Uruguay

The need for a new data governance agenda based on human rights

Introduction

Uruguay is considered a full democracy and one of the most progressive countries in Latin America. Nevertheless, the COVID-19 pandemic brought new challenges and priorities to Uruguayan civil society groups working in this space. There are three key challenges that could be shifting the advocacy landscape: government transparency, including digital surveillance; gender-based violence; and virtual education. Uruguay was hit by the pandemic amidst a change of government, which increased the difficulties to address these governance challenges

This report explores these issues, and argues that the most effective way to deal with the multiple obstacles they present is to push for a revitalised data governance agenda for the country based on human rights.

Government transparency

Uruguay has been a consistent champion of open government and open data. It ranked second in the Americas in the United Nations Global e-Government Index 2020,[2] first in the Regional Open Data Barometer 2020,[3] and 18th in Transparency International’s Corruption Perceptions Index 2021.[4] Uruguay follows the lead of the European Union on data protection and has recently adopted Convention 108 of the European Council, one the most progressive regulatory frameworks in the world.[5]

But how did the COVID-19 pandemic affect transparency and privacy?

As a first digital response against the pandemic, the government and a large number of private stakeholders collaborated and developed the first version of the Coronavirus UY app. The app was developed by the firm GeneXus, which worked with a number of other private companies. It was sponsored by the Uruguayan Agency for Electronic Government and the Information and Knowledge Society (Agesic).

Initially this app provided general information on the pandemic and allowed the user to consult it if they felt they had symptoms of the virus, and to schedule an appointment with a medical service provider.

At that time, the concerns expressed by civil society were the lack of a contract with the companies developing the app, and why GeneXus and its partners were not chosen on the basis of a fair competitive public tendering procedure.[6]

In June 2020, the government announced that a new version of the coronavirus app would implement a COVID-19 exposure notifications application programming interface (API)[7] developed by Google and Apple.

As a consequence, a citizen made a request for access to public information about the source code of the application, the companies linked to the development of the app, and whether or not a contract had been signed with Google and Apple. However, the response received only provided clarity on the link between the Coronavirus UY app and the Salud.uy programme, an initiative that promotes the use of information and communications technologies (ICTs) in the health sector.[8]

After several consultations, the government confirmed to the media that it did not sign a contract with Google and Apple, and accepted their offer after studying their terms and conditions only.[9]

Civil society nevertheless warned the government about the privacy risks associated with the use of the app’s contact notification system, and said that the source code should be published as a guarantee of transparency, allowing it to be audited by any citizen.[10]

According to several Uruguayan experts, the use of any contact tracing technology implies security risks. Therefore, it is a basic condition that the contact notification system respects the protection of personal data and the principles of prior informed consent and voluntary use.[11]

There is also a need to better understand the terms and conditions of its use, the legal framework and public rules that allow its use, and any personal data exchange agreements between the government and the developers. An evaluation of its impact on human rights is also needed, including how the digital divide limits access to mobile devices.[12]

According to Uruguayan researchers from the GUIAD group,[13] a public debate on these issues is needed, as well as on whether the government has the capacity to monitor the app’s evolution.[14]

The evolution of digital surveillance

Digital surveillance is an established practice in Uruguay. In 2020, the Ministry of the Interior acquired the UCINET software developed by Analytic Technologies that allows the monitoring of networks to track criminal organisations in the country. In June, news broke that the Ministry’s cybercrime division had identified 200,000 citizens for online speech that could be against law, and 2,000 groups identified as mainly left-wing oriented. Because of this, as data seemed difficult to check, the NGO OBSERVACOM[15] filed an access to public information request to find out if the government was monitoring social networks to identify and eventually prosecute hate speech and other possible security threats. The request also asked for clarification on what hate speech and security threats mean in the context of the digital surveillance.[16] The request was rejected based on a Ministry of the Interior decree which classifies all information related to the materials and supplies used by police officers as reserved for reasons of national security. Further, authorities are now systematically denying basic information about the surveillance system.[17]

In 2020, automated facial recognition software and associated support services were procured through a public bidding process, without a legal framework that enables its use.[18] After the purchase of the software, Budget Law No.19924 introduced two articles that provide a legal framework for the creation of a facial identification database for public security purposes under the authority of the Ministry of the Interior.[19] The database is created by migrating the data from the National Directorate of Civil Identification. It is worrying that these articles give the Ministry of the Interior discretion as to the possible uses of the facial identification database.

Civil society has warned that these articles were approved without an analysis of the impact on personal data, nor proper parliamentary discussion. A group of civil society organisations has sent a letter to the Senate, asking that the articles be removed from the draft of the Budget Act.[20] Despite the fact that some legislators took a position to remove the articles or require a court order for the use of that facial identification database, no agreement was reached and the articles were approved.

