Pule, N. (2021). Digital Identity in Lesotho: Case study conducted as part of a ten-country exploration of socio-digital ID systems in parts of <\/i>Africa<\/i> (Towards the Evaluation of Digital ID Ecosystems in Africa: Findings from Ten Countries) [Case study]. Research ICT Africa (RIA).<\/p>\n
Abstract<\/strong><\/p>\n In 2011, the government of Lesotho passed the National Identity Cards <\/span>Act 2011, which paved the way for establishing a national digital identity <\/span>register and issuing national identity cards (ID cards). In 2013, the register, <\/span>managed by the Department of National Identity and Civil Registry in <\/span>the Ministry of Home Affairs, was established based on this law. The Act <\/span>requires that all eligible persons use the national ID card issued in terms <\/span>of this law to \u201caccess all services\u201d. It is not clear if and how the mandated <\/span>use of the government\u2019s digital ID, to the exclusion of other means of <\/span>identification, has affected citizens. <\/span><\/p>\n This research explores the governance of the digital ID system established <\/span>under the National Identity Cards Act 2011. It does so by applying the <\/span>Centre for Internet and Society\u2019s \u201cGoverning ID: Principles for Evaluation\u201d <\/span>framework. In general terms, the framework applies three categories of <\/span>tests: a) rule of law tests, b) rights-based tests and c) risk-based tests. <\/span><\/p>\n Findings suggest that, to a limited extent, digital ID governance in Lesotho <\/span>passes some of the rule of law tests, in that it is backed by an act of <\/span>parliament, even though within the Act itself there are clauses that do <\/span>not pass the quality of law test; there is also a wide scope of discretion <\/span>given to the minister. On the rights-based tests, Lesotho does not pass the <\/span>test because the Act allows for the collection of personal data, including <\/span>biometrics, and sharing of the same by several actors, while safeguards <\/span>against abuse and cybersecurity threats are insufficient. On risk-based <\/span>tests, the governance system in Lesotho fails a number of tests. The most <\/span>concerning are risks of privacy harms, exclusion harms, mission creep and <\/span>indiscriminate data sharing. The report ends with recommendations on <\/span>how the government of Lesotho and other stakeholders may improve the <\/span>digital ID implementation and governance in the country to minimise the <\/span>identified risks while maximising the potential benefits of digital ID.<\/span><\/p>\n