Contributor: Katelyn Cioffi
Organization: Center for Human Rights & Global Justice, NYU School of Law
Last update:
Chapeau
The Registration of Persons Act, 2015 (ROPA) forms the legal basis for the Ugandan national digital ID system. This legislation was passed the year after mass registration for the national ID began in 2014, initially without a legal basis and with little public participation or acknowledgement of human rights risks. ROPA establishes the national ID as the primary means of identification in the country, making registration compulsory for all citizens and alien residents in Uganda, and enumerating many areas of public and private life where the national digital ID will be a mandatory requirement. Although both ROPA and the Data Protection and Privacy Act, 2019 provide some legal and administrative avenues to raise complaints and concerns about the national ID, these mechanisms have yet to yield tangible remedies for those affected by the national digital ID system.
1.1. Which are the specific laws creating and regulating Digital ID and what is their hierarchy (constitutional, organic laws, regional/sub-state laws, regulations, procedures)?
- The Ugandan Parliament passed the Registration of Persons Act in 2015 (ROPA).[1] ROPA and its subsequent regulations (fees,[2] access and use of information,[3] births and deaths[4]) form the legal basis for the national digital ID system.
- ROPA created a new government entity, the National Identification and Registration Authority (NIRA), governed by a Board composed mainly of government ministers, and including two representatives of the public and the Executive Director of NIRA as a non-voting member.
[1] Registration of Persons Act, 2015, https://www.parliament.go.ug/cmis/views/059330e5-12e4-4ca1-a08f-6b81fbfb4b60%253B1.0.
[2] https://www.nira.go.ug/media/2021/05/Statutory-Instruments-2015.pdf
[3] https://www.nira.go.ug/media/2022/08/Access-and-Use-of-Information.pdf
[4] https://www.nira.go.ug/media/2022/08/Births-and-Deaths-Reg-20158.pdf
1.2. What is the definition of Digital Identity brought by the Law or regulation, if any?
There is no definition of digital identity in the law, although the ROPA does define “identity data”[1] and “identity document,” and subsequent regulations have provided definitions for “biometrics.”[2]
[1] Section 3, Registration of Persons Act, 2015 (“the physiographic characteristics of an individual including the biometric information of an individual required for the purpose of establishing that individual’s identity”)
[2] Section 2, Registrations of Persons (Regulations), 2015 (“includes DNA, fingerprint, eye retina, iris, voice pattern, facial pattern, hand measurements and any other thing as may be determined by the Board”).
1.3. Which are the corresponding Data Protection laws, if existing?
- The right to privacy is protected under Article 27 of the Ugandan Constitution. Parliament passed the Data Protection and Privacy Act in 2019,[1] which is a general data protection act. Specific provisions on data protection are also included in specific laws, including ROPA, the Access to Information Act, 2005, the Computer Misuse Act, 2011, as amended in 2022.
[1] https://ict.go.ug/wp-content/uploads/2019/03/Data-Protection-and-Privacy-Act-2019.pdf
1.4. What are the main elements of the Digital ID framework (scope, eligibility criteria, remedies)?
- Purpose: as identified in ROPA, is to: “(a) remove duplication from the processes and laws relating to the registration of persons; (b) to harmonize and consolidate the law on registration of persons; (c) to establish a central registration body for the registration of all persons in Uganda; (d) to establish a national identification register of all persons in Uganda; (e) and to provide for access and use of the information contained in the national identification register.”
- Eligibility Criteria: The system applies only to citizens of Uganda and resident aliens; those staying in the country for less than 90 days and refugees are explicitly exempt.[1] Registration is compulsory for citizens of Uganda, both inside and outside of the country,[2] and those who fail to register may be subject to both fines and imprisonment.[3] Registration is also compulsory for resident aliens with a permit or certification (although as of February 2024, the process of registering and issuing ID cards to resident aliens has yet to begin). It is the duty of the individual to prove their citizenship status, and ROPA stipulates a process for verifiable proof, including through oath.[4]
- Scope: ROPA provides for both use of information in the register for a wide variety of purposes,[5] and for mandatory use of national identification cards.[6] This has been reinforced through the Registration of Persons Regulations, 2015, which includes a more detailed list of required uses, including “application for public government services, facilities, approvals, permissions or benefits.”
