RIA is working with 10 African partners evaluating the rollout of digital ID systems in their respective countries under the auspices of our BIO-ID project. Our country partners are summarising their findings in blogs, and in this installation, Dr Patricia Boshe of the of the African Law and Technology Institute argues that the digital ID framework in Tanzania poses a significant threat to personal privacy and the protection of personal data. To delve deeper into the issues highlighted in her blog, scroll down for an interview that RIA conducted with her.
In an age where technology is advancing at an accelerated pace, there is an undeniable need for people to be able to identify themselves securely, on and offline, and have equal and indiscriminate access to services. In fact, Article 6 of the Universal Declaration of Human Rights makes ‘legal identity’ a right of every person. It is on this basis that the Sustainable Development Goals (SDGs), specifically goal 16.9, emphasizes the need for states to “provide legal identity to all, including birth registration, by 2030”.
In 2014, the World Bank and others launched the Identification for Development (ID4D) initiative to help countries realize the transformational potential of digital identification systems to achieve SDG 16.9. In Africa, this initiative was adopted in the same year under the ‘Identity for All in Africa (ID4Africa)’ campaign; the mission being to help the region realize uniform universal legal identification for all people.
In Tanzania, the idea of providing legal identity to its citizens took root as far back as 1961 when Tanganyika got her independence. The first president of Tanzania, the late Mwl. Julius Kambarage Nyerere, emphasized the need to establish a national identity for the citizens of the new country. Unfortunately, due to financial and other capacity constraints, this ‘dream’ wasn’t realised even after parliament enacted the Registration and Identification of Persons Act in 1986. The law only came into force 25 years later after being published in the Government Gazette (Notice No.257A of 2011), made possible by the establishment of the National Identification Authority (NIDA) in 2008 by presidential mandate.
Registration of citizens began in 2013, with approximately 6.5 million residents from seven regions getting registered over two years. However, only 40% of registered residents received their national ID cards. In 2016, the first batch of national IDs were handed out. Unfortunately, the quality of the ID cards raised concerns, especially the illegible signatures, making most of the IDs unacceptable by several financial providers. As a result, the President fired the director-general of NIDA with a new acting director ordering a massive recall of over 2 million ID cards. The bottom line is that the overall rate of registrations and issuance of cards was slower than expected.
Regardless of these hiccups, Tanzania still envisions that the NIDA ID would eventually be used as exclusive IDs to identify citizens and to access civic services. Currently most, if not all, public institutions have moved to make the National ID or NINs as primary/mandatory requirement for identification for service provision, including institutions like the Higher Education Loans Board, the Tax Revenue Authority, Business Registration, Licensing Authority and the Government Recruitment Agency. This means, for example, that without the NIN students cannot get loans, one cannot apply for government employment, pay tax or register a business.
The same tide is seen in the private sector. It began with SIM card registration in 2009 and is now moving to financial institutions. In the case of SIM cards, one cannot register a SIM card unless the biometric information collected is verified against the NIDA database. Hence, the SIM card database is in effect linked to the NIDA database. If a SIM is not registered against the NIDA ID, it is deactivated. This has created a lot of havoc with people fearing being ‘locked out’ of their SIMs.
In Tanzania, having a locked SIM means more than just denied access to communications, it affects financial transactions. SIMs are not only connected to personal bank accounts, they are also ‘mini personal banks’. People save, send and receive money viatheir SIMs. It has become a convenient means used even by people with no conventional bank accounts.
I, for one, experienced SIM deactivation. Although I had the NIDA card, that was not sufficient to keep my SIM active. I was still required to physically report to the service provider to give my fingerprints for verification with the NIDA database. Since I was abroad at the time, my SIM was locked. I could no longer use my SIM to communicate or access my mobile money. Note that, at the time about 22 million people were registered by NIDA, from the initial targed of 25 million eligible population. That is 88% of the population eligible for the registration. Out of the registered population, only about 6.2 million were issued with their NIDA ID cards. That means, about 15.8 million people were registered but had no ID cards. As of March 2021, 18.7 million (74% of eligible population) had received their NIN to support their SIM registration, 6.5 million (26% of eligible population) had neither the NIDA card nor NIN to support SIM registration.
Lack of legal identity could hinder individual access to basic social services but improperly regulated ID systems could have far more negative effects on individuals. If such systems fail to address pertinent technological and social aspects, it may lead to the exclusion of certain population groups. Since the ultimate objective of ID systems is to give people legal identity to allow them access to civic services and exercise individual rights, governments are expected to uphold and protect those rights. More so, when a country such as Tanzania declares that the National ID is to become the only official ID document, as reported by the East African newspaper in 2015.
Making NIDA IDs exclusive may not be a problem if the administrative and regulatory framework is sufficient to ensure no one is excluded from accessing civic services and that ID pertaining rights are protected. These rights can be summarized in four key Ps: Privacy, people can control their identity and what data is shared and with whom; Portability, people can access and confirm their identity anywhere they are through multiple methods; Persistence, the identification lives with the person from life to death and, Personal, the identification is unique to one single person.
