Digital Identification and Biometrics In East Africa: Opportunities and Concerns

Recommendations

Digital identification (ID) systems should be rolled out transparently, with public consultation, and take into consideration the sensitivity of collected data.
Function creep (the use of data that has been collected for one purpose, for other purposes) is a real possibility in centralised shared databases between public and private sectors. Data protection and privacy should always be respected.
It is advisable to maintain paper-based or analogue alternatives or alternative biometric options if registrants are not able to supply the necessary biometric data.
A strong legal basis for the protection of data and privacy of the bearer is crucial to the functioning of any digital ID system.
Cybersecurity and related legislation should be prioritised.

Executive summary

Possession of legal identity is a link between citizens and the myriad government services and social, economic and legal rights available to them. However, around 50% of Africa’s population do not have a legal identity, making it increasingly difficult for people to access vital government services such as healthcare and social grants, and to set up bank accounts, register SIM cards, and apply for other important documents such as passports. The provision of legal identity is included in the UN’s Sustainable Development Goals and is also regarded as important in attaining the objectives of the AU’s ‘Agenda 2063: The Africa We Want’. The roll-out of legal identity is moving away from traditional, paper-based systems to digital systems, which often include the collection of biometric data for additional security. This reduces the risk of identity theft and fraud, to some extent. However, without the proper legal framework guiding implementation, such programmes could significantly increase the risk both of certain members of the population being excluded and of collected data being abused. This policy briefing considers the implementation of digital identification programmes in two East African states – Ethiopia and Uganda. It explores the advantages and drawbacks of these systems and makes recommendations on how to mitigate the risks of such systems and ensure that their implementation considers the privacy and data protection of citizens.

Introduction

A national ID document is a primary vehicle for inclusion in and access to government services, as well as the exercise of social, economic and legal rights for millions of people across Africa. Possessing a legal identity, defined by the UN as ‘the basic characteristics of an individual’s identity… conferred through registration and the issuance of a certificate by an authorised civil registration authority following the occurrence of birth’,¹ connects citizens with governments and the services they provide.

Yet, nearly half of Africa’s population still go about their daily lives without any form of legal identification.² The most recent World Bank data indicates that one in four adults in sub-Saharan Africa does not have an ID.³ This lack of legal identity also has a gendered impact, with ID coverage among adult women found to be significantly lower than among men.⁴ Foundational identity management is defined by the World Bank as ‘an identification system primarily created to manage identity information for the general population and provide credentials that serve as proof of identity for a wide variety of public and private sector transactions and services’.⁵ The implementation of this also varies between African states, with some displaying higher levels of deployment than others.⁶

In their efforts to upscale the roll-out of national ID to meet the Sustainable Development Goals (SDGs), many African states have turned to digital options to facilitate foundational identity management. The term ‘digital identification’ refers to the process of ‘converting paper-based legal identities into digital data which can be processed by machine systems’.⁷ But digital identification, while it has many benefits, comes with its own set of challenges.

If not implemented with care and impartiality, digital identification could lead to the exclusion and marginalisation of sections of the population in a more intense manner than with paper-based ID documents. This policy briefing explores the benefits and challenges related to the implementation of digital identification systems in Africa, drawing on the examples of Ethiopia and Uganda. It also looks at concerns around the types of data collected for these systems.

Why digital ID? And why now?

The provision and possession of a legal identity is recognised as important for promoting development and forms part of the UN’s Sustainable Development Agenda and related SDGs. Under SDG 16.9, states have committed to provide ‘legal identity for all, including birth registration’, by 2030.⁸ The AU also considers this ideal important for achieving the objectives of Agenda 2063, its long-term development plan.⁹ In its Digital Transformation Strategy for Africa (2020–2030), the AU maintains that ‘rapid modernisation and urbanisation’, coupled with ‘the increasing sophistication of commercial transactions’, have reinforced the clear necessity of legal identity.¹⁰

The AU attributes the current push for digital identification to ‘recognition of the fact that the economy in Africa must evolve or even transform in order to achieve sustainable, inclusive growth’.¹¹ More specifically, digital identification and a standards-based approach to govern it – what the AU’s Digital Transformation Strategy aims to establish – are regarded as advantageous for the smooth functioning of the African Continental Free Trade Area and reaping its many hoped-for benefits.¹²

