2020 is a crucial year to fight for data protection in Africa

…And more and more biometric voting systems

2020 will be a crucial year for power dynamics in Africa. At least twenty countrieswill go to the polls, for both legislative and presidential elections. These include Sahelian countries affected by growing insecurity and population displacement, authoritarian regimes in Egypt, Togo and Burundi, and high-voltage political confrontations in Guinea and the Ivory Coast.

Citizens in the majority of these countries will express their preferences thanks to a biometric voter register and a card that stocks their facial images, fingerprints and iris scans. In most cases, the cards and the voting equipment are produced by Western companies that obtain lucrative contracts with African governments.

If the trend to adopt these costly systems seems irreversible, Ghana shows well some of the doubts and potential risks associated with them, ahead of its end-of-the-year electoral round.

Back in 2012, the West African state was the first in the region to adopt biometric voting cards. A system built by Dutch companies Genkey and HSB and integrated by local company Superlock Technologies, that was tested in general elections in 2012 and 2016. The European Union was among the main supporters of both electoral rounds, with an initial 7 million euros contribution in 2012, and further donations over the following years.

“The system has been updated, 40 million USD worth of new investments were done between 2016 and 2017, and now the Electoral Commission says it needs to be replaced,’’ explained a surprised Bright Simons.

Everything was duly prepared, according to Simons, who’s the vice-president of Ghanean think-tank Imani Center for Policy Education: a little-to-none publicized tender in spring 2019, whose winners were never proclaimed, followed by a series of public declarations emphasizing the inadequacy of the existing system and, finally, a public announcement to launch the creation of a New Biometric Voters Infrastructure, in December 2019.

18 civil society organizations, including Imani, protested the move, arguing that it’s a “sham to legitimise an already finalised procurement gig”. The new system, they detail, would cost at least 150 million USD to Ghanean taxpayers. The cost of elections in Ghana, per voter, would then be four times higher than in the United Kingdom, one of the world’s richest countries.

Opposition parties immediately created an ‘Inter-Party Resistance Against the New Voter Register’, launching a series of demonstrations in January.

Sold as antifraud solutions to guarantee transparency and peaceful transitions, electoral biometrics risk fueling tensions, while absorbing relevant shares of states budgets.

“Biometric voting registers are a perfect example of the vulnerability of Africans personal data: thousands of employees and many offices can access databases, cybersecurity is often weak and privacy breaches aren’t usually treated seriously by Data protection authorities,’’ added Simons.

But despite these controversies and a series of pending legal cases, these systems continue attracting new supporters.

On February 3, 2020, the Constitutional Court nullified the May 2019 general elections in Malawi, citing fraud in the manual transcription of votes. Voters had to register with a biometric ID card card launched in 2017 with the support of the EU, the UN and other international donors and built by Chinese company Laxton, one of the emerging providers of ID systems in Africa.

Sold as a solution for more inclusive and transparent elections, the biometric ID didn’t avoid the first nullification of elections in the history of Malawi.

Yet other countries and political actors knock on biometrics doors: the Republic of the Congo’s main opposition party has recently called for postponing 2021 elections to 2023, in order to establish a biometric voting register.

A race for identity

In July 2019, Anthony Okolie was arrested by a police squad during a normal working day at a fishing factory in the Delta region of Nigeria. For ten weeks, they held him in a cell at the security department. His crime? He had bought a SIM card whose previous owner was none other than Hanan Buhari, the daughter of the president of the Republic.

Months after, Okolie filed a lawsuit against Ms. Buhari, the Department of State Services and MTN, the South African telco company that had sold him the SIM.

Okolie’s case might be an extreme one, but it exposes one of the most recent obsessions of African governments: SIM card registration, a process that ramped up over the last years, starting from fingerprints to include facial recognition systems, with little safeguards on the collected data. A way forward to privacy breaches and increased surveillance.

There’s a simple reason why more and more African governments are forcing SIM card owners to give out their biometrics details, either through a registration done by the provider, either - as in most cases - by submitting a biometric identity document: through this move, they encourage (read ‘oblige’) people to enroll in new biometric ID schemes that would cost them time, and sometimes money, while feeding security agencies databases.

Tanzania went as far as ordering the cancelation of all unregistered sim cardswithin a two months period, finishing in January 2020. To avoid this, each sim card owner needed to present to his phone provider a biometric ID card and a National Identification Number. A race against the clock, considering that as of November 2019, environmental, economical and technical reasons were still preventing millions of Tanzanians from obtaining the ID card, launched in 2017.

The Tanzanian government said it recruited 150 social media influencers to convince the country’s youth to register. But it’s the rural communities, that have little-to-none access to social media, that risk being cut out of this process.

About seven million sim cards were deactivated as of mid-February 2020, according to data by the Tanzania Communications Regulatory Authority. While 50 countries in Africa have laws on SIM card registration, according to UK company Comparitech, Rwanda, Nigeria, Uganda, Tanzania and Mozambique adopted the most restrictive rules on biometric registrations in the continent, and Liberia might join the team soon.

But it’s not only about SIM cards: gigantic plans to deliver ID cards are going on or being planned through the continent, under the auspices of international donors such as the World Bank, the International Monetary Fund, the European Union, Germany, France or China.

