State of Internet Freedom in Africa 2022: The Rise of Biometric Surveillance

FIFAfrica22 |

Digital biometric data collection programmes are becoming increasingly popular across the African continent. Governments are investing in diverse digital programmes to enable the capture of biometric information of their citizens for various purposes.

A new report by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) documents the emerging and current trends in biometric data collection and processing in Africa. It focuses on the deployment of national biometric technology-based programmes in 16 African countries, namely Angola, Cameroon, Central African Republic, Democratic Republic of Congo, Kenya, Lesotho, Liberia, Mozambique, Nigeria, Senegal, Sierra Leone, Tanzania, Togo, Tunisia, Uganda, and Zambia.

The report published today is the ninth consecutive one issued by CIPESA since 2014 under the State of Internet Freedom in Africa series. It was released at the Forum on Internet Freedom in Africa (FIFAfrica), which is taking place in Lusaka, Zambia.

The biometric data collection programmes reviewed by the report include those related to civil registrations, such as the issuance of National Identity cards, biometric voter registration and identification programmes, government-led CCTV programmes with facial recognition capabilities, national ePassport initiatives, refugees’ registration, and mandatory biometric SIM card registration.

The report highlights the key trends, potential risks, challenges and gaps relating to biometric data collection projects in the continent. These include limited public engagement and awareness campaigns; inadequate legal frameworks that heighten risks to privacy; exclusion from accessing essential services; enhanced surveillance, profiling and targeting; conflicting interests and the wide powers of third parties; and limited capacity and training. 

Consequently, the study notes that these biometric programmes are being implemented in countries with poor digital rights records, declining democracy and rising digital authoritarianism, which casts doubt on the integrity of biometric data collection programmes and the resultant databases. Thus, viewed collectively, the developments, trends and risks outlined in the report heighten concern over the growing threats to the right to privacy of personal data and potential violations of digital rights on the continent. 

Finally, the report presents recommendations to various stakeholders including the government, civil society, the media, the private sector and academia, which, if implemented, will go a long way in addressing data protection and privacy gaps, risks and challenges in the study countries. 

The key recommendations include a call to:

  • Governments to implement the laws and policy frameworks on identity systems and data protection and privacy while paying keen attention to compliance with regionally and internationally recognised principles and minimum standards on data protection and privacy for biometric data collection and require the adoption of human rights-based approaches. 
  • Countries without data protection and privacy laws such as Liberia, Mozambique, Sierra Leone and Tanzania should expedite the process of enacting appropriate data protection laws so as to guarantee the data protection and privacy rights of their citizens. 
  • Governments to ratify the AU Convention on Cyber Security and Personal Data Protection (Malabo Convention) to ensure government commitment to regional data protection and privacy as a means to hold them accountable.
  • Governments to establish independent and robust oversight data protection bodies to regulate data and privacy protection including biometric data.
  • Civil society to engage in advocacy and lobby governments to develop, implement and enforce privacy and data protection policies, laws and institutional frameworks that are in compliance with regional and international minimum human rights standards.
  • Civil society to monitor, document and report on the risks, threats, abuses and violations of privacy and human rights associated with biometric data collection programmes, and propose effective solutions to safeguard rights in line with international human rights standards.
  • The media to progressively document and report on initiatives such as advocacy by civil society and other stakeholders to keep track of developments. 
  • The media to conduct investigative journalism to identify and expose privacy violations arising from the implementation of biometric data collection programmes.
  • The private sector to take deliberate efforts to ensure that all their respective biometric data collection programmes and systems are developed implemented and managed in compliance with best practices prescribed by the national, regional and international human rights standards and practices on privacy and data protection, including the UN Guiding Principles on Business and Human Rights.
  • The private sector to ensure that they progressively adopt and develop comprehensive internal privacy policies to guide the collection, storing and processing of personal data. 
  • The private sector to take deliberate efforts aimed at involving data subjects in the control and management of their personal data by providing timely information on external requests for information. 
  • Academia to conduct evidence-based research on data protection and privacy including biometrics, highlighting the challenges, risks, benefits and trends in biometric data collection programmes. 

The full State of Internet Freedom in Africa 2022 Report can be accessed here.

