Toward a trustworthy and inclusive data governance policy for the use of artificial intelligence in Africa

Abstract

This article proposes five ideas that the design of data governance policies for the trustworthy use of artificial intelligence (AI) in Africa should consider. The first is for African states to assess their domestic strategic priorities, strengths, and weaknesses. The second is a human-centric approach to data governance, which involves data processing practices that protect the security of personal data and the privacy of data subjects; ensure that personal data are processed in a fair, lawful, and accountable manner; minimize the harmful effect of personal data misuse or abuse on data subjects and other victims; and promote a beneficial, trusted use of personal data. The third is for the data policy to be in alignment with supranational rights-respecting AI standards like the African Charter on Human and Peoples Rights, the AU Convention on Cybersecurity, and Personal Data Protection. The fourth is for states to be critical about the extent to which AI systems can be relied on in certain public sectors or departments. The fifth and final proposition is for the need to prioritize the use of representative and interoperable data and ensure a transparent procurement process for AI systems from abroad where no local options exist.

Policy Significance Statement

Designing policies on data governance as it relates to the use of artificial intelligence (AI) requires an inclusive and accountable approach: one that ensures responsible use of both the data and the AI technologies to ensure that all human and people’s rights are protected and respected. Data policy in this area of AI may also require some relativism to be best suited for the people and communities where they will apply (and as defined by them). However, the African region has received very little attention when it comes to data governance policies for the use of AI in the region. This is partly because the region characterizes an ‘under-sampled majority’ of people and communities who are marginalized when it comes to inclusive data policies for the use of AI. This article hopes to highlight a few of the data norms applicable in Africa and, more importantly, to share ideas for how the design process for an inclusive data governance policy for the use of AI within Africa could be promoted.

1. Introduction

There are a few countries in Africa that have recently formulated laws, policies, and/or guidelines on data governance as it relates to the use of artificial intelligence (AI) within their jurisdiction (Adeniran, 2022). Several African states are also in the process of (or are contemplating) developing policies in this area (Halka, 2022). Many AI policies developed by states rely on established (or establishing) data governance structures for data protection, security, and regulation drawn mostly from non-African data governance initiatives. Developing an African-centered data governance structure is crucial if local and regional inclusivity will be achieved. Robust AI continental initiatives are gradually emerging. For example, the 2022 African Union (AU) Data Policy Framework has been and will be very helpful in this regard. The Framework aims to provide a blueprint for Africa’s data market by helping member states navigate complex regulatory issues. It acknowledges the vast ongoing transformations in regional and global data policies and the need for African leadership to promote the harmonization of legal frameworks across the continent. Other related governance initiatives include the AU Convention on Cyber Security and Personal Data Protection, which came into force in 2023. Individual African States have also introduced AI data policies or strategies, such as Benin, Egypt, Ghana, Rwanda, Senegal, Mauritius, and Tunisia (J Effoduh 2020).

Good data governance remains crucial for building a successful AI African ecosystem, but many roadblocks exist that deserve to be noted. Differing political and cultural setups can influence data sovereignty, privacy laws, and AI use in social systems and may militate against regional consensus. At the local level, a lack of a robust AI governance framework can lead to misuse and abuse of data and AI deployment. Institutional barriers like misappropriation of funds and other corrupt practices can weaken funding for research and development interventions, including effective implementation of data laws and policies. Consequently, it is important to recognize that policies and proposals to regulate data for the use of AI may require peculiar considerations in Africa. For example, it is relevant for such policy intervention to consider the unique political and sociolegal landscapes that exist on the continent, so that the enforcement of such data policy can be adequately projected. Also, the continent’s long colonial history, which has played a part in its current developmental path, is relevant in understanding the continent’s past and current track record with technological adoption. Issues such as availability and access to high-tech tools; current stages of AI readiness, and even cultural sensitivity to data and AI systems may help inform better policy designs. Therefore, designing policies on data governance as it relates to the use of AI requires a trustworthy approach: one that ensures a responsible use of technology that will respect human and people’s rights in Africa. Such policy may also require some relativism to be best suited for the people and communities where they will apply (Lindholt, 2019). This article hopes to highlight a few of the data norms applicable in Africa and, more importantly, to share ideas for how the design process for a trustworthy data governance policy for the use of AI within Africa could be promoted.