The only information currently available on the potential uses of the software is contained in the tender document issued by the Ministry of the Interior. There is no regulatory framework or protocol for police use of the software that guarantees the protection of fundamental human rights.

Datysoc and Amnesty International Uruguay proposed the inclusion of this issue in the 5th Open Government National Action Plan.[21] They are seeking a space to discuss transparency in the use of automated surveillance systems and a space for citizen participation in the co-regulation of the new surveillance systems.[22]

At the moment, these technologies are being deployed without an adequate human rights-focused framework. It is a priority to develop this framework, and to discuss a moratorium on the use of these surveillance tools without more evidence on their impact on human rights.

Gender-based violence

Gender-based violence escalated in Uruguay, as in other countries, during the pandemic. According to data from the second national survey on the prevalence of gender-based violence carried out in 2019, eight out of 10 Uruguayan women said they had suffered gender-based violence due to their mere status of being women, and one out of five said they had suffered gender-based violence in the last 12 months since the survey was completed.[23]

Over the past three years, calls about gender-based violence to a telephone guidance service run by the National Women's Institute have increased considerably.[24] These calls increased during the pandemic, peaking in the first three months of 2020.[25]

However, formal complaints of gender-based violence have not increased over the last three years, suggesting a disconnect between formal complaints and incidents of gender-based violence.[26] According to the 2020 annual homicide report carried out by the National Observatory on Violence and Crime of the Ministry of the Interior, in 2020, 37 women were killed, but it is not clear how many of these can be categorised as femicides.[27] In 2021 the Ministry started a new methodology to count femicides and identified 21 cases.[28] Nevertheless, the civil society website Feminicidio Uruguay recorded 21 femicides in 2020 and 30 in 2021.[29] An access to information request made in the context of this report to the Public Prosecutor’s Office got a reply that there was no technical means to fully identify femicides in their database. The lack of clarity in criteria shows the difficulty in assessing the situation in Uruguay.

What do we know about gender-based violence online?

In 2020, the second national survey on the prevalence of gender-based violence produced some data related to sexual violence through digital media: 2.5% of women over 15 years of age reported having experienced some type of violence in the digital sphere in the last 12 months, and 5.5% of women aged 15 or over declared having experienced some type of digital violence by their partner or ex-partner.[30]

Despite the survey, there is currently little open data available on gender-based violence online. The few data points available are marginal and partial and do not allow an intersectional analysis of the forms of digital violence, their manifestation and particularities, and are not sufficient for evidence-based public policy planning. Civil society organisations recognise that it is necessary to produce detailed information on digital violence, as well on the multiple types of violence identified in Law 19580 on gender-based violence against women,[31] including psychological or emotional violence, violence due to prejudice towards sexual orientation, economic violence, symbolic violence, and obstetric violence.[32] However, despite the list being identified in law, there are no registries or databases on these different types of violence. In an access to information request made in the context of this research, the Public Prosecutor’s Office released data showing that complaints of disclosure of intimate images without consent and grooming have increased in the last three years.

The reality is that the lack of resources, including budget cuts suffered by institutions such as the Ministry of Social Development and the National Women's Institute, makes it impossible to properly apply the law. In addition, it is essential to create more courts specialised in gender violence that develop processes with a comprehensive approach and treatment of the problem, including attending to online violence.[33] Finally, there are cultural issues that will demand a different approach. The normalisation of digital violence means that it is often not perceived as an infringement of rights by those who suffer it.

As it is, the support mechanisms for victims of gender-based violence are still in their infancy and legal measures are inadequate, despite evidence suggesting that the pandemic exacerbated gender-based violence, with a limited response from government authorities.

The challenge of ensuring access to education online

One of the challenges faced in 2020 was to ensure access to online education for all. For that reason, connectivity and internet access have become very relevant.

According to a study by the state-owned telecommunications firm Antel, which was accessed by the newspaper El País, there are 22,716 people without internet access in Uruguay, out of a population of 3,473,727. The study found that 3,115 people in the countryside have access to 2G (LTE) technology, 390,986 have access to 3G (LTE) and 2,693,447 have access to 4G (LTE).[34] Coverage is therefore almost universal, but with different degrees of quality and speeds.