How Surveillance, Collection of Biometric Data and Limitation of Encryption are Undermining Privacy Rights in Africa

By Paul Kimumwe |

The right to privacy online has become a critical human rights issue, given its intricate connection with, and its being a foundation for the realisation of other rights including the rights to freedoms of expression, information, assembly, and association and preservation of human dignity. However, many African countries have steadily taken measures to undermine this right, including enacting retrogressive laws and policies that facilitate surveillance and the collection of biometric data, and others that limit the use of encryption

The advent of the Covid-19 pandemic has exacerbated the privacy concerns yet in several countries, digital rights were already under steady attack, including via internet shutdowns, criminalisation of “false news”, misinformation and disinformation campaigns by state and non-state actors, harassment and prosecution of social media users, and growing state surveillance.

In responding to the pandemic, many countries adopted regulations and practices, including deploying surveillance technologies and untested applications, to enable them collect and process personal data for purposes of tracing, contacting, and isolating those suspected to be carrying the virus and those confirmed to carry it. These measures were quickly adopted, often without adequate regulation or oversight.

In this research report, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) has analysed laws and policies that impact on privacy, notably those that regulate surveillance, data localisation, biometric databases, and encryption.

The research covered 19 countries – Cameroon, Chad, Egypt, Ethiopia, Kenya, Ghana, Malawi, Mali, Mozambique, Namibia, Nigeria, Rwanda, Senegal, Tanzania, Tunisia, Uganda, Zambia, Zimbabwe, and South Africa.

Summary findings

Growing Surveillance: The research findings show that overall, there has been notable progress in the enactment of specific laws and policies safeguarding the right to privacy, including requiring judicial authority to authorise surveillance in countries such as Kenya, Nigeria, Tanzania, Tunisia and Uganda.

However, there are a few cases, such as in Zimbabwe, where authorisation for monitoring and intercepting communications is offered by non-independent and partial actors such as ministers. In addition, many of the countries’ laws do not measure up to international human rights standards and fail to establish clear and appropriate oversight, redress, and remedy mechanisms.

Indeed, “national security” considerations have been employed in laws in various countries broadly to justify and authorise the interception of communication, restrict privacy rights, grant wide search and seizure powers to law enforcement agencies, mandate intermediaries such as telecommunication service providers to facilitate interception, and to require data localisation.

In addition, while various countries have criminalised illegal surveillance and placed various safeguards on the conduct of state surveillance, many of them still contain retrogressive provisions that leave scope for intrusion, including enabling state surveillance with limited safeguards.

Limitation of Encryption Anonymity and the use of encryption in digital communications are critical in advancing both the right to freedom of expression and right to privacy. In the absence of these rights,  the capacity of individuals to communicate anonymously and without fear of their communications being intercepted cannot be guaranteed.

There are few positive provisions in some countries that require the protection of personal data through technical security measures which include encryption. On the other hand, many countries in the study have passed legislation that limit anonymity and the use of encryption through criminalisation of possession and use of cryptographic software or hardware, providing for fines and prison sentences.

The findings show that in countries like Chad, Malawi, Senegal, Tanzania, Tunisia and Zambia, there are penalties for offering cryptographic services without licensing, registration or authorisation. Interception of communications provisions often require service providers to decrypt any encrypted information that they may intercept in the course of offering assistance to lawful interception. In countries such as Mali and Tanzania, the laws require the encryption service providers, upon registration with the authorities, to disclose the technologies they plan to use for encryption.

Data Localisation The findings show that a growing number of African countries have been legislating on data localisation, which has mostly taken the form of a requirement to store data locally and forbidding unauthorised cross-border data transfers. Various countries have specified the conditions for authorising transfer, mostly where the data subject has offered consent and where an adequate level of protection is assured in the recipient country or international organisation.

Several African countries have adopted different approaches towards data localisation. Several countries use laws on financial services (Nigeria, Ethiopia and Rwanda), cybersecurity and cybercrimes (Rwanda, Zambia and Zimbabwe), telecommunications (Cameroon, Rwanda and Nigeria) and data protection (Kenya, South Africa, Tunisia and Uganda) to place restrictions on cross-border transfer of data.

Some countries have specified the data that cannot be exported without authorisation. Kenya specifies all public data; Nigeria mentions all government data and all subscriber and consumer data; while Zimbabwe, Malawi and Tunisia cite personal information.

Establishment of Biometric Databases  In several countries, government agencies are collecting and processing personal data without adequate data protection laws, amidst limited oversight mechanisms and inadequate remedies. While many have recently passed data protection laws and policies, implementation is not effective, and the safeguards are not water-tight as required under international human rights law.

