PDPO Upholds NIRA's Refusal to Disclose Third-Party National Identification Records Without Consent, Clarifying that Access Rights Under Data Protection Law Do Not Extend to Private Litigants

PDPO Upholds NIRA's Refusal to Disclose Third-Party National Identification Records Without Consent, Clarifying that Access Rights Under Data Protection Law Do Not Extend to Private Litigants Seeking Another Person's Data Without a Court Order.

Facts

On 11th July 2025, Muzira Patrick Mark (the Complainant) lodged a complaint with the PDPO alleging that the National Identification and Registration Authority (NIRA) unlawfully refused him access to personal data of Mr. Kabunga George William and nine other named individuals.

The Complainant sought this information from the National Identification Register, asserting that it was necessary to expose fraudulent claims related to the estate of the late Latima Mujankondo Sendagala and land in Mityana District. He also claimed the data was required to support a criminal investigation and a civil suit.

NIRA, the Respondent, maintained that access to the National Identification Register by private individuals is governed by a special legal regime under Section 67 of the Registration of Persons Act, Cap 332, and the Registration of Persons (Access and Use of Information) Regulations, 2015.

NIRA contended that this regime requires a formal application, payment of a prescribed fee, and the consent of the data subject, unless a recognized statutory ground for dispensing with consent applies. The third-party data subjects were not notified of the complaint nor were they heard during the proceedings.

Legal Representation

The Complainant, Muzira Patrick Mark, was represented by M/s Sebanja & Co. Advocates.

Issues for Determination

The PDPO identified four issues;

1. Whether the statutory right of access to personal data may be used by one person to obtain another person's data, or whether it is limited to access to one's own personal data.

2. Whether NIRA acted unlawfully in requiring consent of the persons concerned, or a court order, before releasing National Identification Register records to a private applicant.

3. Whether the exemptions relating to criminal investigations and contemplated court proceedings could be relied upon to compel disclosure of third-party personal data without consent.

4. Whether the complainant was entitled to the remedies sought.

Submissions

Complainant's Submissions

The Complainant relied on Section 24(1) of the Data Protection and Privacy Act and Regulation 35 of the 2021 Regulations, particularly Section 24(4)(b), arguing that disclosure of another individual’s data is permissible if reasonable in the circumstances.

The Complainant contended that requiring consent from suspected fraudsters was impractical and self-defeating. He argued that the Data Protection and Privacy Act permits disclosure without consent when necessary for the prevention, detection, investigation, prosecution, or punishment of an offence, or for the preparation or conduct of court proceedings.

The Complainant invoked Section 7(2)(b)(iii), 11(2)(e) and (iv), 13(3) of the Data Protection and Privacy Act, and Section 34 of the Access to Information Act, asserting these provisions allowed disclosure without consent for investigating offences and for contemplated court proceedings.

Respondent's (NIRA) Submissions

NIRA maintained that access to the National Identification Register by private individuals is governed by Section 67 of the Registration of Persons Act, Cap 332, and the Registration of Persons (Access and Use of Information) Regulations, 2015.

NIRA asserted that under the law, a private applicant must;

1. Submit the prescribed application;

2. State the purpose for which information is sought;

3. Pay the prescribed fee; and

4. Obtain the consent of the data subject unless a recognised statutory exception applies.

NIRA contended that the complainant had not satisfied the requirements of that special legal regime.

PDPO's Findings

On Issue 1

The PDPO found that Section 24(1) of the Data Protection and Privacy Act and Regulation 35 confer a right exercisable by a data subject solely in respect of their own personal data. Section 24(4) was interpreted as a protective provision for valid access requests by data subjects, not a freestanding right for one person to obtain another's data. The Office cited Durant v Financial Services Authority [2003] EWCA Civ 1746 as persuasive authority. Since the Complainant was not the data subject and lacked their consent or proof of identity, his reliance on Section 24(4)(b) failed. The PDPO concluded that the right of access under Section 24 does not entitle an individual to obtain the personal data of named third parties. Issue 1 was resolved against the Complainant.

