Africa’s digital ID ecosystem needs more transparency to protect human rights: report

The speed and scale of biometrics and digital ID expansion across Africa may be necessary to meet United Nations Sustainable Development Goal 16.9 by enabling everyone in the world to prove their legal identity. But hasty decisions and processes have already led to exclusion and other human rights violations, according to researchers, and could easily continue to do so.

The Atlantic Council’s Democracy + Tech Initiative convened a discussion of “Biometrics in Africa: The market behind digital identity” on Wednesday to examine this challenge, and the findings of a new report on the human rights implications of how the continent’s digital identity ecosystem is coming together.

There are 49 countries in Africa operating at least one biometric system. The infrastructure behind digital identities in African nations “is often developed with limited transparency, weak data protection and minimal public oversight,” says Atlantic Council Democracy + Tech Initiative Senior Research Fellow Iria Puyosa.

Paradigm Initiative Programmes Officer Sani Suleiman was lead author of the report on “Biometrics and digital identification systems in Africa: Assessment of governance, vendors, and human rights.”

Suleiman notes that there is a significant body of research looking at the governance of biometrics in Africa, but less examination of the vendor ecosystem, particularly from within the continent.

Thirty-five African countries use biometrics in elections, Suleiman notes, but there is “a huge gap in the governance itself,” including a lack of redress mechanisms.

The “outsized role of global vendors and the structural dependencies that it creates,” with just a  few, mostly European countries, at the top of a pyramid-shaped vendor ecosystem.

National-level biometrics projects are also largely funded through international bodies, notably including the World Bank, which Suleiman suggests can obscure their motivation. The report also highlights the convergence between digital ID expansion and international security cooperation, including to control migration.

One of the results of the accountability gaps observed in the report is that often “there is a lot of politics” in procurement, with due diligence skipped in favor of vendors closely associated with leadership. These gaps also contribute to the frequent exclusion of people with low levels of digital awareness or skill, and enable weak enforcement of existing laws, Suleiman says.

He notes that most countries in Africa now have data protection authorities and laws. But some of those laws do not provide adequate governance or enforcement mechanisms, rendering them ineffective.

Suleiman acknowledges that the large incumbent technology providers from Europe have resources, specifically capital, that enable them to take on contracts others, including most African technology companies, cannot.

The speed of deployment comes up repeatedly as a problem. Rushed projects have too often run ahead of data protection and other regulations, squeezed the time civil society and other actors have to raise problems before they compound and given populations inadequate time to even understand what is being asked of them, Suleiman and subsequent event participants say.

Concerns around data residency and other issues related to protecting the rights of Africans in this market circumstance are also dealt with in the report.

The report makes nine policy recommendations, including ensuring oversight bodies are independent, enacting data protection laws that are comprehensive and cover the full lifecycle of biometric data and integrating due diligence on human rights into all projects.

“The findings underscore that biometric and digital identity systems must not be viewed merely as technical tools for modernization,” the report states. “They are inherently political, with the potential to either strengthen democratic governance or entrench authoritarian control. Without robust reforms, these systems risk becoming instruments of exclusion and surveillance rather than empowerment.”

Fixing policy and processes

A panel discussion fleshed out the challenges facing Africa’s digital ID rollouts and the policy recommendations intended to address them with perspectives from research and civil society experience.

Procurement processes for biometrics and digital identity technologies are too often backwards, Research ICT Africa ICT Policy Researcher Grace Mutung’u argues. Understanding of the social problem being addressed should come first, she says, and inform the legal and policy frameworks that should precede procurement. Too often, she says, economic growth arguments motivate hasty procurement, leading to situations like in Kenya. The court has stepped in three times to pause the country’s digital ID rollout, which skipped steps like conducting a data protection impact assessment and sorting out the prior double-registration of thousands of people.

Paradigm Initiative Senior Manager for Partnerships and Engagements Thobekile Matimbe says human rights impact assessments have typically been neglected by countries in Africa setting up digital ID systems. People should be aware of what personal data digital ID systems are capturing, where it is stored and for how long. Vendors are contributing to the lack of transparency, she says.

Vendors, particularly those involved in smart city initiatives, have told Paradigm Initiative researchers that they don’t feel they have a responsibility to disclose details about their systems with civil society, according to Matimbe.

Matimbe called on civil society organizations to challenge processes and systems that appear not to respect human rights, and to remain vigilant to the human rights implications of any biometrics systems being procured.

Nubian Rights Forum Project Manager Yasah Musa raised the centralization of identity data in most of Africa’s digital ID systems. Mitigating the risks that lie at the intersection of data centralization and authoritarian governments or dictatorships requires addressing the lack of data protection laws and accountability, he says.

Article Topics

Africa  |  Atlantic Council  |  biometrics  |  digital ID  |  digital ID infrastructure  |  digital identity  |  human rights  |  Paradigm Initiative  |  procurement