- Remedies: ROPA does specify some procedural remedies and due process principles, for instance cancellation of registration requires notice and a reasonable opportunity and forum to show cause why the registration should not be canceled before the revocation of documents. However, many of these processes have not been operationalized.
[1] ROPA, § 1.
[2] Ibid. at § 54.
[3] Ibid. at § 76.
[4] Ibid. at § 55(3).
[5] Ibid. at § 65.
[6] Ibid. at § 66.
1.5. Are there specific complaint mechanisms foreseen in the Digital ID and Data Protection laws?
- Under ROPA, the NIRA Board is meant to “establish an identification and registration to committee to adjudicate over matters arising and or related to registration under this Act.”[1] No specific remedies or powers are designated to this committee, which has never been established. The Act also allows for appeal to the High Court.
- The data Protection and Privacy Act, 2019, Sections 31–34, allows for complaints to be made to the National Information Technology Authority (NITA), with a pathway for appeals to the Minister responsible for information and communications technology.
[1] Ibid. at §
1.6. Was public participation ensured when these were drafted and enacted? How?
No, there was very little public participation. ROPA was passed after mass registration had already begun in 2014
1.7. Was there a Human Rights Impact Assessment prior to the enactment of the laws?
No
1.8. Does the country’s Digital ID framework reflect any particular digital ID model existing elsewhere (e.g., similar/comparable to X country)?
- This is a card–based, biometric system that is similar to many others, particularly on the African continent.
1.9. What is the interrelation of these Digital ID laws with existing nationality laws (does Digital ID reflect nationality status, is nationality an eligibility criterion or only legal residence)?)
- Registration for the digital ID is contingent on proving nationality, as determined by Chapter 3 of the Constitution of Uganda 1995, and ROPA amended the existing Citizenship laws.[1] Importantly, citizenship by birth is conferred on those who have one parent who is either already a citizen or who is a member of an indigenous tribe of Uganda, a schedule of which is included in the Constitution. The citizenship verification process has proven to be one of the most administratively difficult aspects of the national digital ID system, especially given the low rates of birth registration and issuance of birth certificates in the country.
- The registration of refugees remains outside of the national ID system and falls under the authority of the Office of the Prime Minister Department of Refugees, as defined in the Refugees Act of Uganda.
[1] See Neema Iyer, Digital Identity in Uganda: Case study conducted as part of a ten-country exploration of socio-digital ID system in parts of Africa, 2021, https://researchictafrica.net/wp/wp-content/uploads/2021/11/Uganda_31.10.21.pdf.
1.10. Court cases: Is there litigation going on? Has there been prior litigation? What are the specifics of those cases (list and summarize)?
- Yes, Initiative for Social & Economic Rights, Unwanted Witness, & Health Equity & Policy Initiative v. Attorney General and the National Identification and Registration Authority is currently (as of November 2023) pending the High Court of Uganda at Kampala.[1] The case alleges that the use of the national digital ID system has led discriminatory treatment of women and older persons, and that it violates economic and social rights.
- ISER and Unwanted Witness previously brought a case against the AG to prevent the exclusion of those without national IDs from receiving the COVID-19 vaccine, but the case was withdrawn after the MOH made a policy announcement that they would be accepting alternative forms of identification.[2]
[1] https://iser-uganda.org/frequently-asked-questions-on-national-digital-id-ndaga-muntu-case/
[2] https://iser-uganda.org/iser-press-release-on-ministry-of-healths-withdrawal-of-national-id-requirement-for-covid-19-vaccination/
1.11. How has Digital ID been rolled out?
- Initially, the digital ID was rolled out through a mass registration campaign that began in 2014 and involved physical visits to the districts of Uganda to conduct registration exercises. Subsequent registration drives have been conducted by NIRA.
- NIRA has also transitioned to an on-demand model by establishing offices in 117 districts of Uganda, while maintaining a head office in the capital of Kampala.
1.12. Has there been any special measures to ensure access for vulnerable and isolated communities (e.g., for PwD, minorities, elderly) such as mobile offices or free legal aid? Are those measures provided for in law?
- NIRA has made some efforts to cater to the specific needs of vulnerable groups. This includes door-to-door registration efforts, specific outreach to older persons who have been excluded, and several registration campaigns. These measures are not provided for in law.