“Digital colonialism”: US demands for access to African data raise privacy and sovereignty concerns

Frank Ssekamwa says the United States has presented his country with an impossible choice. If it agreed to the terms of a new health deal, Uganda would have to give the United States access to the data of millions of its citizens — a move it said would make their personal information more vulnerable to breaches and possible exploitation.

But if he refused, the East African country would likely lose more than $1 billion to fight HIV, malaria, tuberculosis and other diseases, even as its population faces constant threats from Ebola and other deadly infectious diseases.

So, on December 10, he agreed.

“If you accept the deal, you are going to be exploited. If you don’t accept it, you are going to die,” said Ssekamwa, a lawyer and digital rights expert in Uganda. “This is the essence of digital colonialism.”

Countries across Africa faced similar dilemmas as the United States conducted a series of closed-door negotiations in which life-saving aid was conditioned on access to citizens’ health data. The negotiations follow the dismantling of the United States Agency for International Developmentwhich – unlike the new deals – provided billions of dollars in aid with few strings attached. Officials in Zambia, Zimbabwe and Ghana were so outraged by these demands that they rejected the initial agreements.

The demand for access to health data is at the heart of the Trump administration’s new project. America First, the Global Health Strategyan overtly transactional approach that seeks to capitalize on the desperate need for medical treatment abroad. Aid will now be provided “in a way that directly benefits the American people and directly promotes our national interest,” Secretary of State Marco Rubio said. declared in September.

The State Department has refused to make public the global aid and data-sharing agreements it signed with more than 30 countries as part of its new approach. But a ProPublica analysis of nine of these agreements provides a window into the broad U.S. demands for data access — and the potential risks and vulnerabilities for citizens of the countries that signed them. ProPublica also examined a previously unreported data-sharing agreement with Uganda; a data agreement with Kenya; six agreements on sharing pathogens likely to cause pandemics made public by the Department of State this week; generic template agreements for sharing data and pathogens that could cause pandemics; and a document analysis advocacy group Public Citizen shared exclusively with ProPublica.

ProPublica also consulted with more than a dozen data privacy and global health experts, including several with direct knowledge of U.S. policy, who said the insistent demands for access to data and other resources as a condition of aid are unprecedented. Without looking at all the agreements, they couldn’t identify all the vulnerabilities. But they spotted some red flags: The terms of the agreements are vague and lack language standards in most data-sharing agreements that adequately limit what data is collected and how it can be used. This increases the risk that individuals’ personal data will be exposed, misused or traded without their consent.

Under the Uganda Data Agreement, the United States will benefit from direct, real-time access to nine of the country’s health data systems for seven years, including the central repository that stores all of its health information, laboratory data, data collected by community health workers and, most importantly, its system for managing individuals’ electronic health records. The agreement provides for the sharing of aggregated data by removing all personally identifiable information. It also says the data should be used to deliver and audit health services.

But lawyers and digital privacy experts say the deal raises questions about who will have access to the massive cache of health data and whether it could be inappropriately accessed and exploited.

Some have expressed concern that because it is possible to reverse engineer anonymized data, the records of people living with HIV, tuberculosis and other illnesses could be leaked.

Stephanie Psaki, who served as U.S. coordinator for global health security under President Joe Biden, described the Trump administration’s approach as a “blunt instrument of ‘just give me the identifier of your data systems’.”

“The United States would never agree to this,” she said if the deal was proposed in reverse.

In Uganda, the United States will provide up to $1.7 billion over five years for global health security and the treatment and prevention of deadly diseases such as malaria, tuberculosis, HIV and polio. In the past, the United States provided this aid without asking for direct benefits in return, saving approximately 170,000 Ugandans live every year.

While this is a significant investment, it is less than what the United States previously spent in Uganda and will decline each year since the agreement. By 2030, the African nation will receive 45% less global funding for health than when Trump took office, according to an analysis by Vincent Lin of Partners in Health, which provides health care in poor countries.

