Africa’s data protection action pushing digital ID forward

Major gains in digital identity policy and the related regulation of data privacy in many African countries provide practical lessons for neighboring nations. These were discussed in a livecast review of two workshops at ID4Africa’s 2023 annual general meeting on Wednesday.

The workshop included perspectives from 17 countries on identity policy and legal reform. They were summarized in a discussion led by Hadiza Ali-Dagabana of Nigeria’s NIMC, and including commentary from Mbawaka Mwakhwawa of Malawi’s NRB, Devendre Gopaul of Mauritius’ PMO, and Djenabou Touré-Camara of Guinea’s MATD on each country’s efforts.

Each country is digitizing government services, but their legal frameworks are in widely varying states, from inherited colonial laws, through modernization and in some cases to amendments of newer frameworks to adapt them to the reality of identity systems now in place. Nigeria is relatively far along in putting ID policies in place, but needs to implement those policies, according to Ali-Dagabana.

Most CRVS systems are not directly connected to digital ID systems, and are less likely to be digitized at this point, Ali-Dagabana says. This makes harmonization a broad priority.

Digital infrastructure and human resources remain barriers to identity systems, and funding remains a barrier to acquiring those resources.

ID4Africa Executive Chairman Dr. Joseph Atick pointed out India’s reported return on investment, but Ali-Dagabana notes the constant prioritization of investments with returns that are both more concrete and immediate.

Malawi was the last country in Africa to create a digital ID system, and Mwakhwawa recounted how the country recognized the value of extending its ID card program to verify citizens for elections, rather than starting from scratch for voter registration each time.

A proof of concept was followed by a pilot, and the findings were used to inform the update to Malawi’s policy in support of the new process. This included amending Malawi’s registration law, which mandated physical ID credentials, to allow different forms of IDs.

The next policy the government is working on is a data protection act.

Gopaul described the consensus-building process in Mauritius that has resulted in mature identity policy. Major further policy reform is coming, however, to update the country’s CRVS system and enable mobile ID, including a mobile driver’s license. The integration of an e-passport with digital ID is also being considered during this gradual reform process.

Guinea’s vision for identity has changed following a military takeover of the government, says Touré-Camara, with political will to digitize the system. New laws are rapidly coming online to update the identity framework to support a range of applications, from passports to payments.

Atick notes that the reforms have largely focused on holistic change and modernization. Different countries have very different gaps, however, so the approaches taken by governments to undertake that change vary widely.

Building trust through data protection action

Immaculate Kassait, Data Protection Commissioner of Kenya reported that the workshop on privacy and data protection focused largely on the role of data protection authorities in the larger system, the kinds of actions they should undertake, and emerging issues.

Contracts for digital identity technology are often shrouded in secrecy, Kassait says, which makes it difficult to identify data protection issues before their impacts are felt.

Further, she notes that standards are needed to bridge the gap between the goals of data protection authorities and the efforts of ID technology vendors to meet them.

Irungu Houghton of Amnesty International Kenya said the country provides a valuable case study, having moved from acrimony and intrusive policies to a workable legal framework and institution that is helping to restore trust in just four years.

Stella Alibateese of Uganda’s NITA noted the importance of the advance of data protection discussions at ID4Africa from a side-meeting at 2019’s AGM in Johannesburg to a full workshop in 2023. About 70 percent of African countries have now passed data protection laws, she says, reflecting the same increase in prioritization.

Pam Dixon of World Privacy Forum pointed out that at the 2019 meeting, a common refrain from Africa’s data protection authorities was a lack of engagement from identity authorities. That has changed, with attitudes changing and “a tidal wave” of legal measures making data protection a trade issue.

The next step, according to Dixon, is bringing African voices to the discussions on regulating emerging AI technologies.

Article Topics

Africa  |  biometrics  |  data protection  |  digital ID infrastructure  |  digital identity  |  ID4Africa  |  ID4Africa 2023  |  standards