encrypted communications.

Lack of Protection Under Current Laws

Under Sudanese law, authorities can access user data after obtaining an order from a prosecutor or judge. However, existing laws offer little protection for users’ privacy and data from government surveillance. The use of vague terms such as “competent authority” gives telecommunications companies a pretext to hand over user information to security agencies without a court order.

Independent Supervision

Independent supervision over how the government and private sector handle personal data is lacking in Sudan. There is no data protection authority, no data protection law, and no transparency about data collection and sharing practices by online businesses.

Current Legal Framework

The current legal framework does not require companies, websites, and organizations to have written policies explaining their data collection and sharing practices. Emerging online businesses in Sudan lack transparency about how they handle users’ information. Online shopping platforms and ride-sharing applications publish limited or no information on data collection, retention, and sharing.

Constitutional Charter for the 2019 Transitional Period

As part of the power-sharing agreement to guide Sudan’s transition towards civilian rule, the Transitional Military Council and the political coalition that represents the protesters signed the Constitutional Charter for the 2019 Transitional Period. Article 54 enshrined the right to privacy, stating that “no one’s privacy may be violated, nor shall it be permitted to interfere in the private or family life of any person in his home or correspondence, except by law.”

Reforms Needed

However, without reforms aimed at reinforcing and protecting privacy rights, this right remains under threat. An effective data protection law in Sudan is crucial to fulfilling legislative gaps and ensuring compliance with international human rights standards and best practices for data protection.

Call to Action

The government of Sudan must take immediate action to address the lack of data protection and ensure that privacy rights are protected and respected. This includes:

• Enacting a comprehensive data protection law that provides clear guidelines on data collection, retention, and sharing
• Establishing an independent data protection authority to oversee compliance with data protection laws and regulations
• Ensuring transparency about data collection and sharing practices by online businesses
• Implementing measures to prevent government surveillance and ensure accountability for any violations of privacy rights.