Several experts said there is broad support for some of the goals of the new aid plan, including reducing African countries’ dependence on the United States for their health care needs. But they fear the transactional nature of this approach could backfire by undermining trust or, in some cases, pushing countries to reject deals altogether.

After withdrawing from the World Health Organization and losing access to its global network that tracks and combats outbreaks, the United States is trying to obtain the information needed to address potential pandemics through a patchwork of agreements with individual countries. Each of the agreements reviewed by ProPublica includes a section on outbreak response. And some countries have signed separate pathogen-sharing agreements, which stipulate that countries must “begin sharing specimens and associated data” within five days of a request from the United States. The Trump administration also plans unprecedented involvement of private companies in data management and processing.

The State Department told ProPublica it needs access to data to improve health outcomes in recipient countries and keep Americans safe. The new approach also requires countries to invest more in their own health systems in return for aid, a promise many countries will likely struggle to keep. And, in some cases, notably the one with Uganda, it aims to boost local manufacturing through partnerships with American companies.

The State Department said it considered several factors to ensure the investments required from other countries were “realistic and achievable.”

“The United States is investing billions of dollars in other countries’ health systems to fight infectious diseases. In return, we expect governments to increase their own health spending, so that programs are sustainable and truly nationally owned, and not permanently funded by U.S. taxpayers. For the first time, both sides are putting skin in the game to ensure lasting impact,” a State Department spokesperson said in response to questions about the deals.

In response to follow-up questions from ProPublica, spokesperson Tommy Pigott said the agreements “share only the same types of aggregated, anonymized data that have been shared and used for years in the fight against HIV/AIDS, malaria, tuberculosis and other diseases. Any data sharing is consistent with each country’s laws and approvals. No personally identifiable information is received or shared by the United States government.”

The Ugandan Ministry of Health, Ministry of Foreign Affairs, Privacy Office and embassy in Washington, DC, did not respond to questions for this article.

In the age of artificial intelligence, large health data sets have become so valuable that they have been called new gold. The precise value of an entire nation’s health data is unclear, but it could be extremely useful to AI-focused companies for training models. The industry of buying and selling these treasure troves of information is worth billions. And countries around the world have come to view the health records of their citizens as national assets that deserve special protections and can confer economic and strategic advantages.

Yet these agreements, which are part of a State Department strategy openly declare aims to make America “more prosperous” and “promote American health innovations,” does not guarantee that Africans subject to it will have a say in the fate of their data or receive a fair share of its profits. “Once companies get this data, the value increases. But there is no way to [African] population to know how companies will use it,” said Jane Munga of the Carnegie Endowment for International Peace, who argued that the agreements may violate African privacy laws.

Africans have also expressed concern that they will not be able to access drugs and vaccines developed from samples of pathogens. genes shared with the United States and benefit from them. Five of the six sample-sharing agreements reviewed by ProPublica stipulate that, in the event a medical product is developed primarily using a domestically sourced sample, the U.S. government will “prioritize” a request from that government over U.S. needs. using the specimens.

The phenomenon of extracting information and samples from less wealthy populations and failing to credit and compensate them for their contributions to medical developments is well-known enough to have several names, including “parachute science.” Just a few years ago, countries, including some in Africa, held COVID-19 vaccine trials and then tested them. difficulty accessing the plans they helped develop.

Each agreement includes “profit-sharing provisions,” the State Department said in response to questions.

After the Trump administration USAID dismantledthe world’s largest provider of humanitarian aid, it also slashed funding for international health work done by the Centers for Disease Control and Prevention and slashed the President’s Emergency Plan for AIDS Relief, which combats HIV globally. In addition to withdrawing from the WHO, the United States withdrew from international negotiations for a agreement on the pandemic intended to assert the sovereign rights of countries over their biological resources and to guarantee equitable access to medical interventions.

Brad Smith, an entrepreneur who served in the first Trump administration, is now charged with creating the system that would rise from the ashes. Before joining that administration, Smith founded three companies whose business models rely in part on using data to lower health care costs, including CareBridge, a home care provider that sold for $2.7 billion in 2024. During the presidential transition that year, Smith led the government panel on effectiveness this would become Elon Musk’s Department of Government Effectiveness. After Trump took office, he presided over some e $67 billion in sweeping cuts at the Department of Health and Human Services before being hired as an advisor to the State Department.