2. Designing data governance policies for the inclusive use of AI in Africa

This section introduces data governance and the key elements and instruments that frame Data Governance Imperatives—actors, policies, laws, human rights resolutions, and so forth for the inclusive use of AI in Africa. We recommend diverse perspectives worth considering to ensure the sustainable development of Data Governance policies that reflect Africa’s unique concerns and aspirations.

2.1. Data governance and (inclusivity)

A precise conceptual framing of the term data governance can be challenging. However, it can simply mean the exercise of control and authority by relevant actors in the management of data, aimed at harnessing the value of data and mitigating potential risks (Abraham et al., 2019). The term encompasses a wide variety of meanings and norms depending on use and context but could be treated as connoting the collaborative obligations of different actors in the management and treatment of data, such as its collection, usage, transfer, security, and limitations. It can also imply a framework that provides a formalized structure for the management of data use at different levels of corporate or institutional needs. It is trite that effective data governance can lead to better data analytics, which in turn leads to better decision-making that can improve system outcomes, and ultimately, public service support.

Data governance invites the active involvement of multiple actors, often with competitive struggles and power dynamics. These actors include States acting through relevant public institutions and supranational bodies, corporate big tech bodies usually with a high capacity to harvest big data, civil societies, and data subjects. These actors operate at different levels of power relations that produce asymmetric control (Micheli et al., 2020). High-tech entities mostly driven by market needs benefit at the detriment of less powerful actors such as data subjects, civil societies, and even states, who are grappling with how to regain the majority governance stake.

This power imbalance is particularly problematic for Africa since major big tech companies operate extraterritorially. This extraterritorial presence excludes these entities from understanding the social, legal, and economic context and nuances of data and AI in Africa. Hence, the diverse cultural and socioeconomic nuances of African states warrant a strategic data and AI governance regime at both the regional and state levels. It is imperative to develop governance regimes that promote inclusivity. We stress inclusivity as particularly relevant for AI and data trustworthiness in Africa. The approach reflects and underscores the imperativeness of context-driven governance interventions that consider cultural diversity and socioeconomic realities. It also implies the responsibility of global north players to respect these governance frameworks in data collection and the use and production of AI technologies for the African market. African states must clearly articulate the social and cultural logic that embeds the country’s governance and who benefits from it. As noted by Wakunuma et al., the AI ecosystem is a “value-laden” one that encompasses a country’s ethical, legal, sociocultural, and technical principles. As such, any governance framework in Africa must set out a vivid path for the integration of sociocultural and legal values in specific AI domains (Wakunuma et al., 2022). The efforts toward inclusivity must be for African states to jettison governance assimilation, or what Vincent Obia describes as “regulatory annexation” wherein existing standards and legal frameworks that are representative of values from other domains are imported and replicated without proper context fine-tuning (Obia, 2023).

2.2. Framing data governance imperatives for AI in Africa

While the term data governance has a broad or narrow connotation depending on the context, we focus on its meaning in the sense of States’ (including supranational bodies) contributory interventions through policies, standards, and procedures when data are used for AI technologies. These governance interventions include the use of both hard laws and flexible recourse like policies, regulations, strategies, and guidelines. Indeed, AI-based technologies are becoming increasingly integrated into the modern lives of many Africans (Baijnath, Butcher et al., 2021). In terms of policy making, there is a need to consider the ways by which such technologies impact the lives and rights of Africans: from the initial design of these technologies; to how they are trained; also, how they engage with data (especially the management, anonymization, gathering, transfer, and storage of data); and then how these technologies are ultimately used. These are the entry points for data policy intervention.

As noted earlier, data governance on both macro- and micro-levels has become a top priority for many African countries (Ndemo and Thegeya, 2022). Data governance has become even more fundamental as several state initiatives are beginning to give attention to the use of AI and other technological tools that require the use of data for their development and application (Effoduh, 2021). Although challenged by various technological and developmental limitations, some states are still demonstrating readiness for establishing responsible data policies to create a framework for the research, development, application, coordination, and regulation of AI systems: Nigeria, Ethiopia, Rwanda, South Africa, Egypt, Tunisia, Mauritius, Senegal, and Kenya are examples of countries that have committed to instituting appropriate and adequate frameworks on the use of data as a tool to advance technological advancement, job creation, economic growth, and improved governance, among other goals (One Trust Data Guidance, 2022).