Some laws in countries such as Chad, Kenya, Tunisia, Uganda, South Africa, and Zimbabwe, prohibit the collection of certain categories of data, including specific types of biometric data generally, or where certain conditions are not complied with. In the other countries studied, the laws require the mandatory collection of biometric information for the registration of telecommunications subscribers, for digital identity programmes and during voters’ registration. Several laws and policies on biometric data collection contain provisions on sanctions and penalties for breach.

Weak Oversight, Transparency and Accountability Mechanisms The study found that countries have adopted different approaches to oversight, including specifying courts, data protection authorities, sector regulators and administrative bodies as key oversight bodies. Some of these bodies are located within the executive, and therefore may lack the proper legal, financial, and institutional independence to stem violations within government, and especially by state security agencies. The laws in most countries require judicial authorities to issue a warrant for interception or monitoring of communications. However, in some countries interception orders can be issued by non-judicial officials, such as ministers.

The deficiency of accountability and transparency is among the weakest links in the various countries’ surveillance laws. While some countries, such as Nigeria, Rwanda, Tunisia, Zimbabwe, have commendable oversight and accountability provisions, it is not known whether they are applied. No entity in any of the countries studied permits public access to records on interception which the laws require state authorities to compile periodically, or publishes any data related to interception warrants issued and if at all they do record such data, they are categorised as classified information under state secrets laws. Thus, the public and oversight institutions such as judiciaries and parliaments remain in the dark about the extent and legality of the conduct of surveillance in the respective countries.

Recommendations

  • Governments should review existing laws, policies and practices on surveillance, including Covid-19 surveillance, biometric data collection, encryption and data localisation to ensure they comply with the principles in the African Commission on Human and Peoples’ Rights (ACHPR) Declaration on Principles of Freedom of Expression and Access to Information in Africa and international human rights standards.
  • Governments should also adopt multi-stakeholder approaches to ensure meaningful participation of all stakeholders in the development of policies and laws that affect the right to privacy and data protection.
  • Civil society actors should use strategic public interest litigation as an avenue to challenge laws that violate privacy rights and push for policies and practices reforms that uphold privacy.
  • Civil society actors should also monitor and document privacy rights violations through evidence-based research, and report on state compliance with their obligations to human rights monitoring bodies.

See the full research report here.

Data Protection Policy Developed to Guide FinTechs in Ghana

by Ashnah Kalemera and Edrine Wanyama |

The Financial Inclusion Forum Africa, through an Africa Digital Rights Fund (ADRF) grant, has drafted a Data Protection and Privacy Policy to serve as an internal guide on how digital financial service providers in Ghana should collect, store and process individuals’ data. The ADRF is an initiative of the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) which provides flexible and rapid response grants for the advancement of digital rights in Africa.

The policy outlines principles on the management of personal data in compliance with Ghana’s Data Protection Act 2012 and the International Organization for Standardization and International Electrotechnical Commission Standards for Information Security Management – ISO 27001:2013.

The policy outlines data protection principles including accountability by jurisdiction of data subject; lawfulness of processing through consent; disclosure of purpose; compliance with further processing; accuracy and completeness; openness; safeguards; and correction as well as deletion. The principles of privacy outlined are legal compliance; limitations of purpose; adequacy; and retention. 

The policy requires mandatory and frequent information security awareness training for staff and the constitution of an Information Security team responsible for implementing the policy and incident response. Roles and responsibilities are also outlined for risk and compliance, heads of departments, and employees. Provisions for the rights of data subjects include the right of access, rectification, cessation of processing and prevention of automated decision making. In the event of violation of the provisions, the policy provides for internal investigations and sanctions under the law. 

The policy was previewed at the Data Protection and Privacy Roundtable, which saw leading digital financial service providers such as Appruve, Jumo, Vodaphone Cash, and G Money, alongside industry experts and regulators such as the eCrime Bureau, RegTheory, and CUTS (Consumer Unit and Trust Society) Ghana provide insights into its viability and applicability. Discussions drew on real-life experiences of service providers and key feedback was incorporated into a revised version of the policy.

Commenting on the policy, Dr. William Derban, Chairperson of the Financial Inclusion Forum Africa, stated that data privacy and protection was “critical to financial inclusion”, as data was the cornerstone of innovation in digital financial services delivery. “These guidelines [the policy] serve as a template to enable fintechs who are developing such services to ensure that all our data is being protected,” he added. 

With data breaches, including by business entities, a growing concern among users of digital services across the African continent, the policy can go a long way in addressing the live issues in protecting the privacy of data in the financial sector in Ghana, if widely adopted by service providers.

