Promoting Effective and Inclusive ICT Policy in Africa

Tag Archives: surveillance

  HomeCollaboration on International ICT Policy for East and Southern Africa (CIPESA)  /  surveillance
13Oct

Africa’s Digital Infrastructure Expands As Rights Risks Deepen, Report Warns

Author CIPESA Posted on

By Winnie Kamau |

Africa’s rapid adoption of digital public infrastructure is transforming how citizens access government and private services, but weak safeguards, digital exclusion and fragmented oversight are creating growing risks to human rights and democratic participation, a new continental report warns.

The 2026 State of Internet Freedom in Africa (SIFA) report, unveiled by Collaboration on International ICT Policy for East and Southern Africa (CIPESA) during Forum on Internet Freedom in Africa 2026 (FIFAfrica26) in Mauritius, examines the growing use of Digital Public Infrastructure (DPI) across 11 African countries and its implications for privacy, inclusion, civic participation and democratic governance.

The study covered Egypt, Ethiopia, Ghana, Kenya, Nigeria, Senegal, South Africa, Tunisia, Uganda, Zambia and Zimbabwe.

“DPI refers to foundational digital systems that allow governments, businesses and citizens to interact electronically. The report identifies three main components: digital identity, digital payments and data exchange platforms” the report explains.

According to the study, African governments are increasingly replacing fragmented government systems with interconnected digital platforms capable of sharing data, verifying identities, processing payments and delivering public services.

By the end of September 2026, 17 African countries were among 39 countries globally participating in the 50-in-5 campaign, an initiative aimed at helping countries design, launch and scale components of digital public infrastructure.

The report says early progress in countries including Ethiopia, Ghana, Kenya, Nigeria, Rwanda, Togo and Uganda, alongside continental digital transformation ambitions and support from development partners, has accelerated the adoption of DPI.

But the report cautions that technological progress is moving faster than the institutions and safeguards needed to protect citizens.

Digital Exclusion Remains A Major Concern

The study finds that people who are already digitally connected, formally documented and living in urban areas tend to benefit first from DPI systems.

Those facing barriers such as poor connectivity, limited digital literacy, disability, poverty or weak civil registration systems risk being left behind.

“Rural communities, low-income people, older people, persons with disabilities, migrants and communities facing contested citizenship are particularly vulnerable to exclusion” the report identifies.

It cites concerns raised over digital identity systems in Kenya and Uganda, where refugees, stateless people and some rural communities have faced exclusion.

The report warns that DPI can reproduce existing inequalities when a person’s ability to access services depends on documentation, biometric records, addresses or other foundational data that may be missing or inaccurate.

As more public and private services rely on the same foundational systems, a failure in one record can have consequences across multiple areas of a person’s life.

A citizen, for example, could face difficulties accessing a service because of an incorrect or missing identity, citizenship, address or birth record held by another government agency.

Connectivity Failures Could Have Wider Consequences

The report also highlights the growing dependence of essential services on connectivity and interconnected digital infrastructure.

“A cable cut, power failure, cloud outage or internet disruption could simultaneously affect identity systems, payments and public services” the report warns.

For landlocked countries, the report says resilience can also depend on neighbouring states, border crossings and regional infrastructure-restoration arrangements.

The study further finds that although governments are increasingly pursuing digital sovereignty, including local data centres, data localisation and domestic digital infrastructure where many national DPI systems remain dependent on foreign financing, technology companies and international standards.

AI generated image/CoPilot

The report identifies organisations and actors including the World Bank, development partners, Modular Open-Source Identification Platform (MOSIP), telecommunications operators, global payment networks and technology vendors as playing significant roles in financing, developing or operating various DPI systems.

Democracy And Civic Participation At Risk

The report says the consequences of DPI extend beyond service delivery to democratic participation.

It warns that the growing convergence of foundational identity systems with electoral processes and telecommunications infrastructure could expose citizens to democratic risks.

“Network disruptions, inaccurate administrative records and restrictions on digital platforms can affect people’s ability to participate in public life and exercise civic freedoms”, according to the study.