2.2.1. Compatibility with Africa’s universal goals

Designing data governance interventions for the inclusive use of AI in Africa behooves the various governments on the continents and other relevant stakeholders to think carefully about how such a policy can be created to support an AI economy that will maintain standards of algorithmic accountability, data protection, explainability of decision-making by machine learning models, and the protection of the citizens’ privacy and other human rights from infringements, and so forth (Chakravorti and Chaturvedi, 2019).

The formulation of such interventions for the inclusive use of AI in Africa must also rest on some universal goals for data governance programs: This will require a motivation to enable better decision-making; reduce operational friction; protect the needs of data stakeholders: train management and staff to adopt common approaches to data issues; build standard, repeatable processes; reduce costs and increase effectiveness through coordination of efforts; and ensure transparency of processes (Data Governance Institute, 2022). Designing such governance interventions requires an understanding of how AI and other related technology developments can be used to help solve a myriad of pressing local problems (such as food security, healthcare, pandemic and epidemic preparedness and response). It will also require an understanding of some of the harms that the use of AI may perpetuate as well as thinking of ways to promote mitigation. This is because the use of AI will have an impact on a wide range of activities and sectors in the coming years: including impacting commercial transactions, how enterprises produce; how consumers consume; and how governments will deliver life-saving services to their citizens.

2.2.2. Consideration of Africa’s vulnerabilities

The outbreak of COVID-19 has highlighted some dependence on digital technologies and networks for economic, health, educational, judicial, and even cultural endeavors. For example, in the past years, some judges in Nigeria had to resort to speech-to-text transcription in Zoom court sessions (The Cable, 2020; Thisday Nigeria, 2021). More broadly, Nigeria’s Aviation has acquired two robots with AI features for use in improving passenger safety (HumAngle, 2020). The robots are responsible for the identification and screening of passengers (The Nation Nigeria News, 2020). The transfer and sharing of data—be it on a video conference platform by a court of law or by robots at the entry point into a country—sudden resort to AI and other digital technologies has also created new vulnerabilities to privacy, trust, and protection of sensitive data. In Uganda, citizens may be at risk of their data being commercialized or weaponized against them as the use of facial recognition technology (that is secured from abroad and may be controlled there) may be deployed and unregulated (Jili, 2022; Unwanted Witness, 2022). In Kenya, a gap in the state’s data governance structure may have allowed the use of bots to spread misinformation and disinformation, which created societal divides in electoral sentiments and affected voter behavior (Article 19, 2022; CIPESA 2022). In South Africa, a private surveillance machine may be fueling a digital apartheid as data extracted from a database that allows car tracking when matched with facial recognition cameras may recreate the digital equivalent of passbooks or internal passports, (an apartheid-era system that the government used to limit Black people’s physical movements in white enclaves) (Hao and Swart, 2022).

These examples make it essential for data governance on the use of AI in Africa to be rights-respecting and responsible (Kong et al., 2023). They need to prioritize the inclusion and recognition of values that advance the needs and welfare of the people they intend to serve and perhaps even introduce the use of data trusts to navigate what use of data is permissible and beneficial or harmful and prohibited. A data trust provides independent, fiduciary stewardship of data. Data trusts are an approach to looking after and making decisions about data in a similar way that trusts have been used to look after and make decisions about other forms of assets in the past, such as land trusts that steward land on behalf of local communities. They involve one party authorizing another to make decisions about data on their behalf, for the benefit of a wider group of stakeholders (Hall and Pesenti, 2017; Hardinges, 2020). States’ governance approaches can drive meaningful action with a rights-respecting data governance policy for AI: one that can promote the use of data in responsible and innovative ways to create a healthy AI ecosystem that is centered around the protection and advancement of the human rights of Africans right from the start.

