In our digital world, data and identity are increasingly intertwined. As the world responds to data-related scandals with new business models, checks, and balances, what is the appropriate governance for digital identity?
Regulation can play a powerful role in ensuring everyone can fully and fearlessly engage in digital society. Good policy decisions can not only empower individuals but also protect their right to privacy.
In this series, we talk to industry leaders about the policies, technology and practices which affect digital identity systems on the road to Good ID.
We talk to Teki Akuetteh Falconer, Founder and Executive Director of Africa Digital Rights’ Hub, about data protection and how she’s pushing forward the policy debate for digital identity in 2019.
Hello, Teki, welcome to #GoodID. Looking at the year ahead, are there any digital ID events you’re particularly looking forward to?
Hello! Thank you for having me.
Yes, I am particularly looking forward to ID4Africa which will be held in June 2019 in Johannesburg, South Africa. It is one of the largest multi- stakeholder platforms on the continent of Africa that addresses the issues of digital IDs. I am excited about this 2019 event because it proposes to explore the issues of data protection and privacy and how they affect digital IDs in Africa.
We haven’t had this opportunity in the past, where we get all key stakeholders around digital ID issues at the same table.
Do you see any trends this year in citizen-led, digital identity systems? What is the direction of travel from your perspective?
At the Africa Digital Rights’ Hub, we are interested in the development of digital IDs that guarantee and protect the privacy/data protection of the individual.
While we are not aware of any specific citizen-led trends in 2019, our objective is to create awareness on the importance of data protection/privacy for digital IDs; and develop a code of practice that can facilitate implementation of privacy and data protection standards in the development and use of digital IDs. Our aim is to re-focus the respect for the individual as central to the objective of digital IDs.
Because after all, most of our conversation on the creation of digital IDs focus on the benefit to individuals. If these systems are for the benefit of people, we must ensure that their information is collected and used in manner that protects them.
With the recent India Supreme Court’s decision on the Aadhaar Project, it is becoming increasingly clear that when governments pursue the establishment of national/citizens’ ID projects, not every legislated use of such IDs guarantee the fundamental right to privacy which is critical to protecting citizens.
The need to therefore have the right framework for collecting, using and sharing personal information is important to any digital ID platform.
If for instance, personal information needs to be collected or used for other reasons - such as surveillance, sharing with third party organisations, etc - it must be done lawfully in recognition of one’s inherent right to privacy.
For us, it is important to create the right framework and parameters to ensure that information is accurately collected and stored, reliable, adequately protected, transparent and properly shared with the right stakeholders.
At Africa Digital Rights’ Hub, we are calling on all stakeholders to not look at the development and use of digital IDs outside of the fundamental right to privacy but rather to see both as synonymous.
A robust digital ID environment operates on key principles of data protection such as legitimate use, accuracy, minimality, adequate security safeguards, transparency and data subject participation. Such a robust system improves data quality and reliability, which are key to its use and service delivery.
Ultimately, if you cannot authenticate the quality of the information you are collecting, then the information is not good enough to serve your purpose.
So there’s a broader benefit to everybody in making these good frameworks and systems?
Definitely. Having a good digital ID not only benefits the individual who is the subject-matter of the ID, but all stakeholders.
Do you identify what you’re describing as ‘Good ID’?
For me, Good ID is not just about data protection/privacy, (although you cannot have a Good ID without respecting the right to privacy) but one that is reliable, available, cost-efficient, complete and relevant.
What else is happening on the African continent in relation to digital identity?
Apart from ID4Africa and our project on the code of practice, the African Union Commission (AUC) and the Economic Commission for Africa (ECA) recently launched a partnership for digital ID. Among the issues raised at launch was the establishment of a Centre of Excellence for Digital ID to work with the AUC, Regional Economic Communities and member countries to champion the Digital ID Initiative. This is a very laudable initiative and we are looking forward to its implementation.
So that synergy between government, activists and technologists is essential?
Yes. The synergy of all stakeholders is extremely important for the successful implementation of good digital IDs. It helps bring challenging issues to the fore before they escalate to the point where it becomes impossible or costly to resolve.
The approach of waiting for an issue to crop up before bringing stakeholders to the table is changing, especially with Aadhaar. Aadhaar is not just affecting India, but is making all stakeholders - governments, policy makers, implementers, technology solution providers, regulators, individuals, etc - ask the questions that we should have asked a long time ago. And the good thing is that is not too late to start addressing the challenges now.
So you’re fairly optimistic that people are going to start working together to develop positive practice and positive policy?
Yes, this will not happen overnight but I believe the right conversations have started.
What are you planning for 2019?
This year we will launch our Data Protection Code of Practice for Digital ID and Addressing in Africa. The Code will put out guidelines that can be implemented to address data protection/ privacy concerns. We will also be engaging with stakeholders in the digital ID space to evaluate as well promote the code of practice and its use.
What would you say are the key barriers to achieving the better frameworks that we need for the ethical forms of digital identity? Do you have any solutions for overcoming those barriers?
I think a lot of the time we rush in taking decisions on the development of digital ID systems, without appreciating the full implication of what we are doing.
For instance when it comes to national IDs, the decision to have a national ID for developing countries maybe a good one, what we fail to do however, is properly think through its implementation - policy rationale, strategy, technology and the approach.
We also tend to look at digital IDs as a technological solution, rather than a comprehensive solution which involves laws, people, technology and processes.
In order to build better frameworks; we must ask ourselves the following:
- Whose information am I going to collect?
- What will it be used for?
- How do I protect them?
- Do they have any rights under any law?
- How do I make sure that what am doing complies with whatever laws exist?
- Is my processing of personal data also fair in situations where I do not have any law regulating by behaviour?
- How open am I about what am using their information for?
- How do I engage the individuals whose information I collect?
The key barriers are not fully addressing the need to respect the fundamental right of individuals to their privacy.
So you think that could get addressed in 2019/2020 ?
With everything that is happening around the world today, I believe 2019/2020 will see significant steps being taken towards good frameworks for digital IDs, especially in Africa.
The issues of privacy and data protection are still fairly new to Africa. Everywhere we have had opportunity to discuss them, people do not initially appreciate the issues. But then there is always that lightbulb moment which illuminates the concerns individuals have.
These moments always change perspectives on data protection and privacy. But will only grow with time by continuous awareness, promotion and recognition of practices that can help create the change we expect to see.