“Technology-facilitated gender-based violence, online harassment and misogynistic disinformation are also identified as factors that can discourage women from participating in political and civic life” the report shows.

The report argues that DPI does not necessarily create underlying inequalities, but can reproduce or intensify them when systems fail to account for differences in documentation, disability, gender, income, geography or language.

No Clear Continental Leaders or Laggards

The study cautions against ranking African countries simply according to their level of digital development.

It finds that countries can make significant progress in one aspect of DPI while continuing to face serious weaknesses in areas such as oversight, access or legal remedy.

According to the report, Nigeria, Ethiopia and Ghana perform strongly on aspects of scale and payments, while Kenya and South Africa are comparatively stronger on institutional contestability.

The broader finding, however, is that progress is uneven.

The report says technical development, institutional safeguards and rights protection can advance at different speeds within the same country.

Call For Stronger Safeguards

The report recommends that governments conduct human rights, data protection and equality impact assessments before major DPI systems are introduced or significantly expanded.

It also calls for transparent information about the agencies responsible for systems, suppliers and financiers, as well as accessible complaint and correction mechanisms.

Governments are urged to maintain non-digital alternatives so that citizens who cannot access digital systems are not excluded from essential services.

Oversight institutions, meanwhile, should conduct regular audits of national identity databases, interoperability platforms and government-to-person payment systems, according to the report.

The study also calls on technology companies, telecommunications operators, banks and payment firms to conduct human-rights due diligence on high-risk DPI projects, particularly those involving identity, biometrics, data exchange and surveillance.

Development partners and DPI financiers are urged to link funding and expansion to evidence of inclusion, rights protection, effective oversight and access to remedy rather than relying primarily on measures such as enrolment numbers, infrastructure coverage or transaction volumes.

For civil society and the media, the report recommends greater scrutiny of DPI before systems are deployed, including investigation of procurement, system design, vendor arrangements, identity and authentication failures and the use of digital systems in elections.

Building Trust Into Africa’s Digital Future

The report concludes that DPI is becoming an increasingly important part of the relationship between African states and their citizens.

While interconnected digital systems can improve administrative efficiency and financial inclusion, the study warns that they are not neutral simply because they are technological systems.

“Technical failures, inaccurate records and poorly designed access requirements can trigger cascading exclusion, particularly among people already facing barriers to connectivity, documentation and digital literacy” the report notes.

The report argues that the long-term legitimacy and public trust of DPI will depend on whether rights protections are built into the systems from the beginning rather than introduced later as compliance measures.

It recommends accessible non-digital channels, stronger data-protection enforcement, independent oversight, resilient connectivity and timely access to legal remedies as key elements of a rights-respecting digital future for Africa.

This article was first published by TalkAfrica on October 12, 2026. Click here to read more on their website

05Oct

State of Internet Freedom in Africa 2026 Report Launched at FIFAfrica26

Author CIPESA Posted on

FIFAfrica26 |

For four days, the Forum on Internet Freedom in Africa (FIFAfrica26) brought together voices from across Africa and beyond to engage in discussions and debates on the state and future of internet freedom in Africa. The Forum concluded with the launch of the 2026 edition of the State of Internet Freedom in Africa report.

This year’s report examines how Digital Public Infrastructure (DPI) systems are reshaping the relationship between states and citizens, particularly in relation to digital rights, democratic governance and civic participation. Much of the existing work on DPI has focused on technical design, economic efficiency and service delivery outcomes, with far less attention given to the human rights implications of DPI governance and implementation.

The report was officially launched during the FIFAfrica26 closing ceremony by Dr the Hon. Avinash Ramtoh, Minister of Information and Communication Technology of Mauritius. “DPI is a critical infrastructure in any forward-looking country,” he said. “We must make our internet more inclusive, accessible and rights-respecting.”