As data becomes increasingly pivotal to the digital economy and digital rights, it is becoming essential to develop sector-specific data protection guidelines. The fintech sector, which is growing exponentially in Africa, is one of these sectors. Such guidelines are essential to buttress existing legislation, which in Ghana’s case includes the Payment Systems and Services Act, 2019Data Protection Act, 2012, Electronic Communications Amendment Act. 2016, Electronic Transactions Act, 2008 and the Anti-Money Laundering Act, 2008.

While the policy is not binding, it is anticipated that through ongoing data protection and privacy campaigns, it will draw stakeholder buy-in and implementation, as it is in harmony and gives effect to various local laws while also reflecting the General Data Protection Regulation of the European Union and the African Convention on Cyber Security and Personal Data Protection which Ghana has signed and ratified.

Register for The Data Privacy Summit 2021

Online Event |

The Collaboration on International ICT Policy for East and Southern Africa (CIPESA) alongside Article 19, Facebook, FGI Benin are pleased to host the Data Privacy Summit 2021 (#DataPrivacySummit21) in commemoration of Data Privacy Day.

Data Privacy Day was launched by the Committee of Ministers of the Council of Europe on 26th April 2006, to be celebrated each year on 28th January; the anniversary of the signing of Convention 108 – the first legally binding international treaty on privacy and data protection. Since then, this day has come to represent international efforts to empower individuals and businesses to respect privacy, safeguard data and build trust.

Data Privacy Summit 2021, thus aims to raise awareness on contemporary privacy and data protection issues in Africa and the Middle East, as well as to inspire individuals, policymakers, organisations to take action and adopt best practices that protect privacy while promoting innovation in a manner that mitigates risks in the increasing use of digital technologies.

To see the lineup of sessions and speakers, register here.

African Civic Tech and COVID-19: Five Emerging Trends

By Melissa Zisengwe |

Africa has a growing civic tech community that focuses on issues such as accountability and transparency, data journalism, citizen participation, and public services monitoring. Since the outbreak of COVID-19, various technologies have been deployed by citizens, civil society organisation, start-ups, private companies, universities and governments to aid the fight against COVID-19.  Specifically, the civic tech community has created several innovations or adapted and repurposed existing resources to confront the COVID-19 pandemic.

The findings resulting from interviews conducted with civic tech innovations from Kenya, Nigeria, South Africa and Uganda indicate that the potential for technology to facilitate the fight against COVID-19 is clear. Across the continent, the emerging trends include contact tracing, instant messaging, digital governance, information dashboards and predictions and debunking misinformation.

For instance, platforms leveraging instant messaging applications such as GovChat and Grassroot in South Africa, as well as Uganda’s Ministry of Health Chatbot have supported remote government-citizen interactions, community organising and access to information, respectively in compliance with national COVID-19 standard operating procedures. Similarly, there has been a shift in governments’ adoption and use of technology, with many operations such as  the judiciary in Kenya and emergency services in Uganda moving online.

Further, the use of data mining and spatial analysis techniques to aid analysis into  the spread of the virus at provincial level in South Africa, and functioning of health centres in Burkina Faso indicates that the civic tech community, along with the private sector and the government, appreciate the importance of access to information in a pandemic.

While dashboards are keeping citizens updated on Coronavirus related news, some organisations are taking it a step further to ensure that citizens receive the accurate information and stop the spread of the disinfodemic, which is the spread of unverified, untrue information about the disease. This is being achieved through virtual games in Uganda and live guides among others.

 In several countries, organisations, governments and companies are reported to have employed digital contact tracing measures. Although the extent of this trend is unknown, common practices include contact tracing apps, CCTV surveillance, and cell phone location data tracking.

While these contact tracing apps and efforts could indeed aid the countries in their fight against COVID-19, they present some concerns over data privacy and surveillance. Tracking via mobile technology means personal information such as an individual’s location and movements, and their COVID-19 status could be disclosed without consent and oversight mechanisms for protection and accountability.

The trends above show that the civic tech community in Africa is willing to do their part in society and that innovation is not always a shiny new app or product; rather, sometimes it is existing tools and methodologies which can be repurposed to respond to  emerging needs. While these tools have been instrumental in shaping the fight against COVID-19, user sensitisation towards increased adoption during and in the aftermath of the pandemic remains crucial.

Read the full brief here.


Melissa Zisengwe is a 2020 CIPESA Fellow focussing on the area of civic technology in Africa.