In order to deal with the demand for access for educational purposes during the pandemic, Plan Ceibal – a government project to ensure access to the internet, devices and education to every school child[35] – partnered with telecommunications service providers and the National Education Board (ANEP) to get free internet access for the use of educational tools, or with discounts and exemptions for students, families and teachers.[36] Plan Ceibal, ANEP and the telecommunications companies Antel, Movistar and Claro also agreed to promote and ensure access to hybrid education.[37]

A problem with platforms

During the closure of educational centres due to the COVID-19 pandemic, Plan Ceibal and ANEP created "Ceibal at Home" in an effort to transform a face-to-face learning programme into a distance learning solution.[38] But despite this effort to provide continuity to education, it was only partially successful. Aristas – the first report on educational performance of students between third and sixth grade in primary school – shows that in the first semester of 2020, 90% of public school teachers connected with their students through the Ceibal platform, while in private schools, other platforms were used as often as the Ceibal platform. The study also found that the use of WhatsApp for education was greater in public schools (70%), while in private institutions the use of email increased.[39]

There are several points to consider about the use of platforms such as Google for Education, including the interests of the company and the privacy of students and teachers. Currently, according to statements made by Google's manager for Latin America to El País, there are 50,000 active users of Google educational tools in Uruguay.[40]

With regard to the use of WhatsApp as an official means of communication with students, it must be taken into account that when using the free service, data such as the mobile phone number, the operating system, information about the networks used, the geographical location and profile details and statuses of the students and teachers are captured by the company.

Due to this new reality, children and vulnerable groups are now exposed to various uses of their private data that could harm them, including the use of their digital profiles for commercial purposes.

Understanding this new reality and generating an adequate framework to govern it is a necessity for Uruguay.

When copyright gets in the way of education

Another challenge to online education in Uruguay during the pandemic is that most learning materials were covered by copyright law dating back to 1937, which does not respond to the needs of accessing knowledge in the digital age. The needs impact authors, producers and publishers, as well as educational and cultural institutions, such as universities, libraries and archives.

A more flexible system of copyright is required, based on current international regulations, which guarantees authors the effective exercise of their rights, while also ensuring the right to education, access to information, and to culture, science and research.

With regard to education, it must recognise the use of digital environments and tools, and educators as content creators.

Specifically, Datysoc believes that the copyright law should:

• Include exceptions for educational, research and private study purposes that do not involve profit, without establishing restrictions on the physical spaces where these activities are carried out or restrictions on the type of institution that carries them out.
• Guarantee the possibility of carrying out certain acts of reproduction, distribution, adaptation and communication of works, as well as the creation of selections or compilations of readings.
• Expressly clarify that the exceptions apply to online teaching and learning activities.
• Establish a definition of study materials that covers any type of work and is neutral with respect to the type of medium, format and technology. There should be a specific clarification that this applies to audiovisual works and images used for education purposes.
• Establish a generic exception that enables non-consumptive uses of works for research purposes, especially those uses related to text and data mining techniques and artificial intelligence procedures.
• Explicitly enable the circumvention of technological protection measures when the exceptions operate for purposes of education, research and private study.[41]

Conclusion: An emerging agenda for digital rights in Uruguay

In this report we have argued that government transparency, including on digital surveillance, gender-based violence and government services, were negatively affected by the COVID-19 disruption.

While previously being committed to open governance, the government has shown significant reticence to valid questions posed about its use of surveillance technology. It is also possible to argue that a new administration did not have experience in some of these topics and had to deal with them under maximum pressure. Furthermore, in areas such as surveillance, the agenda of the new administration did not include a focus on transparency and accountability. It remains to be seen whether the current administration is willing to sustain a commitment to openness and transparency in these vital areas for human rights and security.

It is not possible to fully assess the impact of the pandemic on gender issues, most notably gender-related violence, due to the absence of data. However, insufficient resources have been set aside to attend to this deficit, even though more data is needed to properly enact gender-related laws. At the same time, support mechanisms and legal remedies for the victims of gender-based violence, including online violence, are inadequate.

While Uruguayan public telecommunications infrastructure played a critical role in supporting government services, including education, the government response showed the lack of a coherent governance framework to deal with the pandemic. Dependence on global corporations to deliver key services is also a significant vulnerability in terms of rights, particularly those of children.

Action steps

The most important next step that needs to be taken to address these issues is to foster a multistakeholder internet governance agenda that focuses on respecting human rights. This agenda needs to update the current data governance framework. In order to do this. two principles are essential: 1) openness to multistakeholder work and 2) an intersectional approach.

Genuinely diverse multistakeholder groups are likely to deliver better governance frameworks in the Uruguayan setting. An intersectional approach, considering different forms of social discrimination, will also be needed to ensure governance frameworks and their implementation are transparent, fair and inclusive.

The most progressive country in Latin America needs to innovate to walk the talk in the digital age.