The report documents how DPI deployment is affecting human rights, governance and democratic participation across 11 African countries: Egypt, Ethiopia, Ghana, Kenya, Nigeria, Senegal, South Africa, Tunisia, Uganda, Zambia and Zimbabwe. It provides evidence that can support civil society organisations, policymakers, development partners, regional institutions and technology providers in strengthening rights-respecting DPI governance frameworks before these systems become further entrenched in public administration and everyday life.

DPI is increasingly positioned as a foundation for digital transformation, offering systems that can support services such as digital identification, payments and data exchange. Across Africa, governments and development actors are investing in these systems as part of broader efforts to modernise public services and expand digital economies.

Hosted in Mauritius, FIFAfrica26 created space for policymakers, researchers, civil society organisations, journalists, technologists, activists, development partners and others to exchange experiences, challenge assumptions and interrogate some of the most pressing questions facing Africa’s digital society.

Since its inception in 2014, FIFAfrica has become an important convening space for shaping debates on digital rights, internet governance and civic freedoms across the continent. Its continued relevance lies in its ability to remain closely attuned to the changing realities of Africa’s digital landscape.

Across conversations on artificial intelligence, digital public infrastructure, data governance, platform accountability, digital inclusion, civic participation and digital security, the theme that remained constant was that technology is not separate from society. The systems we build, the rules that govern them and the choices made about their use have consequences for rights, participation and power.

As Africa’s digital transformation accelerates, these questions are becoming increasingly important. The systems being built today will shape how people access services, engage with governments, participate in public life and exercise their rights for years to come.

Find the full report here: State of Internet Freedom in Africa 2026

15Sep

Beyond AI Safety: Why Africa Needs Sovereignty and Agency in Global AI Governance  

Author CIPESA Posted on

By Lillian Nalwoga |

As artificial intelligence reshapes economies and everyday life, the essential question for African countries is not simply whether AI will be safe. It is whether African societies will have the power, infrastructure, skills, resources, and representation to shape how AI is built and used.

The Inaugural UN Global Dialogue on AI, held in July 2026, among its priorities called for the need for “safe and inclusive AI” among others. However, the message from African delegates pointed to a broader concern. Safety without sovereignty and agency is not enough. Delegates pointed to limiting factors such as the lack of access to computing power, locally relevant data, technical expertise, financing, and meaningful influence over global AI rules. The speed of AI development intensifies these challenges. The preliminary report of the Independent International Scientific Panel on AI rightly warns that technological advances are moving faster than governments’ ability to adapt. This could create risks that can be severe, further worsening existing inequalities and undermine digital rights. The report further notes that steps to close these gaps do exist, but they require sustained investment in Member States’ capacity to shape, evaluate, and deploy AI.

Many African countries are now developing AI strategies and policies with the goal to harvest opportunities and mitigate AI risks. However, regulating alone without the necessary infrastructure, data, and human capacity are unlikely to deliver the desired outcomes. Moreover, as noted in the preliminary report, current global AI systems often overlook indigenous languages and cultures resulting in inaccurate outputs and systems that are poorly suited to local realities.

The need to protect data sovereignty was another issue that emerged clearly from the dialogue. Africa member states emphasized the need to have control over how their data is used, while ensuring that cross-border data arrangements are fair and mutually beneficial. For this to manifest, African countries would require access to computing capacity, high-quality data, skilled talent, sustainable financing, reliable electricity, and robust digital infrastructure to support meaningful AI development.

These concerns were further highlighted by the governments of Rwanda and Uganda, who noted that more than half of the world’s data centers are located in just a handful of wealthy countries, while Africa possesses less than 1 percent of global AI computing capacity. This systemic inequality risks entrenching dependence on foreign platforms, cloud providers, and AI models that are not designed for African contexts. Despite its significant contribution to the global AI economy in terms of critical mineral resources and social data, Africa is still too often positioned as a consumer rather than a shaper of AI technologies, standards, and governance.

