There is another privacy concern arising from digital IDs verifiers, such as banks and other organisations that use KYC. Even if data isn’t sent back to the issuer of the ID (the African country the holder hails from), each time someone uses their ID, verifiers have the potential to record and compile information about these interactions. For instance, a group of banks could maintain an electronic log of every instance you use your ID. While they may not observe when you present your digital ID to others, they could track each time you share it with them, their corporate affiliates, or anyone with whom they have a data-sharing arrangement. In the process, these entities can gather a lot of personal information about the ID holder. The digitisation of IDs could make this process more automatic than it is now.

Computer security challenges are harder to fix in the current world. Experts have said that attacking digital systems is often easier than defending them, as seen with leading tech companies and government agencies falling victim to hackers. While this shouldn’t discourage digitisation, it’s key to consider the consequences of successful cyberattacks, including their severity and who bears the burden. Companies sometimes neglect to protect their digital assets, leading to catastrophic customer outcomes. It would be worse if such attacks targeted digital ID systems, especially when African governments have yet to develop robust and formidable digital infrastructure.

Lastly, privacy concerns arise when digital IDs require users to install government-related software on their phones, even if private contractors create these apps. To instil confidence, the source code of these apps should be transparent for public scrutiny, which will ensure they function correctly and securely. However, many private companies (Kenya’s digital ID system may be built by Estonian tech companies) may want to keep their code proprietary, which could lead to users trusting secret government code on their phones, especially if digital IDs are mandatory, which is unacceptable.

Granted, a digital ID could enhance privacy by allowing users to selectively share only the necessary information from their identification, such as confirming their age without disclosing their full date of birth or other details. However, knowing what kind of data will be stored in the IDs is a challenge. In a Kenyan context, digital ID items might include health insurance, pension, employment, passport, birth and marriage certificates, among other documents. If data categories expand, it’s unclear whether privacy measures will be implemented immediately and according to new data sets.

Policymakers in African countries considering digital IDs should remember that the documents are important for KYC, fraud reduction and detection, and financial inclusion. Therefore, they should assess the impact of optional or mandatory adoption and consider the ID’s long-term evolution. It is up to them to ensure that strong privacy safeguards are in place since success depends on robust implementation to boost privacy and empower individuals.

Article continues after this ad

Kenn Abuya,

Senior Reporter, TechCabal.

Feel free to email kenn[at]bigcabal.com, with your thoughts about this edition of NextWave. Or just click reply to share your thoughts and feedback.