Uganda is tracking its vehicles, but there’s no law that says who can look

Governments across the Global South are expanding their capacity to watch citizens through biometric ID systems, centralised databases, CCTV and communications interception.

Systems introduced for service delivery or security too often become tools for monitoring critics, because oversight is weak, access is abused, and due process is absent. At Thraets, we investigate data exploitation, track emerging surveillance technologies and analyse the actors behind them so that at-risk communities can protect themselves and digital rights are written into policy.

Our position is simple: surveillance technology must operate within the law that protects the people being watched. In Uganda, that law is the Data Protection and Privacy Act 2019.

In February 2025, we wrote about the Intelligent Transport Monitoring System (ITMS), the vehicle tracking project run by the Moscow-based Joint Stock Company Global Security. We asked who could see its data, where it was stored, how long it was kept and who audited the company.

Twenty months on, an inquiry by Parliament’s Committee on Physical Infrastructure is exposing significant gaps on each of those questions. What it has found should concern every Ugandan whose vehicle carries this device, and the lawmakers and regulators charged with protecting their data.

**IT’S NOT JUST A PLATE **

The first concern is what is being installed. The public understood the digital number plate to be just that: a plate. Parliament has found it is only the visible part of a larger package.

The committee chair, Mwine Mpaka, has confirmed that the plate itself cannot be tracked. According to Parliament’s records, each installation also includes a tracking device fitted inside the vehicle, a SIM card connecting it to a network, Bluetooth beacons, and data processing systems integrated into police operations.

The finding raises concerns about data security and privacy, and about whether owners were told about, or consented to, the device.

**NO RULES ON ACCESS **

There is no published framework governing the system. Nothing sets out who may query it, for what purpose, which data they may see, how long location history is kept, or whether queries are logged.

That gap is sharper because a private company runs the system. A 2025 minority report by nine MPs found Global Security is privately owned by four individuals. Without rules on how private actors may access public data, nothing public limits what the operator can reach.

The committee chair has already questioned how the company gained access to the Police Command Centre, warning of leakage and misuse. The committee has yet to establish which agencies have access, and no one has said who audits the company.

MPs were told the data is held in Uganda. That says where it sits, not who can reach it. Data on a server in Kampala is open to anyone with credentials to the system. The police call the system a work in progress.

Without access rules, it is a surveillance system waiting to be used. Uganda already has the law to fix this, and an office to enforce it: the Personal Data Protection Office. Yet nothing from the hearings shows the Office being consulted, or a data protection impact assessment being produced, before the system went live.

**A REACH SET TO EXPAND **

The system is set to know more. The Ministry of Works and Transport is linking the vehicle register to owners’ phone numbers, email addresses and other contact details, so the command centre can reach owners when a plate is tampered with.

The aim is reasonable; the consequence is significant. A location trail shows where a car went. Joined to a name, a phone number and an inbox, it shows who went there and how to reach them.

Over time it maps where people live, worship, meet and protest. One breach, or one misuse, exposes all of it at once. Before the committee reports to the House, we urge Parliament and the government to act on five points.

1. Publish the contract. Release the full agreement with Global Security, including its data ownership, access and exit clauses.
2. Disclose the tracker. Tell every motorist what device is in their vehicle, what it records, how often it reports and who receives the data, and let owners see the data held about them.
3. Put access rules in law. Name the agencies that may query location data and the authorisation each query needs, log every query, and audit the logs independently.
4. Bring in the Personal Data Protection Office. Publish a data protection impact assessment before the register is linked to phone numbers and email addresses.
5. Audit before spending more. Questions about value for money are already on the record.

Motorists pay Shs 714,300 for a new plate, and officials could not tell Parliament what it buys; two were arrested on October 5.

Motor dealers have told MPs the fee is excessive next to trackers on the local market, and police concede tamper alerts still need a faster response. Commission the Auditor General to audit the ITMS for value for money, and pause further procurement with Global Security until that audit is complete.

This is a contested system, and the public is paying attention. Parliament’s scrutiny is welcome, but it cannot end with a committee report. Uganda needs a level of rigour it has not yet applied to how this data is collected, shared and used, and it needs it before the system grows further.

Ugandans deserve to know what is in their cars, and who is on the other end.

The writer is a researcher with Thraets, a nonprofit, pro-democracy civic-tech research lab based in the Global South that works to defend truth, democracy, and social cohesion. https://thraets.org.

The post Uganda is tracking its vehicles, but there’s no law that says who can look appeared first on The Observer Media Ltd.