2.2.3. Recognition of existing data governance policies

The AU Data Policy Framework, which was endorsed by the AU Executive Council in February 2022, shows the commitment and political will of African leaders to invest in data through strengthening cross-sector collaboration and developing the related infrastructure to host, self-manage, process, and use data being generated by people and industry to inform policy formulation and decision-making processes (African Union, 2022). The African approach to data is said to be inclusive and forward-looking by aiming to harness the potential of the data revolution to empower people and institutions in Africa; build trust in the data ecosystem, and reinforce Africa’s participation as a united front and a uniform stance in multilateral discussions on various data-based areas (African Union, 2022). Subregional data frameworks in Africa also exist. For example, for West Africa, there is the Supplementary Act on Personal Data Protection within The Economic Community of West African States (ECOWAS Supplementary Act A/SA.1/01/10, 2010); for the East, there is the East African Community Legal Framework for Cyberlaws of 2008; and for the southern part of the continent, there is the Southern African Development Community Model Law on data protection. Domestically, of the 54 African states, 33 of them have established data protection laws (6 other states are still in the drafting stage; 10 have no data legislation and there is no data on 5 states) (United Nations Conference on Trade and Development, 2022).

When it comes to the governance of data for AI specifically, it is important to note that the African Commission on Human and Peoples’ Rights adopted a resolution on human rights, AI, and other new and emerging technologies in Africa (African Commission on Human and Peoples’ Rights, ACHPR/Res. 473, 2021). The resolution emphasizes the need for sufficient consideration of African norms, ethics, values, and communitarian ethos, in the development of new technological structures. The Commission calls on African States to ensure that the development and use of AI is compatible with African regional human rights norms and standards of human dignity, privacy, equality, nondiscrimination, inclusion, diversity, safety, fairness, transparency, accountability, and economic development. The Commission also resolved that all technologies that are imported from other continents into Africa should be made applicable to the African context and/or adjusted to fit the continent’s needs and peoples. International (and other regional or institutional) data policy frameworks relating to the use of AI have been established (A few of the AI policy frameworks include the G20 AI Guidelines (Group of Twenty (G20), 2019); OECD AI Principles (OECD, 2019); UNESCO Recommendation on AI Ethics (UNESCO, 2021); Universal Guidelines for AI (The Public Voice 2018); EU AI Act [Proposed]; EU AI Act [Council Text (European Union, Jan 2024)]; African Commission on Human and Peoples Rights—ACPHR—Resolution 473; EU Digital Services Act (European Union, 2023) [provisions on Recommendation Algorithms]; and a host of others). Some of them have relevance within some African states and perhaps have inspired some policy development on data governance on the use of AI within Africa.

Furthermore, a human-centric approach to data governance is imperative for a standardized set of data protection rules and to address ethical concerns around the collection, holding, and processing of Africans’ data. The continental legal framework for the use and exchange of electronic data is resourceful in complementing state efforts in this area and inspiring other states that are yet to ratify it to develop inclusive data governance, especially toward the use of AI. Also, public (and even private) institutions across Africa can benefit from a mix of international, continental, subregional, and even local-level propositions to guide them on the management and coordination of rules on data protection, security, and regulation as they design, develop, or deploy the use of AI systems within the continent (Shaw, 2021).

The African Charter on Human and Peoples’ Rights (ACHPR) and its related protocols and conventions (African Union, ACHPR, 1981), including the AU Convention on Cybersecurity and Personal Data Protection (though not without their limitations—for example, both the ACHPR and the AU Convention on Cybersecurity and Personal Data Protection do not contain standards or provisions that directly apply to AI), can serve as foundational rubrics toward the ethical governance of data and the use of AI on Africans (Murray, 2019). However, comprehensive national data legislation and an ombudsman for data governance within states may help provide some enforcement teeth and improve accountability (Orji 2018).

2.2.4. Promotion of ethical AI with democratic data governance

Data governance interventions in the form of policies and legislative frameworks for the use of AI in Africa should prioritize the regard for democratic values and compliance with rights-respecting constitutional principles; especially with objectives to meet the socioeconomic needs of the people. Policies for the use of AI in Africa should maintain standards of algorithmic accountability, fairness, transparency, security and safety, reliability, data protection, interoperability, explainability of decision-making by machine-learning models, and the protection of human rights from infringements. A data governance policy for the use of AI should emphasize the recognition and compliance with fundamental human rights provisions, particularly the right to privacy, nondiscrimination, and the protection of the dignity of Africans. (Ssenyonjo, 2018). Such policy should also align with supranational rights-respecting AI norms and standards that promote equality, inclusion, diversity, and the right to redress harm.

