Financial Crime World

Lesotho Digital ID System Under Scrutiny

A Concerning Integration

A digital identity system launched in Lesotho five years ago has raised concerns about personal data privacy risks. The system, introduced by the National Identity Register (NICR), relies on a central database that connects various government systems and third-party entities.

  • The NICR database is linked to several government agencies, including:
    • Birth and Death Registration System
    • Marriage and Divorce Registration System
    • ID Card System
    • ePassport System
    • eBorder Control System
    • Enquiries, Reports, Administration Management System
    • Stock Control System
  • Critics argue that this integration has made it impossible to assess the extent to which these instruments minimize personal data privacy risks.

A History of Challenges

The digital ID system was launched in 2013, and since then, Lesotho has struggled to digitize its economy. According to a recent report, the country ranked 118 out of 152 countries on the UN Conference on Trade and Development’s Business-to-Consumer Index 2020, indicating low digital economy readiness.

The ID Cards

The ID cards issued by the NICR do not have chips but instead feature two-dimensional barcodes that contain vital information, fingerprints, and photos. The system uses an application programming interface (API) to enable remote access to third parties, including:

  • Credit bureaus
  • Banks
  • Mobile network companies

Concerns Surrounding Personal Data Privacy Risks

Despite the concerns surrounding personal data privacy risks, the ID cards have been issued to citizens, with over 100,000 IDs already distributed. However, experts argue that the lack of widespread digitization in Lesotho has hindered the effective use of digital ID in daily life.

Recommendations for Improvement

A recent analysis of the National Identity Cards Act (NICA) using CIS’ Evaluation Framework identified several areas for improvement, including:

  • Improving the legal framework to support data sharing and ensure data minimization
  • Ensuring greater transparency and accountability in the handling of personal data

A Call to Action

The Lesotho government has been urged to address these concerns and implement measures to protect citizens’ personal data while also promoting digital economy development.