Ghaneans are queuing up to obtain the ‘Ghana card’ which, similarly to other programmes through the continent, is a public-private partnership between the government and different companies, including Margins from Ghana, Latvian X-Infotech and French, state-owned Imprimerie Nationale. These companies, argues Bright Simons, will likely profit from selling personal data collected during the process.

Similarly, Nigeria signed a public-private partnership with Euphoria Press, a local company known for being close to the presidency, to issue ID cards for migrants from the 15-countries Economic Commission of West Africa States (Ecowas). The initiative is connected to the EU-funded project Free movement of people in West Africa and to a series of ambitious - and problematic - programmes to enhance digital ID, including a maxi-fund by the European Investment Bank.

While Nigerians fight with unclear perspectives over a new ID scheme and about nine million Ghaneans obtained their new IDs as of February 2020, Kenyans are registering for what is popularly known as the ‘Huduma Namba’ (the service number, in Swahili). Immense, conflict-ridden Democratic Republic of Congo is set to be the next player in the game, as announced by president Fèlix Tshisekedi in 2019.

The idea of these schemes is to set up a unique, centralised source of information on people. One that would slowly replace existing sectoral databases - for workers, pensioners, medical patients, bank account owners and the like - and guarantee access to a series of public and private services.

Such systems are often costly, invasive and not necessarily secure.

The UN’s Sustainable Development Goal 16.9 calls for ‘By 2030, provide legal identity for all, including birth registration’. But this goal is often used to justify high-tech schemes - frequently funded through official development aid - that risk amplifying patterns of exclusion.

Kenyan researcher, Grace Bomu, points for example at the need to have birth certificates to apply for the Huduma Namba. “This automatically excluded communities that have never been issued with these documents due to historical reasons: such communities fear that digital ID, if implemented as the exclusive means of identity, would erase them from official existence,’’ she writes.

Furthermore, researcher Raymond Onuhoa says that these schemes expose people to breaches as they are not clearly defining and respecting “purpose limitations, data quality, transparency, third-party access and restrictions of cross-border transfers”.

One of the major risks for African’s personal data, he adds, is the “increasing adoption of cloud computing services across the region in both public and private domains: people data are stored in servers out of our countries, with doubts over the ownership of this data and their protection”.

Civil society vs aggressive capitalism

“All these programmes send a clear message”, denounces Ghanean advocate Bright Simons: “Africa’s going through a lightning-fast fintech revolution, where aggressive entrepreneurs push on governments to access people personal data, and safeguards are too weak”.

When it comes to European donors, including the EU, he suggests that their support for biometric solutions in Africa is largely driven by commercial interests.

European countries are lobbying for their companies, that are still dominating over the global market, even if giants as Gemalto and Idemia in France, Dermalog in Germany, or Genkey in The Netherlands have to compete with Chinese companies such as Laxton, the Japanese NEC or the South Korean Suprema.

These commercial interests often overshadow the EU’s stance as a global privacy leader. When coming to EU-funded programmes in Africa, warns Nigerian expert Ridwan Oloyede, “there’s a wide disparity between the level of transparency and accountability applied here, and EU standards”.

One of the justifications for the EU’s spending on biometrics systems in Africa, from ID cards to databases at border posts, is a better management of migrations - read increased border controls at the Union’s borders and in third countries. Matching facial images, fingeprints and documents scan would also help to identify and repatriate undocumented migrants, a priority for the bloc’s foreign policy and for most European governments.

But according to Oloyede, “these programmes raise lots of questions: are the dignity and data of immigrants protected? Does the EU demand a Data Protection Impact Assessment from the governments as a condition for funding?”. While immense funding will be given to migration and border control in the bloc’s upcoming seven-year financial framework, and a new EU Strategy for Africa will be launched by the Commission in the next few months, such questions remain largely unanswered.

The overall picture is quite dark. But since we’d like to see readers out with a bright note… Here’s what some civil society groups are doing to bring biometrics systems into public discussion and hold governments accountable.

In Ghana, as we mentioned, 18 organisations denounced the excessive costs associated with rebuilding the biometric voting system for this year’s elections.

In Nigeria, Paradigm Initiative brought the National Identity Management Commission to court over its launch of the biometric ID scheme without data protection safeguards, forcing the government to speed the adoption of a data protection regulation in 2019.

In Kenya, the Nubians Rights Forum and other NGOs recurred to the High Court to contest the Huduma Namba, obtaining a landmark pronunciation that reduced its pervasiveness.

In The Ivory Coast, civil society coalition ‘Ça suffit’ (It’s enough) asked to review the cost of the new biometric ID card, which is a prerequisite for voting but is seen as too expensive for many citizens.

In early 2020, a report by Ugandan civil society group Unwanted Witness revelead that five years after its launch, the national biometric ID scheme fostered the exclusion of fragile people. “To open up a bank account, access a loan, get drugs from the hospital and participate fully in the economy, one must have a National ID and this has increased the poverty gap”.

And these are only some examples.

If Africa’s a battleground for technology giants, whose interests converge with those of local ruling elites, then “the battle for data protection and digital rights is the new fight for civil rights in the continent”, argues Bright Simons.

Will the EU stand on the side of inclusiveness and civil participation or rather continue asking regimes in Africa to enforce migration controls, while pushing them to buy expensive biometric systems?