Although the humanitarian aid system was largely dismantled, Congress required the executive branch to continue providing aid. So Smith and his team had to find new ways to get funds to countries, ensure they were spent wisely, and deal with potential pandemics — all without many of the international partners and staff the government previously relied on to carry out this complex work.

A Rhodes scholar known for his intense work ethic, Smith threw himself into this effort. State Department staff fielded his calls at all hours of the night explaining budget items on spreadsheets. Through his personal attorney, Smith directed questions to the State Department.

One of the biggest challenges lies in the processing of health data. In the past, PEPFAR, the HIV programbuilt its own systems to manage anonymized data, separate from government health records — a setup that Trump administration officials and others have criticized as ineffective.

The America First plan proposed standardizing data collection and processing within countries. Uganda’s data deal requires the country to provide the United States – and its contractors – with credentials “or other secure access mechanisms” to directly access the country’s data systems. U.S. officials say the new approach will allow the United States to continue auditing programs and tracking outbreaks.

The agreements reviewed by ProPublica include statements about the U.S. government’s intent to keep the data secure and assert that the data is accessed for the purpose of disease control and monitoring that work, but they leave open the possibility that sensitive information could be revealed, according to data privacy experts consulted by ProPublica.

Countries without national data privacy laws are particularly at risk, such as Liberia, whose MoU requires “interconnected and interoperable” data systems for “surveillance, laboratories, response, health, environment and agriculture.” That country’s main health deal does not require the United States to limit the amount of data it uses to the minimum necessary, a standard clause in U.S. contracts, according to Abdoul Jalil Djiberou Mahamadou, a recent postdoctoral researcher specializing in bioethics at Stanford University. (Neither Liberia nor the State Department has released the additional data-sharing agreement.) “Once data is breached, it is almost impossible to recover it,” Mahamadou added.

The Liberian government did not respond to a request for comment.

Uganda’s data sharing agreement says it will comply with the laws of both countries and allows the sharing of “sensitive personal data” if consent is obtained from those whose data is being shared, if there is a compelling public health emergency of international concern and if this is the only way the information can be provided in a “timely and accurate format”.

Ssekamwa, the digital rights expert who also founded and runs the Africa Center for Digital Justice, said there are important questions that the Ugandan government has not answered.

“Does the United States have appropriate data protections? Can the systems provide anonymized data? Are they really up to these standards?” said Ssekamwa. “If I have had health problems, can you deny me a visa based on my health problems? »

Psaki, the former global health security coordinator, is concerned about the haste with which changes to data access are happening. “Even in the best of times, you can’t go from having parallel data systems established over 20 years to finding a way to integrate those data systems in six months.”

Speed ​​is a hallmark of the America First global health effort. In September, just a month after Smith joined the State Department, it launched the strategy an event co-sponsored by the United States Chamber of Commerce and five major pharmaceutical companies. In November, Smith traveled the African continent with a small team of negotiators, trying to persuade dignitaries to agree to deals.

The State Department said the agreements were “thoughtfully and strategically negotiated over several months.”

On December 4, Kenya became the first country to sign, in a triumphant celebration with Rubio and President William Ruto in Washington. The outcry over the deal had already begun two days earlier, when a Kenyan activist named Nelson Amenya announced on the social platform that he had seen a sample of the specimen sharing agreement as well as a legal analysis showing that it would violate Kenyan law.

As a condition of receiving $1.6 billion in aid, the Kenyan government agreed to provide access to seven years of medical records, two years more than the financial support from the United States.

Although the Kenyan data-sharing agreement states that the United States will take “all reasonable measures to protect the confidentiality of information” and respect American and Kenyan laws, Amenya fears that is not enough. “Every HIV test, tuberculosis diagnosis, malaria case – available to US officials,” he wrote in his post, which now has a million views. “Your medical records, your children’s health data – all exposed. »

Days later, a Kenyan senator named Okiya Omtatah sued members of the Kenyan government over the deal, arguing that it posed a threat to citizens’ constitutional right to privacy by “allowing broad foreign access to sensitive data.” A Kenyan nonprofit was also sued, and more than 50 groups weighed on their sidedescribing the document as giving the United States “excessive access” to African data and raising the possibility of serious human rights violations.