This imbalance cannot be solved by ethical principles alone. From an African perspective, AI governance is not only a regulatory exercise; it is an infrastructure, development, and justice agenda. African member states at the Dialogue reinforced this message. Government delegates from Rwanda and Kenya for instance highlighted the need to expand access to infrastructure and financing, invest in skills and talent, reduce regulatory fragmentation, and build on regional initiatives such as the Africa Declaration on Artificial Intelligence. Other delegates similarly stressed that AI must be transparent, accountable, and subject to meaningful human oversight. The protection of underrepresented languages, cultures, and data, as well as concrete forms of international cooperation, was also highlighted.

The priorities identified by African stakeholders. This distinction should define the future of the Dialogue. Unlike what was seen at the India AI Summit, the UNGDIA drew many high-level African government delegations, who clearly voiced the continent’s priorities for advancing AI. African participation and that of the Global South must go beyond consultation after key decisions have been made. Stakeholders from the Global South should play a leading role in setting priorities, developing standards, and monitoring AI implementation. The challenge for the Dialogue is therefore not only to identify risks but also to ensure that countries have the capacity to prevent them and to benefit from AI on fair and equitable terms. The choice should not be between innovation and rights. The Dialogue must ensure that AI advances development without compromising dignity, privacy, equality, or democratic participation. This is also anchored in calls by civic actors from the Global South, who have long called for not merely inclusion in global AI discussions but also a South-led rights-based AI paradigm grounded in planetary limits, democratic participation, and intergenerational justice. Additionally, CIPESA’s research on AI impact in Africa has highlighted the need for a human-rights approach to AI regulation and the adoption of a human- centred AI governance in Africa, through deliberated and inclusive approaches.

Moreover, the UN Global Dialogue on AI can make a meaningful contribution by moving from issuing broad statements to practical, measurable actions anchored in Africa’s sovereignty, agency, and capacity to shape its own digital future. As the dialogue moves into its intersessional phase, it must shift from discussion to action. Global South governments and civil society are demanding equal footing in AI governance, and the UN must listen. One way to do this would be for the UN to champion a consolidated fund for AI development and capacity building in the Global South. The UN Secretary-General suggested creating a Global Fund on AI with a target of $3 billion to facilitate building basic AI capacity in developing countries. According to him, this is “less than one per cent of the annual revenue of a single tech company.” If successfully adopted, it could help launch AI development initiatives in many Global South countries. However, relying solely on tech companies is unlikely to address Africa’s and the wider Global South’s AI challenges. That is why African countries are calling for a holistic approach to AI investment. The 2025 Africa Declaration on Artificial Intelligence proposes the creation of a $60 billion Africa AI Fund financed by public, private, and philanthropic capital. The fund will support AI infrastructure, African AI businesses, workforce development, and domestic research capacity. It still remains unclear when these funds will take effect.

Nonetheless, more efforts are still needed to create public awareness on the ethical use of AI while also strengthening civil society voices in advocating for human rights respecting AI development.

10Sep

Mozambique’s Internet Shutdown Case: African Courts Draw a Line on Executive Power

Author CIPESA Posted on

By CIPESA Writer |

In July 2026, Mozambique’s Constitutional Council ruled that before a government can justify an internet shutdown, it must first have lawful authority to order one. The ruling signifies that before governments restrict connectivity, they must be able to show not only that the power to do so was lawfully created, but that it was exercised by a legally authorised authority.

The ruling comes against a wider pattern across the continent, where governments have used internet shutdowns to silence dissent and restrict fundamental rights.

The Constitutional Council declared 18 provisions of the Telecommunications Traffic Control Regulation (Decree No. 48/2025) unconstitutional, following a petition from the Center for Democracy and Human Rights. These provisions granted the telecommunications regulator, the National Communications Institute of Mozambique (INCM), broad powers to control telecommunications traffic, collect user data, intervene in operators’ networks using its own technology without their consent, and monitor communications on stated grounds including protecting state security and mitigating fraud.

The Council’s ruling was not about a recently imposed internet shutdown. Instead, it examined provisions of the regulation that gave the authorities powers to monitor communications, collect data, suspend telecommunications services and intervene in networks. The question was whether those powers could be created through regulation without a sufficient basis in legislation enacted by Parliament. The Council found that they could not, holding that the executive had effectively assumed the role of Parliament in defining the essential content of fundamental rights.