So far, the digital ID framework in Tanzania poses a significant threat to personal privacy and the protection of personal data (there is no data protection or regulatory oversight) and potentially abets social exclusion.
Poor and marginalised people make up the largest percentage of people without official identity. Due to existing digital and structural inequalities these groups are at risk of further discrimination and socio-economic exclusion depending on how Digital ID systems are developed. If not carefully evaluated, the digitalisation of ID systems may also subject citizens to state surveillance. As a result, there is a growing and urgent need to examine the impact of Digital ID systems on human rights in Africa and use these findings to develop evaluation frameworks that ensure compliance with international rights and data protection norms. To support this need Research ICT Africa’s BIO–ID project deploys a legal Evaluation Framework for Digital Identities developed by the Centre for Internet and Society (CIS). This framework was previously used to evaluate the Indian government’s mandatory biometric ID project that was found to have violated citizens’ human rights by denying them access to essential services and benefits. The African evaluation project brings together partners from 10 African countries, including Ghana, Kenya, Lesotho, Mozambique, Nigeria, Rwanda, South Africa, Uganda, Tanzania and Zimbabwe.
In addition to the blogs being produced by our country partners to introduce you to the issues that they’re uncovering in this important new research area, RIA’s Kristophina Shilongo is interviewing partners to delve deeper into the socio-economic challenges ushered in by the rollout of digital ID systems in Africa. Read her interview with Dr Patricia Boshe of Tanzania below.
Tanzania’s NIDA ID system needs comprehensive data protection regulation
In the third of the series of interviews with our partners participating in RIA’s BIO-ID project, Kristophina Shilongo interviews Dr Patricia Boshe of the of the African Law and Technology Institute. Boshe is concerned about the misuse of personal information by government agencies due to a lack of data protection law and authority.
KS: We’ve seen a lot of interest in digital ID on the continent from a diversity of donor agencies, financial institutions, and governments. Why do you think this is the case?
PB: Most donor agencies, like the World bank, have internal commitments to helping governments achieve development through provision of universal identification. They are working on digital IDs as predictors for development as they (donor agencies) have mission statements to bring about development in developing countries. Digital IDs improve access to other indicators of development such as access to financial services, access to healthcare services etc.
With respect to financial Institutions, having universal digital IDs helps them expand their service coverage in ways they couldn’t before. In Tanzania, the second biggest bank recently launched the first online bank opening service. The first of its kind in Tanzania. This is because the central bank was strict on information gathering for banks before. Now with universal digital IDs, anyone can open a bank account wherever they are in Tanzania. All they need is their ID number and access to a smartphone.
Finally, concerning government, Digital IDs can help the Tanzanian government realize its long-term goals of universal identification as well as the ruling party’s promise of identification documents. Another motivation is the access to personal identification information for its citizens. This helps government agencies not only in service provision, but also in crime prevention. Another less spoken of aspect in the Tanzanian context is revenue generation. Public and private institutions that access the information stored by the national ID database, have to pay an access fee that has seen the government receive revenues as high as 200$ million on an annual basis.
KS: If policymakers in Tanzania can take away one lesson from your case study, what do you hope it will be?
PB: There is a need for Transparency. Policy makers need to improve transparency on how collected information is stored, how a person can access their information to correct and update it and how third parties are accessing the information stored by the national database.
There is also a need for a clear framework. The Identification and Registration Act does not provide for a clear framework on how the system operates and what are rights and duties of third parties accessing (wish to access) information from the database. These are probably provided in individual ‘access accounts’, which are not public. But it would be better if access, usage rights and duties are clearly regulated by the law. Citizens need to know what obligations third parties have so that they can be able to hold them accountable.
Finally, with personal and private information of over 20 million Tanzanians being stored in a national database and being accessible to third party institutions, it is crucial to have a comprehensive data protection and privacy law, and supervisory authority. This will help increase not only safety and security around personal information from potential mishandling or misuse but also accountability on data controllers and processors.
KS: What research still needs to be done to support the future development of digital IDs that support, not hinder, socio-digital equality on the continent?
PB: Usability studies are important. It is important to conduct a nationwide, multi stakeholder study, on the effects that the introduction of digital IDs has had in the country. From the community level to institutional levels, identify the positives and negatives, the challenges and opportunities that have been brought since the introduction of the National ID program. This will help policymakers to fine tune the overall system.
KS: What are your biggest hopes for the future of digital ID’s in Tanzania?
PB: My biggest hope is seeing universal level coverage of national IDs. Seeing national ID information synced with other key information agencies, such as the birth and death registry authority, to ease and speed up access to service by citizens. The syncing process has already begun.
I would also like to see improvement in the ID application process and shorter timeframes for receiving Digital IDs.
KS: What are your biggest fears for the future of digital ID’s in Tanzania?
PB: Things to highlight here would be the misuse of personal information by government agencies due to a lack of data protection law and authority and/or redress mechanism. Using data to monitor and surveil citizens – without a legal basis. Finally, once the ID is made exclusive, my fear is that those without ID will be excluded from accessing social / basic services.