In court filings, the Kenyan government has argued that it is required to achieve the “highest possible standard of health” and that it is not able to achieve it alone. After blocking the deal for months, in May the Kenyan court temporarily allowed the deal to go ahead while it reviewed the case.

Since outrage erupted in Kenya, other countries have negotiated shorter terms for sharing pandemic data and samples, and inserted additional protections, according to Public Citizen’s analysis.

Yet groups across Africa to have sounded alarms about the dangers inherent in these provisions, including data breaches. Examples of such unauthorized access to personal data is numerousincluding a recent case in which the health data of some 500,000 British Biobank participants was found put on sale on the Chinese site Alibaba.

Revealing whether someone has had an abortion, a mental health issue, substance abuse treatment or a sexually transmitted disease can be devastating anywhere. In Africa, research has shown that this can lead to discrimination and violence. And even when personal information has been deleted, individuals in “anonymized” data can be reidentified using other AI and other tools.

The Ugandan data sharing agreement calls on the U.S. government to “promptly notify the Government of Uganda of any unauthorized access” in such cases and requires the parties to then conduct a joint assessment of the violations and a remediation plan. But at this point it may be too late, Ssekamwa fears. “Once the data leaves Uganda, we doubt that the Ugandan government will actually have the power to control it,” he said.

The secrecy surrounding the negotiations and agreements has aroused new suspicions. The State Department declined to share the agreements, telling ProPublica that the agency would release them when negotiations with all partner governments were complete and describing its actions as “protecting sensitive negotiations, not ‘secrecy.’ In response to a public records request filed by ProPublica, the State Department said it plans to provide the documents in September 2027. The advocacy group Public Citizen recently filed suit against the federal government in order to obtain the documents.

“Why hide do they enter the agreement if they think the terms are acceptable? asked Bernard Okpi, a Nigerian lawyer who sued his government in March, alleging the deal violates the country’s constitutional right to privacy and promotes religious discrimination by prioritize funding for Christian faith-based healthcare facilities. This lawsuit is ongoing and the Nigerian government has not responded to ProPublica’s questions.

The State Department said the agreement with Nigeria “was negotiated as part of reforms implemented by the Nigerian government to prioritize the protection of Christian populations from violence.”

The Trump administration says its new global health strategy is designed to save lives and protect the United States – and the world – from disease outbreaks. But ultimately, its difficult and secretive negotiations could work against those goals.

While the administration aspired to conclude agreements with 50 nationsincluding the three countries that backed out of negotiations in part due to concerns over data sharing, this figure is far from being reached. (In Zambia, officials have also balked at U.S. demands for critical minerals.) The loss of aid in these countries is already prove to be devastating.

Despite the Trump administration’s stated goal of putting “America first,” the United States may also feel the consequences of these failed negotiations, as distrust compounds the loss of long-standing systems that provided care and responded to outbreaks.

“It is in everyone’s interest to have a comprehensive approach to quickly respond to an outbreak,” said Psaki, who cited the rapid increase in the number of Ebola cases in the Democratic Republic of Congo as evidence. Although this country has a health agreement with the United States, five of the nine countries bordering it have not yet done so. “We need to obtain data and samples from all nine countries to collaborate effectively on this outbreak, but we do not currently have this.”

The State Department said the United States responded quickly to the outbreak and provided more than $270 million for the global fight against Ebola.

In Uganda, where people have also fallen ill and died from Ebola, Ssekamwa said his country needs all the help the health care deal can provide, including better protection against outbreaks, but that there must be stronger protection of people’s personal data.

“We are happy to benefit from technological advances and the fruits of Big Data,” he said. Instead, he said, “the United States has left many loopholes in the agreement, which can be exploited in its favor.”