On Issue 2

The PDPO determined that the Registration of Persons Act and its Regulations constitute a special legal regime for accessing the National Identification Register. Applying principles of harmonious construction and generalia specialibus non derogant, the Office held that this special regime takes precedence over general privacy provisions. NIRA was therefore entitled to require a proper application, prescribed fee, and consent of the data subjects, unless a recognized no-consent basis was established (e.g., court order, formal request from investigative authority, or other clear legal obligation). The Complainant's concern about the impracticality of obtaining consent from suspected fraudsters was acknowledged but deemed insufficient to override statutory safeguards. The PDPO concluded that NIRA did not act unlawfully. Issue 2 was resolved against the Complainant.

On Issue 3

The PDPO characterized Sections 7, 11, and 13 of the Data Protection and Privacy Act as permissive processing provisions, not disclosure-compelling provisions. These sections permit data to be collected or processed without consent under certain circumstances but do not create a private right to compel a data controller to surrender another person’s data.

The Office referenced Rīgas satiksme, Case C-13/16, which held that data protection law does not oblige disclosure to private third parties merely to facilitate civil claims. The PDPO also clarified that the Access to Information Act, while applicable to NIRA as a public body, does not create an absolute right to obtain another person's data, and its public-interest override (Section 34) requires a separate balancing exercise that does not automatically override the specific consent and access controls of the National Identification Register.

The Office emphasized that criminal investigations are initiated by authorized actors (e.g., Director of Public Prosecutions, Uganda Police Force) and civil claims require court-supervised disclosure (e.g., Norwich Pharmacal orders). Issue 3 was resolved against the Complainant.

On Issue 4

Since the PDPO found no violation by NIRA of the Data Protection and Privacy Act or its Regulations, the precondition for exercising its corrective powers under Regulation 45(3) was not met. The principal remedy sought by the Complainant (direct disclosure without consent or court order) would have undermined the safeguards of the Registration of Persons Act and Regulations, and potentially led to criminal offenses under Section 81 of that Act.

The PDPO affirmed that the Complainant has alternative lawful avenues, including pursuing access under the Registration of Persons (Access and Use of Information) Regulations, appealing NIRA's refusal, requesting intervention from the Uganda Police Force or the Office of the Director of Public Prosecutions, or seeking court-supervised disclosure. The PDPO concluded that the Complainant was not entitled to the principal remedy sought, and the complaint was not upheld.

Holding

The Personal Data Protection Office upheld NIRA's decision to refuse the Complainant direct access to third-party personal data in the National Identification Register without the data subjects' consent, a court order, or a formal request from a competent investigative/prosecuting authority.

The PDPO ruled that the Data Protection and Privacy Act's general provisions on data access and exemptions do not override the specific access requirements of the Registration of Persons Act and its Regulations, which constitute a special legal regime for the National Identification Register.

The Complainant was found not to be entitled to the remedies sought as NIRA had not violated any provisions of the Data Protection and Privacy Act or its Regulations.

Read the full case

MUZIRA-PATRICK-V-NIRA-PDPO-DECISION.pdf

Download PDF • 7.64MB

Key Takeaways

1. The decision strongly reinforces the legal principle of generalia specialibus non derogant, establishing that specific statutory regimes (like the Registration of Persons Act for the National Identification Register) take precedence over general data protection laws when both apply to the same subject matter. This means that even with a general data protection law, specific sectoral laws governing particular types of data or registers will dictate access conditions.

2. The right of access to personal data under Section 24 of the Data Protection and Privacy Act is primarily a right of the data subject to access their own data. It cannot be unilaterally invoked by a third party to obtain another individual's personal data, even for purposes like fraud investigation or litigation, without proper authorization (e.g., consent of the data subject, court order).

3. The Data Protection and Privacy Act's provisions on processing data without consent (e.g., for crime prevention or legal proceedings) are permissive for data controllers, allowing them to process data under certain conditions. However, these provisions do not create an independent right for private individuals to compel a data controller to disclose third-party personal data directly to them.

4. Individuals seeking third-party data from official registers must utilize established legal channels. For criminal matters, this involves engaging law enforcement or prosecuting authorities. For civil litigation, court-supervised disclosure mechanisms (such as Norwich Pharmacal orders) are the appropriate route. Direct demands to data controllers by private litigants are insufficient.

5. While the Access to Information Act applies to public bodies like NIRA, it does not grant an absolute right to obtain personal data about others. Its public interest override requires a careful balancing exercise and does not automatically supersede the specific safeguards and consent requirements of other relevant statutes.