Uganda to tighten biometric ID database security after data breach claims

The National Database and Registration Authority (NIRA) of Uganda is pledging to strengthen privacy and security measures around the country’s biometric national ID database after recent reports of a data breach.

A recent BBC investigation claimed that data from the National Identification Registry (NIR) was shared illegally by some unscrupulous NIRA staff to a criminal ring.

NIRA said in a recent press release that while it still awaits further evidence on the claims from the BBC, it has nonetheless opened an investigation into the matter, in collaboration with the the Personal Data Protection Office and the Uganda Police Force.

“Once the investigations are concluded, any persons found culpable will be subjected to both disciplinary action and criminal prosecution, as provided by the law. The public will be informed accordingly,” the release mentioned.

The claims in the BBC report allege that the ID database breach is linked to a sex-trafficking network with presence in Dubai, as reported by local media ChimpsReports.

Critical role of ID database

NIRA assured Ugandans that its commitment to protecting the security, privacy, and integrity of the National Identification Register (NIR) remains unwavering.

“The Register plays a critical role in service delivery, financial inclusion, and national security, and therefore NIRA takes its security and protection seriously,” it said, reaffirming the government’s role in “preserving the integrity of the National Identification Register and ensuring that the citizens’ personal and biometric information is secure.”

The ID authority also explained the various safeguard measures which are in place to protect people’s biometric data and punish mishandling.

These include provisions contained in legal instruments such as The Registration of Persons Act, the Data Protection and Privacy Act, as well as certain technical and institutional safeguards.

In addition to these safeguards, NIRA said it has also made it a duty to ensure that all staff meetings begin with “a data protection and privacy recap on the principles and tenets of data protection and privacy, as a means to ensure continued awareness of the importance of data protection for the employees that are in charge of the National Identification Register.”

The body also stated that while the personal and biometric data of citizens remains confidential, secure, and intact, continuous improvements are being made to align Uganda’s systems with global best practices, and to make sure that employees who disclose personal data unlawfully go under the full weight of the law.

In the wake of these allegations, privacy advocates such as Unwanted Witness have expressed deep concerns and called on authorities to take the matter seriously. They have called for “fully independent investigations into these allegations.”

Ugandan authorities have also faced accusations of using the national ID system as a surveillance tool.

Push for birth registration to drive ID adoption

Meanwhile, Uganda has in the past several weeks, been involved in a mass national ID registration and renewal process, which targets an estimated 33 million citizens.

To ensure stronger ID adoption, the government has been deploying efforts to improve birth registration which is a prerequisite for ID card issuance.

Per a recent local media report, the nationwide ID drive has seen the renewal of more than 10 million ID cards. In July, the figure was reported at 5 million.

Speaking on the occasion of this year’s ID Day commemorated on September 16, a Civil Registration Officer, Claire Ollamson, decried the low rate of birth registration which has been hampering ID registration.

She however noted that teams are being dispatched to health facilities for on-site birth registration, the outlet mentions.

Ollamson is quoted as saying that this strategy is aimed at ensuring children have a legal identity from the time they are born.

Article Topics

biometric identification  |  civil registration  |  cybersecurity  |  data protection  |  digital ID  |  identity management  |  national ID  |  National Identification and Registration Authority of Uganda (NIRA)  |  Uganda