The Council described this as “organic unconstitutionality” and held that powers capable of restricting fundamental rights could not be created through executive regulation alone, but required parliamentary legislation that complies with constitutional and human rights protections.

In the Constitutional Council’s words, the provisions “substituted the Government for the Assembly of the Republic’s legislature in defining the essential content of fundamental rights”, contrary to Article 178 of the Constitution.

The Mozambique ruling also helps clarify three contentious questions emerging in shutdown litigation across the continent. What law permits the restriction, and who is authorised to order it? Which rights does it affect, including freedom of expression and access to information? And even where a legal power exists, is the restriction genuinely necessary and proportionate to the stated aim?

A Regional Pattern of Unlawful Interference
Mozambique’s ruling mirrors a broader African legal front against arbitrary internet shutdowns. Across the continent, governments have used shutdowns to restrict political opposition, communication, mobilisation, assembly, association and protest, in some cases without a sufficient legal basis.

In January 2019, the High Court of Zimbabwe ruled that the state security minister had no legal authority under the Interception of Communications Act to order an internet shutdown or issue an intercept directive to mobile network operators. The shutdown was ordered amid nationwide protests against rising fuel prices, but was later restored.

In Togo, the ECOWAS Community Court of Justice found that Togo’s three-day internet shutdown during the 2017 protests violated freedom of expression under Article 9 of the African Charter because it lacked authorisation under national law. The Court also ordered compensation to the applicants for the violation of their right to freedom of expression. The judgment affirmed that access to the internet enables people to exercise rights that are already protected, particularly freedom of expression and access to information.

In Nigeria, the court reached a similar conclusion, finding that the government’s seven-month suspension of Twitter violated freedom of expression, access to information, and media freedom. It described access to the platform as “a derivative right that is complementary to the enjoyment of the right to freedom of expression.”

The case of Association des Blogueurs de Guinée (ABLOGUI) and three others against Guinea shows that a legal basis alone is not enough. In that case, the ECOWAS Court found that restrictions on internet and social media access between October and December 2020 violated the applicants’ rights to information and freedom of expression. The case reinforces the rule that a government must show not only that a restriction is authorised by law, but also that it serves a legitimate aim and is necessary and proportionate.

In Senegal, the shutdowns imposed during the 2023 unrest violated freedom of expression and access to information for both applicants. The court also upheld Ndiaga Gueye’s individual claim that the shutdown violated his right to work as an IT consultant. The case illustrates that shutdowns can disrupt far more than speech. They can cut people off from work and other essential digital services, while disrupting journalism, education, payments and access to health information.

Strengthening Preventive Safeguards
Courts are not the only institutions shaping this debate. For years, the African Commission on Human and Peoples’ Rights (ACHPR) has set continental standards on open internet access. The Commission’s resolutions and declarations do not carry the same legal force as court judgments. Still, they provide important guidance on how African states should protect freedom of expression, access to information, and access to the internet.

Its 2019 Declaration of Principles on Freedom of Expression and Access to Information in Africa, Principle 38(2), provides that states “shall not engage in or condone any disruption of access to the internet and other digital technologies for segments of the public or an entire population.”

In March 2024, the Commission went further in Resolution 580, calling on states to ensure open and secure internet access before, during, and after elections, and to refrain from ordering shutdowns or disrupting digital communication platforms during the electoral process.

Conclusion
Despite judicial victories, the threat remains pervasive, and litigation alone is insufficient when judgments arrive years after the harm. In 2025, the #KeepItOn coalition recorded 30 shutdowns across 15 African countries.

There must be independent oversight, public transparency, and effective ways for people affected by an unlawful restriction to challenge it and seek redress. Telecommunications operators should also be protected from being forced to carry out unlawful orders. Only then can we ensure that the digital rights of millions are protected from the arbitrary exercise of power.

