Malawi’s digitization project poses risks without data protection laws

Malawi is fully committed to driving its digital transformation, including the construction of a national data centre in partnership with Chinese company Huawei, the introduction of a biometric national ID system and a biometric SIM card identification system. It is therefore advisable for the country’s government to put in place mechanisms that provide sufficient and comprehensive data protection guarantees.

This is the warning from the Association for Progressive Communications (APCA) in a report that is part of a recently updated series of articles on digital rights in southern Africa. The APC is a network of dozens of civil society organizations from at least 70 countries that promote the responsible use of the Internet and digital technologies.

The report notes that while Malawi is implementing these digital transformation programs, it has not taken targeted action to enact comprehensive data protection legislation to increase citizens’ trust in digital projects that collect large amounts of personal data, such as the country’s biometric national identity system, which was introduced at breakneck speed, and the mandatory registration of biometric SIM cards, which has been in place since 2018.

The APC stresses that while investments in digital systems are a good thing for the country, “such investments require simultaneous commitments to robust data security, including the introduction of comprehensive data protection laws, something that is currently lacking in Malawi’s government.”

It is noted that such a data security architecture is important for Malawi in general, especially in light of the controversies and allegations of state surveillance that have led to Huawei-led digitization projects in some African countries.

In particular, the report calls on the Malawian government to enact laws that give meaning to Section 21 of the country’s constitution, which emphasises the right of citizens to protection of personal data. This, it says, the government should do by taking steps to pass the Data Protection and Privacy Act, which has been in existence since 2021.

As part of its publications on defending digital rights, the APC has made similar recommendations to other countries in the Southern African region, such as Botswana, where it urged the government to strengthen its data protection arsenal, and Eswatini, where it advised that sufficient attention be paid to data protection and privacy when introducing a national digital ID system.

The Malawi Electoral Commission recently reiterated its plan to make national identity cards the mandatory proof of identity for biometric voter registration, which is scheduled to begin next month.

Article topics

Africa | Biometrics | Data protection | Digital identity | Huawei | Legislation | Malawi | Identity card | SIM card registration