The sudden resort to the use of AI (and other digital technologies) by some African states because of the COVID-19 pandemic (or other reasons) has created new vulnerabilities such as the risk of the data of several Africans being commercialized in ways that may be unfavorable or cause harm to them. Therefore, issues of algorithmic bias, loss of privacy, lack of transparency, and the overall complexity of getting Africans to understand how their data are being used to train or interact with AI systems, all require policy considerations.

2.2.5. Africa’s AI future empowerment through technological resilience

It is proposed that AI assessments just by themselves should perhaps not be a basis for sensitive human decisions due to the probabilistic nature of most predictions. Decisions made by AI systems are influenced by the data used for designing and operating them. Therefore, the representativeness, robustness, inclusiveness, appropriateness, and interoperability of datasets are relevant benchmarks for data governance policies to require. Caution should be made about the extent to which AI systems can be relied on in certain public sectors (especially their use in sensitive areas of law enforcement, criminal justice, immigration, and national security).

This may not be a direct policy concern, but African states (and state development partners) should focus on the creation of easily accessible and affordable data and digital infrastructure, one that includes a spectrum of secure networks, computers, and storage capabilities which are required for the successful delivery of AI applications and services. Both software and hardware tools are insufficient within most African states, and this must be adequately considered.

Due to the diversity of people and communities within African countries, data processing and its representativeness, interoperability, and reusability should be encouraged. The use of locally developed AI systems should be promoted while ensuring a transparent procurement process for AI systems from abroad. Such procurement process, if needed, should focus on mechanisms of algorithmic accountability and transparency norms, with the opportunity for local knowledge transfer and long-term risk valuation.

As a continent with the lowest median age (of about 18 years) and being a demographic outlier in the world (Desjardins, 2019), Africa’s teeming youth require extensive technology upskilling and reskilling efforts (especially within its agile workforce) to leverage the opportunities of the fourth industrial revolution and to sustain the continent’s labor economy (Chakravorti and Chaturvedi, 2019). Training on inclusive and responsible data gathering, data management, data security, and data sharing is highly relevant for the region.

3. What the design of data governance policies for the inclusive use of AI in Africa should consider?

As demonstrated above, we consider inclusivity as an imperative push for regional and domestic governance interventions in Africa. This requires attention to the sociocultural, sociolegal, and socioeconomic relativity and context of African States, including a keen regard for minority communities. Our idea of inclusivity also connotes caution with the importation of foreign data-driven AI technologies by making sure that they put local needs and realities at the center of data usage and AI training methodologies. Our propositions below fit well within the broader international governance directions, but we emphasize precautionary governance norms that reflect the needs of African states. Achieving these suggested policy goals will require an evaluation of a country’s unique demographic needs, strategic priorities, urgent concerns, and resource constraints.

3.1. An assessment of domestic strategic priorities, strengths, and weaknesses

First, as it relates to the use of AI, this assessment should also cover where the use or deployment of AI systems will be most effective and at the same time be most responsible across the country. If a country’s digital infrastructure is below capacity compared to its needs, then there is a need to focus on the creation of easily accessible and affordable digital infrastructure, such as a spectrum of networks, computers, and storage capabilities required for the safe and secure processing, storage, and sharing of data. The proposed digital infrastructure should provide the successful delivery of applications and services that are accessible to all populations across the country.

Second, as it relates to data, this assessment should consider what legal framework works best and how the protection of personal data, and the regulation of the processing of personal data, will be carried out. This data framework assessment could even include an appraisal of the range of data subjects’ rights and remedies for infringements that are already covered by existing law and marking where gaps lie. It could also consider if there are existing data regulatory bodies; if there is a need to coordinate their mandate and activities; or if there is a need to create one that can superintend over data protection and privacy issues and supervise data controllers and data processors within the private and public sectors. It is important to note that several African countries lack data centers, and this reduces the country’s competing power against Big-tech companies (Njanja, 2022). Therefore, an initial assessment and some strategic framings are a good starting point for a data governance policy for the inclusive use of AI.

3.2. A human-centric approach to data governance

Data are the fuel powering AI. Therefore, directives need to support a standardized set of data-protection rules and address ethical concerns around the collection, holding, and processing of citizens’ data. It is important to note that all data are in the past and is subject to change.