Mozambique’s ruling affirms that digital rights are not subject to executive whim. Governments must respect the rule of law, ensuring that restrictions on connectivity that limit fundamental rights are grounded in parliamentary legislation and subject to rigorous constitutional safeguards.

08Sep

Uganda’s Digital Economy: Rights Trends, Regulatory Gaps and Policy Responses

Author CIPESA Posted on

By Doreen Elizabeth Namuyanja |

Uganda’s digital economy is expanding rapidly across finance, transport, agriculture, commerce, healthcare and public-service delivery. However, this growth is outpacing the legal, regulatory and institutional safeguards needed to address emerging concerns around personal and biometric data, artificial intelligence, platform work, digital exclusion and internet shutdowns.

Drawing on a 2025 survey, two commentaries and a policy submission by CIPESA, this policy brief examines Uganda’s evolving digital business landscape, business data practices, the future of work and the impact of internet disruptions. It highlights the gaps between technological advancement and effective governance and proposes actions for government, businesses, private sector associations and civil society to build an inclusive, resilient, and rights-respecting digital economy.

The brief finds that Uganda has established important legal protections, including the Data Protection and Privacy Act of 2019. The principal challenge, however, is implementation, enforcement, and the ability of regulatory and institutional frameworks to adapt to rapidly evolving technologies and business models. Businesses frequently collect personal and biometric data without sufficiently explaining how it will be used, stored, shared, or deleted. Meaningful consent, data security, and effective retention and deletion practices also remain inconsistent, particularly among businesses with limited compliance capacity.

These gaps have consequences beyond privacy and individual rights. Weak data governance can undermine trust in digital services, while inadequate safeguards for platform workers and persistent digital exclusion can limit who benefits from the digital economy. Internet shutdowns pose a broader threat, disrupting digital financial services, e-commerce, public services and other activities that increasingly depend on reliable connectivity.

The brief calls for coordinated action by government, businesses, private sector associations and civil society to:

Businesses

  • Strengthen data governance and informed consent: implement collection and processing frameworks built on explicit, freely given consent, backed by clear, accessible privacy notices.
  • Improve data security and lifecycle management: adopt encryption, regular security audits, and clear retention, deletion and minimisation policies.
  • Build organisational compliance capacity: appoint and train Data Protection Officers, embed privacy-by-design into product development, and run regular staff training on data protection, cybersecurity and phishing risks.
  • Strengthen digital resilience: develop business continuity plans for internet disruptions, and collaborate with civil society and legal actors to promote an open, secure and reliable internet.

Government of Uganda

  • Strengthen enforcement of the data protection framework by adequately resourcing the Personal Data Protection Office (PDPO) and other regulators to conduct audits, investigate violations, and impose proportionate sanctions.
  • Modernise the legal and policy framework to address biometric data, AI and platform work, aligned with constitutional and international human rights standards, and issue practical, sector-specific guidance to help businesses, particularly SMEs, comply.
  • Promote digital inclusion and public awareness through sustained education campaigns, including in local languages, and continued investment in affordable infrastructure and digital skills.
  • Safeguard the digital economy against internet disruptions by developing clear legal safeguards against shutdowns and ensuring any restrictions comply with constitutional and international human rights obligations.

Private Sector Associations

  • Build members’ capacity through regular training on data protection, cybersecurity, AI governance and business continuity planning.
  • Promote industry standards and peer learning by developing model policies and compliance toolkits for consistent implementation across member organisations.
  • Support risk management by encouraging periodic risk assessments among members and facilitating the sharing of lessons learned and mitigation strategies.

Civil Society Organisations

  • Strengthen multi-stakeholder collaboration among government, businesses, academia and technical experts on data protection, AI governance and digital rights.
  • Promote public awareness and digital rights literacy through accessible educational materials and community outreach.
  • Undertake research and evidence-based advocacy on biometric data governance, AI, platform work and internet shutdowns, including documenting their social, economic and human rights impacts, to support stronger legal frameworks and strategic litigation.
  • Support business compliance and resilience by developing practical guidance, templates and capacity-building support on responsible data governance.

Read the full brief here.

1 2 3 … 22