2020 is a crucial year to fight for data protection in Africa

Africa is a testing ground for technologies produced elsewhere: as a result, personal data of its people are increasingly stored in hundreds of databases.

Key findings
  • As Africa is a testing ground for technologies produced elsewhere in the world, too many of the continent’s inhabitants are still excluded from enjoying basic rights, nevertheless their personal information is a valuable commodity in the global market, even when - domestically - safeguards mechanisms are still terribly inadequate.
  • So far 24 African countries, out of 53, adopted laws and regulations to protect personal data, and the number is slowly rising. The 2016 EU General Data Protection Regulation stands as a model for many.
  • The European Union's data protection laws are applied inside the EU area - at least in theory - but their application and enforcement remains foggy when it comes to the bloc’s data processing activities in its African neighbours.
  • In 2020, at least twenty African countries will go to the polls, for both legislative and presidential elections, and citizens will express their voting preferences thanks to biometric voting sytems. In most cases, the cards and the voting equipment are produced by Western companies that obtain lucrative contracts with African governments.
Long Read

Commercial interests seem to often overshadow the EU’s stance as a global privacy leader. After looking at Europes's shady funds to border forces in the Sahel area, Niger's new biometric voting system, and attempts to dismantle smugglers networks powered by Europe's gifts of surveillance, freelance journalist Giacomo Zandonini looks at the battle for data protection and digital rights in the continent.

What do a teenage labourer on a marijuana farm in Lesotho, a retired school teacher in Nigeria, a Somali family who escaped militants violence, a fan of the latest smartphone in Tanzania and a medical patient in Ghana have in common? They all live in Africa, of course. But there’s something more: in order to access basic rights such as healthcare, welfare assistance, food allowances, employment or to surf the internet, they all need to register their biometric data. Most of the time, this involves submitting fingerprints, iris scans and facial images that are fed into private or public databases.

As Africa is a testing ground for technologies produced elsewhere in the world, from North America to Korea, the EU or China, personal data of its people are increasingly stored in hundreds of these databases.

Too many of the continent’s inhabitants are still excluded from enjoying basic rights, nevertheless their personal information is a valuable commodity in the global market, even when - domestically - safeguards mechanisms are still terribly inadequate.

Back in 2017, the global scandal surrounding the British company Cambridge Analytica served as a wake up call for stronger data protection in Africa. One of the reasons Cambridge Analytica could amass large databases of personal information was exactly the lack of data protection mechanisms in countries where they operated.

Data exploitation is big business - personal information collected as part of a health survey could be repurposed for a client that is, say, a political party desperate to win an election.

Sneak peek: it’s a somber scenario, but there's good news. Many countries are strengthening their legal provisions regarding access to personal data, while civil society organizations fight to bring privacy into public discussion. It’s an unfair battle, opposing tech ‘goliaths’ - that often sit side by side with government officials - to unarmed Davids, but in some cases audacity paid back. Here are four hot topics that will shape the ‘scramble for Africans data’ in the coming year, from civil status to immigration systems, from voting registers to sim cards - and much more.

And a spoiler: whilst the EU is presenting itself as a global leader in data protection it fails to act accordingly, when coming to its partnerships in Africa. We’re talking about the European Union, whose data protection laws shine like a lighthouse inside the EU - at least formally - but their application and enforcement remains foggy when it comes to the bloc’s data processing activities in its African neighbours.

More and more laws…

So far 24 African countries, out of 53, adopted laws and regulations to protect personal data, and the number is slowly rising. The 2016 EU General Data Protection Regulation stands as a model for many.

As an example, Nigeria - the continent’s biggest economy and most populated country - adopted its first Data Protection Regulation in early 2019. Public and private actors have to conduct internal assessments, while the National Information Technology Development Agency (NITDA) - the governement’s agency in charge of monitoring IT development - is set to enforce norms and vigilate over their respect.

The regulation is still seen as a partial instrument, as NITDA’s core mandate is the expansion of a ‘regulated’ digital market, and the agency depends fully from the minister of communications.

