Imagine walking for two hours to reach a government service centre, only to be told by a machine that you do not exist. Your finger is pressed against a scanner. Once. Twice. Ten times. The screen stares back blankly. You are turned away — not because you are ineligible, but because the system was never built to recognise you.
This scenario, frustrating in the abstract, becomes life-altering when the service in question is a hospital admission, a social protection grant, or the registration of a vote. Across Africa, it is not a hypothetical. It is a recurring reality embedded in the very systems governments are deploying to modernise public service delivery.
Digital Public Infrastructure — the foundational systems that connect citizens to identity, payments, and data exchange — carries an extraordinary promise. Done right, it can slash bureaucratic friction, extend financial inclusion, and bring government services to communities that have historically been left behind. Done wrong, it can deepen the exclusions it was meant to solve, with the added injury that the exclusions are now automated, scalable, and difficult to challenge.
The technical explanation is well understood in engineering circles, though rarely communicated to policymakers with sufficient urgency. Biometric recognition systems — fingerprint scanners, facial recognition tools — are powered by machine learning algorithms trained on historical datasets. The critical variable is whose data was used in training. When training datasets skew toward specific demographics, the model learns to perform accurately for those groups and poorly for others. Darker skin tones, callused hands from years of manual labour, age-related changes to skin texture — these are not system anomalies. They are predictable failure points for systems trained without diverse, representative data. And the communities most likely to be misidentified are, with grim consistency, those already most marginalised.
This is not a merely technical problem. It is a constitutional one.
African states carry binding legal obligations to protect the rights of their citizens. The African Charter on Human and Peoples’ Rights, together with international instruments such as the International Covenant on Civil and Political Rights, protect privacy, freedom of expression, and political participation. When a digital identity system denies an elderly person access to a social protection grant, it does not operate in a legal vacuum. It operates in direct tension with those obligations.
Yet the enforcement architecture remains fragile. Forty-four of Africa’s 54 countries now have national data protection laws — a genuine achievement. But only 15 have ratified the African Union’s Malabo Convention, the continental framework for data protection and cybersecurity. Data protection authorities, where they exist, are frequently under-resourced and structurally limited in their independence. The legal framework is taking shape; the implementation gap is where rights go to die.
The case record is sobering. In Kenya, a landmark constitutional challenge forced the government to establish a data protection framework before proceeding with a national biometric identity programme. In Uganda, civil society organisations challenged the exclusion of elderly citizens without national IDs from a social assistance scheme — only for the court to rule the exclusions were isolated rather than systemic, leaving millions of vulnerable people locked out. These are not isolated incidents. They form a pattern of systems built without adequate consultation, deployed without adequate safeguards, and scrutinised only after the damage is done.
The lesson is not that digital infrastructure is inherently harmful. It is that infrastructure designed without representative voices in the room will represent some citizens faithfully and fail others consistently. Civil society organisations, legal advocates, and affected communities must engage with DPI from the earliest stages of architecture — not after systems go live and legal battles become the only remaining recourse.
Governments and vendors must be held to a higher standard before deployment: human rights impact assessments, privacy-by-design principles embedded in procurement contracts, and meaningful public consultation during legislative drafting. Regional mechanisms, including the African Commission on Human and Peoples’ Rights, offer platforms for binding normative standards that can raise the floor across the continent.
The fingerprint scanner does not know it is excluding anyone. But the humans who design, procure, and deploy these systems always have a choice.