The drive for digital ID is part of a global shift towards the digital migration of traditionally analogue or paper-based systems. In Africa specifically, interest in digital identification grew as mobile technology became more widespread.¹³ Furthermore, digital ID is being rolled out precisely when digital infrastructure, which includes ‘internet coverage, security, biometric technology, smart devices, and cloud services’, is expanding.¹⁴

Paper-based identification documents are vulnerable to theft, damage and loss, placing their bearers at risk of identity theft and fraud. It has therefore become common for digital ID systems to include biometric data such as fingerprints or iris scans, alongside photos of the bearer. The inclusion of biometric data in ID documents is an extra layer of security and is more difficult for criminals to forge. Research has also indicated that digital identification has become an attractive option for African states as they embrace progress in the digital technology field and because of the ‘relative ease, low cost, and convenience’ of digital ID systems.¹⁵

But there are several concerns around the implementation of digital ID systems. Because they store sensitive and personal information, privacy should be paramount and breaches through cyberattacks are a major concern. Without safeguard mechanisms, especially in authoritarian contexts, state critics and members of the opposition are particularly vulnerable. The development of digital and information and communications technology infrastructure in Africa is also uneven. The precise use of the data collected and stored, whether it is shared between public and private entities, access to this data, the nature of its collection and criteria for inclusion are all risk factors that should carefully be considered before the roll-out of digital ID systems.¹⁶ It is also important that such systems are supported by strong legal mandates for data protection, privacy and transparency, clearly stating how data will be stored and collected and for what purpose.

Ethiopia: Fayda

Fayda (‘value’ in Amharic) is the name of the biometric digital ID programme introduced in Ethiopia, where the government plans to enrol all eligible adults in the system by 2025.¹⁷ A pilot project was announced for the roll-out of the ID in 2021 and completed in 2022, culminating in the first 100 000 registrations.¹⁸ Yodahe Zemichael, Executive Director of the National Identity Program (NIDP), says that the pilot project delivered many lessons on the implementation of the digital ID system. Most importantly, Zemichael says, the national ID authority should not be regarded as ‘a one-stop shop where all the data about an individual, resident or citizen is found’.¹⁹ Rather, such bodies should restrict the amount of data collected from their subjects and prioritise transparency, so registrants are always informed about when and how their data is being used.²⁰

According to the NIDP, there are currently 1 438 351 registrations and counting.²¹ The NIDP aims to register and issue digital IDs to 10 million people in 2023.²² Those 18 years and older make up 54.1% of the country’s total population of nearly 120 million.²³ Fayda is envisioned to become the primary foundational ID management system in the country and will take over several functional ID tasks, as it is incorporated into the financial sector for ‘Know Your Customer’ (KYC) purposes, the civil registry, and overall plans for Ethiopia’s digital economic transformation.²⁴ Functional ID is sector-specific, for example, voter identification cards or, in the case of Ethiopia, the kebele (Amharic for ‘ward’) residence card,²⁵ whereas foundational ID has a more general use and can be applied universally.²⁶ Fingerprints and iris scan biometrics are collected for the Fayda digital ID system in addition to facial biometrics for authentication and KYC purposes specifically.²⁷

Teferei Fikre, Chief of Staff in the Office of the Prime Minister, has said that Fayda will²⁸

guarantee citizens’ right to recognition, expand the opportunities to use various social and economic rights, foster trust in the relationship between the service provider and recipient, and establish a system of transparency, accountability, and streamlined operation at the national level.

Apart from certain functional ID documents such as the kebele card, Ethiopia did not have a foundational legal identity system in place prior to Fayda.²⁹ Kebele cards are identification documents issued by authorities at the ward (kebele) level to residents of that area over the age of 18. In the absence of a national foundational ID system, these documents have fulfilled many such functions in the country.³⁰ By introducing a foundational ID system, Ethiopia’s citizens will be able to fully access the multitude of social, economic, legal and political rights to which they are entitled, and which have rightly been acknowledged by key officials.