“It’s a fair starting point, but now we need a comprehensive Data Protection Act and an independent monitoring authority,’’ said Ridwan Oloyede, a privacy expert at Nigerian consultancy firm Tech Hive. Oloyede is particularly worried about secure technology and independent monitoring.

“Nigeria has at least five nation-wide databases, plus others in some of our 36 states and all of them are compulsory to obtain a series of services,’’ he explained. Experience, though, suggests they are not necessarily secured and that little remedy exists when potential breaches are exposed.

Back in 2018, the case of the Nigeria HIV/AIDS Indicator And Impact Survey, one of the world’s biggest HIV surveys ever, risked exposing personal details, including pregnancy and results of medical examinations, of about 80,000 patients. The survey used MongoDB, a user-friendly and once open source database management system. According to Oloyede, the survey was stored on a database which wasn’t properly secured.

More recently, the NITDA investigated the Nigerian Immigration Service - the country’s border police - over its disclosure on Twitter of personal details of a man who had supposedly damaged a consular office in London. “We are eagerly awaiting sanctions for this violation,’’ said Oloyede, suggesting that a central test for the new regulatory actors - in Nigeria as all over Africa - will be their capacity to scrutinize, and fine, powerful state agencies or private corporations.

But while extending legal provisions across the continent is a positive sign, warned Raymond Onuhoa, a researcher at the Lagos Business School, “we need to elaborate laws that fit the local context, without plainly replicating the provisions of other frameworks, such as the European GDPR”.

…And more and more biometric voting systems

2020 will be a crucial year for power dynamics in Africa. At least twenty countrieswill go to the polls, for both legislative and presidential elections. These include Sahelian countries affected by growing insecurity and population displacement, authoritarian regimes in Egypt, Togo and Burundi, and high-voltage political confrontations in Guinea and the Ivory Coast.

Citizens in the majority of these countries will express their preferences thanks to a biometric voter register and a card that stocks their facial images, fingerprints and iris scans. In most cases, the cards and the voting equipment are produced by Western companies that obtain lucrative contracts with African governments.

If the trend to adopt these costly systems seems irreversible, Ghana shows well some of the doubts and potential risks associated with them, ahead of its end-of-the-year electoral round.

Back in 2012, the West African state was the first in the region to adopt biometric voting cards. A system built by Dutch companies Genkey and HSB and integrated by local company Superlock Technologies, that was tested in general elections in 2012 and 2016. The European Union was among the main supporters of both electoral rounds, with an initial 7 million euros contribution in 2012, and further donations over the following years.

“The system has been updated, 40 million USD worth of new investments were done between 2016 and 2017, and now the Electoral Commission says it needs to be replaced,’’ explained a surprised Bright Simons.

Everything was duly prepared, according to Simons, who’s the vice-president of Ghanean think-tank Imani Center for Policy Education: a little-to-none publicized tender in spring 2019, whose winners were never proclaimed, followed by a series of public declarations emphasizing the inadequacy of the existing system and, finally, a public announcement to launch the creation of a New Biometric Voters Infrastructure, in December 2019.

18 civil society organizations, including Imani, protested the move, arguing that it’s a “sham to legitimise an already finalised procurement gig”. The new system, they detail, would cost at least 150 million USD to Ghanean taxpayers. The cost of elections in Ghana, per voter, would then be four times higher than in the United Kingdom, one of the world’s richest countries.

Opposition parties immediately created an ‘Inter-Party Resistance Against the New Voter Register’, launching a series of demonstrations in January.

Sold as antifraud solutions to guarantee transparency and peaceful transitions, electoral biometrics risk fueling tensions, while absorbing relevant shares of states budgets.

“Biometric voting registers are a perfect example of the vulnerability of Africans personal data: thousands of employees and many offices can access databases, cybersecurity is often weak and privacy breaches aren’t usually treated seriously by Data protection authorities,’’ added Simons.

But despite these controversies and a series of pending legal cases, these systems continue attracting new supporters.

