The AI-based tool demystifying African ID, data privacy laws

For years, the African Union has been developing a continent-wide trade market to make it easier for people to invest and create jobs across national borders. One component holding up this goal: how each nation identifies people and protects their data.

When you cross a border, what will count as a valid form of identification? A passport? A national ID card? Will you have access to services like healthcare? Is there a national digital database for ID cards, and is that technology shared across nations to easily identify someone? How are identities protected within these digital infrastructures? Without a clear understanding of other nations’ policies, questions like these could hinder individuals and businesses from building crossborder operations.

Understanding these differences was at the core of creating a new digital framework called Policy Analyzer. This tool is an open-source solution allowing users to compare and interpret national ID and data protection laws in more than 50 African nations. It was built by the Upanzi Network, a hub-and-spoke network that includes a lead lab at Carnegie Mellon University Africa and nodes in four other countries. The network is focused on creating, testing, innovating, and assisting in implementing digital public goods across the continent.

The Policy Analyzer follows the Upanzi Network’s goal of creating impactful digital public goods. This is a sentiment shared by Furaha Benedict, a research engineer at the Upanzi Network who helped develop the Policy Analyzer. She said that, for the network, “it’s not just about the technology that we build, but it’s also how these technologies can be used.” This means creating technology that not only allows users to solve a problem, but also allows developers to build on an existing tool for specific needs.

It’s not just about the technology that we build, but it’s also how these technologies can be used.

Furaha Benedict, Research Engineer, Upanzi Network

Benedict described the analyzer as a use case for employing artificial intelligence within policy analysis. She said in Africa, there is a tendency to prioritize having a policy backing a topic before building the tech around that topic. As more nations have adopted national ID and data protection laws in the last few years, technology now has a clearer place in allowing users to understand and compare these laws. However, this process would require the average person or organization to locate and access each country’s laws, then read through this complex legal information to find out what is protected or not.

With the Policy Analyzer, users can prompt a chatbot with questions and receive answers based on specific laws. By analyzing with AI on a dedicated platform, users can speed up the fact-finding process, more quickly synthesizing the most relevant information to answer their policy questions.

Benedict has a background in information technology, social engineering, and machine learning, which contributed to her work on the Policy Analyzer. As part of her team’s development of the tool, she conducted initial research into what identity protection policies exist and are being drafted across the continent. She also developed and tested retrieval-augmented generation (RAG) models for the analyzer. These RAG models are built on a corpus the Upanzi Network collected of specific laws and policies, thus improving how accurate and relevant the chatbot’s output will be. Because a user can also fact-check information in the same platform, these models help cement the analyzer as a single repository for African laws on data protection and national ID.

While the network was conducting its comparative analysis, they realized the topic of inclusion played a larger role than expected in some countries’ policies. For example, how does a person with no arms register something like fingerprints for ID purposes? The team learned, in these cases, some countries allow alternatives like toeprints. Understanding policy differences like this would be essential to creating a platform representing the breadth of existing data privacy and ID laws.

The analyzer carries several benefits for different audiences. For individuals, the analyzer helps communicate what they can expect in terms of data protection when crossing a border. This benefit extends to businesses and organizations looking to expand into a country: by knowing what forms of ID are acceptable and how personal data are handled, these groups can more easily invest across borders.

As Benedict noted, the Policy Analyzer also allows nations to spot how they might “harmonize” their laws. For instance, if a government wants to collaborate with another on making their digital ID systems more similar, the analyzer can serve as a jumping-off point to compare their existing infrastructure before working to align them.

One versatile aspect of the analyzer Benedict highlighted: it’s not beholden to only analyzing ID and data protection laws. In fact, it can analyze multiple other kinds of regulations. The Upanzi Network wanted a tool that could be reused across different use cases, such as cybersecurity, giving developers a basis for creating similar tools through the Policy Analyzer’s open-source framework.

The Upanzi Network has begun working with governmental agencies to test how the Policy Analyzer might be deployed among its target users. In practice, the tool will seek to give nations the freedom to see how their neighbors govern IDs and protect data as well as give nations the opportunity to collaborate on creating comparable provisions. The Policy Analyzer also seeks to ease the journey for individuals and organizations wanting to expand their customer bases across Africa, bolstering an ongoing continental goal as a contribution to the digital public good.

For more information about the team or to try the Policy Analyzer tool, contact the Upanzi Network at upanzi@andrew.cmu.edu.