The South African project to digitise its foundational identity expands on a broad system of paper identity documents underpinned by an identity database that has for many decades included records of biometric identity, primarily through fingerprints. It is being driven through a phased introduction of Smart ID Cards. The empowering statute, the Identification Act, is from 1997, and long preceded the introduction of broad-based personal data and privacy protection found in the 2013 Protection of Personal Information Act. This provides a patchy basis for protections, especially in the absence of any guiding policy framework, which makes the mitigation of risks challenging. The recent draft Official Identity Management Policy (2020) indicates a desire to modernise government identity management and align with national development objectives. There are strong indications though that such policies may be insufficient to manage the realities of personal data risks that accompany digitisation efforts, without the full and purposeful implementation of the Protection of Personal Information Act across stakeholder groups. This is concerning, given the imperatives for universal digital identification, in light of the lived experience of poor service delivery in the realm of identity management for South African citizens and non-citizens alike.