On February 3, 2020, the Constitutional Court nullified the May 2019 general elections in Malawi, citing fraud in the manual transcription of votes. Voters had to register with a biometric ID card card launched in 2017 with the support of the EU, the UN and other international donors and built by Chinese company Laxton, one of the emerging providers of ID systems in Africa.

Sold as a solution for more inclusive and transparent elections, the biometric ID didn’t avoid the first nullification of elections in the history of Malawi.

Yet other countries and political actors knock on biometrics doors: the Republic of the Congo’s main opposition party has recently called for postponing 2021 elections to 2023, in order to establish a biometric voting register.

A race for identity

In July 2019, Anthony Okolie was arrested by a police squad during a normal working day at a fishing factory in the Delta region of Nigeria. For ten weeks, they held him in a cell at the security department. His crime? He had bought a SIM card whose previous owner was none other than Hanan Buhari, the daughter of the president of the Republic.

Months after, Okolie filed a lawsuit against Ms. Buhari, the Department of State Services and MTN, the South African telco company that had sold him the SIM.

Okolie’s case might be an extreme one, but it exposes one of the most recent obsessions of African governments: SIM card registration, a process that ramped up over the last years, starting from fingerprints to include facial recognition systems, with little safeguards on the collected data. A way forward to privacy breaches and increased surveillance.

There’s a simple reason why more and more African governments are forcing SIM card owners to give out their biometrics details, either through a registration done by the provider, either - as in most cases - by submitting a biometric identity document: through this move, they encourage (read ‘oblige’) people to enroll in new biometric ID schemes that would cost them time, and sometimes money, while feeding security agencies databases.

Tanzania went as far as ordering the cancelation of all unregistered sim cardswithin a two months period, finishing in January 2020. To avoid this, each sim card owner needed to present to his phone provider a biometric ID card and a National Identification Number. A race against the clock, considering that as of November 2019, environmental, economical and technical reasons were still preventing millions of Tanzanians from obtaining the ID card, launched in 2017.

The Tanzanian government said it recruited 150 social media influencers to convince the country’s youth to register. But it’s the rural communities, that have little-to-none access to social media, that risk being cut out of this process.

About seven million sim cards were deactivated as of mid-February 2020, according to data by the Tanzania Communications Regulatory Authority. While 50 countries in Africa have laws on SIM card registration, according to UK company Comparitech, Rwanda, Nigeria, Uganda, Tanzania and Mozambique adopted the most restrictive rules on biometric registrations in the continent, and Liberia might join the team soon.

Scenes around Karatu, Tanzania. Ph. Wikimedia Commons.

But it’s not only about SIM cards: gigantic plans to deliver ID cards are going on or being planned through the continent, under the auspices of international donors such as the World Bank, the International Monetary Fund, the European Union, Germany, France or China.

Ghaneans are queuing up to obtain the ‘Ghana card’ which, similarly to other programmes through the continent, is a public-private partnership between the government and different companies, including Margins from Ghana, Latvian X-Infotech and French, state-owned Imprimerie Nationale. These companies, argues Bright Simons, will likely profit from selling personal data collected during the process.

Similarly, Nigeria signed a public-private partnership with Euphoria Press, a local company known for being close to the presidency, to issue ID cards for migrants from the 15-countries Economic Commission of West Africa States (Ecowas). The initiative is connected to the EU-funded project Free movement of people in West Africa and to a series of ambitious - and problematic - programmes to enhance digital ID, including a maxi-fund by the European Investment Bank.

While Nigerians fight with unclear perspectives over a new ID scheme and about nine million Ghaneans obtained their new IDs as of February 2020, Kenyans are registering for what is popularly known as the ‘Huduma Namba’ (the service number, in Swahili). Immense, conflict-ridden Democratic Republic of Congo is set to be the next player in the game, as announced by president Fèlix Tshisekedi in 2019.

The idea of these schemes is to set up a unique, centralised source of information on people. One that would slowly replace existing sectoral databases - for workers, pensioners, medical patients, bank account owners and the like - and guarantee access to a series of public and private services.

Such systems are often costly, invasive and not necessarily secure.