Registration for the Fayda system is not mandatory, and citizens will be allowed to continue using their kebele cards.³¹ But the kebele system, when compared with a sophisticated system such as Fayda, is unreliable, as there are no centralised backups of the records. Damage to or loss of this document are therefore legitimate concerns.³² By continuing to use the kebele card and not registering for the digital ID, citizens could also risk exclusion from certain services and sectors that rely on the functionalities digital identification will enable. Indeed, as argued in an analysis of Ethiopia’s Draft Digital Identification Proclamation (presented to the country’s federal parliament in 2022), ‘government or private entities may condition provision of services on possession of digital identity’.³³ In addition, ‘if the provision of a public or private service relies on biometrics verification, possession of digital identity will be mandatory’.³⁴

Civil society activists and other experts have also raised several concerns about the Fayda system being used in a discriminatory fashion and for ethnic profiling. While the Fayda ID will not capture someone’s ethnicity, experts warn that this may still be deduced from that person’s name – information that will form part of the ID – and that ethnic profiling could be enabled in this way. Several legal routes have been proposed to ensure personal data protection, but activists fear that ‘enforcement is not assured’.³⁵ This fear may have grown out of the identification system in place at the ward level, where registrants’ religion and ethnicity are recorded. Although not present on ID cards, this data is still stored in administrative databases.³⁶ There are also growing fears that the adoption of digital ID might see human rights defenders and state critics come under increasing scrutiny and possible surveillance. Such tactics were used against the so-called ‘Zone 9 bloggers’ – state critics charged with terrorism in 2014.³⁷

Experts and activists are concerned that the personal data collected for the digital ID system may be ‘misused’, and that ‘the benefits promised by a digital ID system are outweighed by the potential risks’.³⁸ This is a common critique of digital ID systems. Organisations such as the World Bank and the UN have in the past been accused of deploying digital ID systems in ‘conflict-prone regions without adequate safeguards to prevent data misuse or rights abuses’.³⁹

Concerns about the implementation of the Fayda system in Ethiopia are also tied to the fact that the country has no data protection laws, despite several attempts at adopting such legislation.⁴⁰ There is also an ‘overall apathy towards privacy and data protection in the country’.⁴¹ Furthermore, Ethiopia has neither signed nor ratified the AU Convention on Cyber Security and Personal Data Protection (Malabo Convention), adopted in 2014 and in force since 8 June 2023.⁴² Implementation of the digital ID programme and related data collection is therefore going ahead without a legislative framework governing data protection.

Finally, the act of capturing biometrics itself can be exclusionary, especially in cases where a registrant is unable to present fingerprints, as is often the case with manual labourers, persons living with disabilities and the elderly.⁴³ However, an official from the Ministry of Justice in Ethiopia has said that alternatives to fingerprint biometrics will be available to accommodate such persons.⁴⁴

Uganda: Ndaga Muntu

Uganda’s national biometric digital ID, Ndaga Muntu, was introduced in 2015 as mandatory for all citizens. Ndaga Muntu, which means ‘identity card’ in Luganda, refers to ‘the physical ID card… and to the system itself’.⁴⁵ The project arose out of a national security initiative, the National Security Information System (NSIS) launched in 2014 to ‘reform civil registration and identification ahead of the 2016 elections’.⁴⁶ Without the digital ID, Ugandans are unable to access public services such as healthcare and social grants. It is also necessary for private services such as ‘opening a bank account, buying a mobile SIM card, enrolling in college, gaining formal employment and getting a passport’.⁴⁷

Eight years after its introduction, around one-third of the country’s population reportedly still do not have the digital ID.⁴⁸ A study conducted on the project by the Centre for Human Rights and Global Justice, Initiative for Social and Economic Rights and Unwanted Witness confirms this finding. It further notes that ‘Ndaga Muntu has led to mass exclusion… and has become a barrier for women and older persons, as well as many other marginalised individuals, to access their human rights’.⁴⁹

Failure to register under the digital ID system has been tied to unsuccessful ID applications because of the inability to present documentation proving citizenship, such as a birth certificate or a marriage certificate. This has had a particularly negative impact on those married in traditional wedding ceremonies or who were born at home or in rural areas.⁵⁰ The digital ID was also made a requirement for receiving a COVID-19 vaccine in 2021. However, the intervention of civil society organisations saw this exclusionary requirement overturned.⁵¹ As part of the registration process for the ID card, those enrolling must also provide fingerprints and facial biometrics.