The UN’s Sustainable Development Goal 16.9 calls for ‘By 2030, provide legal identity for all, including birth registration’. But this goal is often used to justify high-tech schemes - frequently funded through official development aid - that risk amplifying patterns of exclusion.

Kenyan researcher, Grace Bomu, points for example at the need to have birth certificates to apply for the Huduma Namba. “This automatically excluded communities that have never been issued with these documents due to historical reasons: such communities fear that digital ID, if implemented as the exclusive means of identity, would erase them from official existence,’’ she writes.

Furthermore, researcher Raymond Onuhoa says that these schemes expose people to breaches as they are not clearly defining and respecting “purpose limitations, data quality, transparency, third-party access and restrictions of cross-border transfers”.

One of the major risks for African’s personal data, he adds, is the “increasing adoption of cloud computing services across the region in both public and private domains: people data are stored in servers out of our countries, with doubts over the ownership of this data and their protection”.

Civil society vs aggressive capitalism

“All these programmes send a clear message”, denounces Ghanean advocate Bright Simons: “Africa’s going through a lightning-fast fintech revolution, where aggressive entrepreneurs push on governments to access people personal data, and safeguards are too weak”.

When it comes to European donors, including the EU, he suggests that their support for biometric solutions in Africa is largely driven by commercial interests.

European countries are lobbying for their companies, that are still dominating over the global market, even if giants as Gemalto and Idemia in France, Dermalog in Germany, or Genkey in The Netherlands have to compete with Chinese companies such as Laxton, the Japanese NEC or the South Korean Suprema.

These commercial interests often overshadow the EU’s stance as a global privacy leader. When coming to EU-funded programmes in Africa, warns Nigerian expert Ridwan Oloyede, “there’s a wide disparity between the level of transparency and accountability applied here, and EU standards”.

Migrants identified by IOM after being deported from Algeria. Ph. Francesco Bellina

One of the justifications for the EU’s spending on biometrics systems in Africa, from ID cards to databases at border posts, is a better management of migrations - read increased border controls at the Union’s borders and in third countries. Matching facial images, fingeprints and documents scan would also help to identify and repatriate undocumented migrants, a priority for the bloc’s foreign policy and for most European governments.

But according to Oloyede, “these programmes raise lots of questions: are the dignity and data of immigrants protected? Does the EU demand a Data Protection Impact Assessment from the governments as a condition for funding?”. While immense funding will be given to migration and border control in the bloc’s upcoming seven-year financial framework, and a new EU Strategy for Africa will be launched by the Commission in the next few months, such questions remain largely unanswered.

The overall picture is quite dark. But since we’d like to see readers out with a bright note… Here’s what some civil society groups are doing to bring biometrics systems into public discussion and hold governments accountable.

In Ghana, as we mentioned, 18 organisations denounced the excessive costs associated with rebuilding the biometric voting system for this year’s elections.

In Nigeria, Paradigm Initiative brought the National Identity Management Commission to court over its launch of the biometric ID scheme without data protection safeguards, forcing the government to speed the adoption of a data protection regulation in 2019.

In Kenya, the Nubians Rights Forum and other NGOs recurred to the High Court to contest the Huduma Namba, obtaining a landmark pronunciation that reduced its pervasiveness.

In The Ivory Coast, civil society coalition ‘Ça suffit’ (It’s enough) asked to review the cost of the new biometric ID card, which is a prerequisite for voting but is seen as too expensive for many citizens.

In early 2020, a report by Ugandan civil society group Unwanted Witness revelead that five years after its launch, the national biometric ID scheme fostered the exclusion of fragile people. “To open up a bank account, access a loan, get drugs from the hospital and participate fully in the economy, one must have a National ID and this has increased the poverty gap”.

And these are only some examples.

If Africa’s a battleground for technology giants, whose interests converge with those of local ruling elites, then “the battle for data protection and digital rights is the new fight for civil rights in the continent”, argues Bright Simons.

Will the EU stand on the side of inclusiveness and civil participation or rather continue asking regimes in Africa to enforce migration controls, while pushing them to buy expensive biometric systems?