The Ndaga Muntu system has received widespread criticism for errors made by officials at registration, such as incorrect spelling of the bearer’s name and dates of birth being misrecorded. In one notorious example, a senior citizen could not claim a monthly welfare grant for two years owing to his date of birth being recorded incorrectly at the time of registration.⁵² The system has also been called over-dependent on manual or paper-based documentation processes and criticised for failing to present alternatives for those registrants unable to present fingerprint and facial biometrics.⁵³ As one critic put it, these shortcomings have led to ‘a situation that has all the negatives and none of the positives’ of digital identification.⁵⁴

The Ugandan digital ID system collects a large amount of personal data: ‘name, date of birth, gender, information on citizenship, place of birth, details of parents, clan, tribe, ethnicity, spouse, education, tax information, personal biometrics information… as well as any other information as may be required’.⁵⁵ Capturing all this data opposes the ‘principles of data minimisation’ often associated with digital ID.⁵⁶ It also heightens the risk of ethnic profiling and surveillance. This becomes especially evident when considering that the Ndaga Muntu ID will become the only valid method of identification for accessing public and private services in Uganda.⁵⁷

Unlike Ethiopia, Uganda does have a legal framework governing data privacy, which is provided for under Article 27 of the country’s constitution.⁵⁸ The Data Protection and Privacy Act was passed in May 2019, while the Data Protection and Privacy Regulations took effect in March 2021. This framework places several restrictions on the collection, transfer and processing of personal data.⁵⁹ But, like Ethiopia, Uganda is yet to sign and ratify the Malabo Convention.⁶⁰

Section 66 of the Registration of Persons Act (ROPA) of 2015 mandates the ID as a requirement to access basic services.⁶¹ In one critic’s view, this is evidence of an undeniable ‘imbalance in the benefits accruable to citizens under the scheme’:⁶²

[It] strips away several of the fundamental rights already afforded to Ugandan citizens under the Constitution, while demanding an extreme amount of information, to grant them – again – access to those very rights and risks fomenting exclusion against persons unwilling or unable to register.

A consortium of civil society and rights organisations in Uganda sued the government in April 2022 because of the exclusionary elements of the digital ID programme. More concerns were raised recently when reports surfaced that the next iteration of the digital ID in Uganda, to be introduced in 2024, will also capture DNA biometrics.⁶³

Conclusion

The implementation of digital ID is a development likely to stay once in place. As cases of fraud and identity theft increase across the globe, additional modes of security are often incorporated. Including biometrics in the digital ID system is a good way of ensuring authenticity, but these systems are susceptible to human error, technical glitches and possible hacking. Additionally, while inclusion is often cited as a primary reason for introducing biometric digital ID, the examples of Ethiopia and Uganda both illustrate the exclusionary possibilities of such systems. Increasing the amount of information held in state ID databases could also hold potential danger, especially in contexts susceptible to ethnic conflict.

While it is important that citizens and the state are connected in this manner, implementing authorities should safeguard the personal data gathered. Handling sensitive information requires a strong legal framework that will ensure that privacy and data protection laws are enforced and oversight mechanisms implemented. The AU, in working towards a standardised framework for incorporating digital technology in governance practices, also has a responsibility to the citizens of African states to ensure that their governments implement ID projects that are truly inclusionary and mindful of the protection of their citizens.

Acknowledgement

SAIIA gratefully acknowledges the support of SIDA for this publication.

Digital Identification and Biometrics In East Africa: Opportunities and Concerns

In their efforts to upscale the roll-out of national ID systems to meet the Sustainable Development Goals, many African states have turned to digital options to facilitate foundational identity management.

Recommendations

Executive summary

Introduction

Why digital ID? And why now?

Ethiopia: Fayda

Uganda: Ndaga Muntu

Conclusion

Acknowledgement

9 Nov 2023

Research by

Series

SAIIA Programme

Region

Country

Theme

Tags

Related Research

Reflections After the BRICS Summit: Membership, Payment Systems and What Lies Ahead

PAPSS – What Is It Good For? Probably Plenty

From Koeberg to Chernobyl: The Challenge of Nuclear Safety in SA and Ukraine

High Expectations: Civil Society Participation in Conflict Early Warning and Response Systems of the AU, ECOWAS and IGAD

Governance Challenges in Cabo Delgado: Spinning Wheels in the Mud

What to Expect from the 2024 BRICS Summit

Stay up to date with our research and events >