Furthermore, there needs to be the deliberate promotion of mutual trust between the AI institutions and the citizens who are the data subjects and deserve to know how their data are collected, stored, processed, shared, and potentially deleted. Data privacy frameworks are important to peg some of the threats linked to the use of AI. And so, data governance for the inclusive use of AI could impose limitations on the type of data that may be inferred, used, and shared. For example, children’s data should require special protection. The special protection accorded to children within the EU’s GDPR: Recital 38 notes that the use of a child’s data for marketing, creation of user profiles, or the collection of data when using services merits specific protection. The process of obtaining consent for children (and the validity of their consent is governed by Article 8 of the GDPR). Another example is UNICEF’s Policy Guidance on AI for Children (2021). Policy guidance explores AI and AI systems and considers how they impact children. It draws upon the Convention on the Rights of the Child to present three foundations for AI that upholds the rights of children. Both documents are instructive here.

Africans need to maintain control over their data. Individuals’ right to their data is grounded in concepts that are related to but distinct from ownership, including control, agency, privacy, autonomy, and human dignity. All these values are established under the African Union, ACHPR (1981). While some African countries have instituted some data guidelines that are progressive and commendable (Ghana, Kenya, Madagascar, Mauritius, Nigeria, Rwanda, South Africa, Togo, Uganda, and Zimbabwe are a few examples: McKenzie, 2022), some of them are still insufficient in providing a robust and responsible foundation for data governance that will be accountable not only to the state but mostly to the citizens and publics as data subjects.

Data governance frameworks should be premised on human rights principles and should require periodic revisions. Comprehensive legislation that enforces a rights-centric data protection obligation for the benefit of citizens is generally required. Moreover, because the government is usually the largest data processor in a country, there needs to be an independent data ombudsman. Nigeria, for example, is proposing the establishment of a Data Protection Commission with enforceable powers, and a code of practice that ensures a rights-respecting data governance framework for the country (Nigeria Data Protection Act, 2023). No doubt multiple actors are involved in the overall management of data and are actively principal governance stakeholders. There is a need for a principled framework that emphasizes collaboration, honest dealing, and respect for data subjects’ rights by all actors. Although the proposal is not exhaustive, this is a step in the right direction. African states can help build empowered data communities, and a human-centric approach to data can help realize this. A human-centric approach to data governance should promote data processing practices that protect the security of personal data and the privacy of data subjects; it ensures that personal data are processed in a fair, lawful, and accountable manner; it minimizes the harmful effect of personal data misuse or abuse on data subjects and other victims; and promotes a beneficial, trusted use of personal data.

3.3. Data policy alignment with supranational rights-respecting AI standards

A report published by the Office of the United Nations High Commissioner for Human Rights in September 2021 outlines the human rights risks and implications of the widespread use of AI by governments and businesses alike, offering recommendations to mitigate these risks (United Nations Human Rights Council A/HRC/48/3, 2021). A moratorium was called on the use of AI technology that may pose a serious risk to human rights, such as the use of remote biometric recognition or real-time facial recognition technologies in public spaces.

Data policies must align with established human rights standards. Regional frameworks on rights-respecting data policies for AI are also significant as they could be relatively significant, especially in the African parlance. For example, the AU Convention on Cybersecurity and Personal Data Protection has established a normative framework that is consistent with the African legal, cultural, economic, and social environment to stress the protection of personal data and private life as this has become a major challenge in the Information Society for African states. The AU proposes data governance policies that will ensure a balance between the use of information and communication technologies and the protection of people’s privacy, while guaranteeing the free flow of valuable data. The AU also recommends cyber security befitting of the environment where data are collected, processed, transmitted, stored, and used (Malabo Convention, 2014).

Moreover, in February 2021, the African Commission on Human and Peoples’ Rights adopted a resolution on human rights, AI, and other new and emerging technologies in Africa. The resolution emphasizes the need for sufficient consideration of African norms, ethics, values, and communitarian ethos in the development of new data technological structures (ACHPR/Res. 473, 2021). The Commission calls on African States to ensure that the development and use of AI is compatible with African regional human rights norms and standards of human dignity, privacy, equality, nondiscrimination, inclusion, diversity, safety, fairness, transparency, accountability, and economic development. The Commission also resolved that all technologies that are imported from other continents into Africa should be made applicable to the African context and/or adjusted to fit the continent’s needs and peoples. AI systems to be used in Africa and for Africans should be trained on African data and if possible, developed with, and designed for Africans. There is also the need for reliable and consistent data interoperability with the potential for industry and/or sector-specific open standards, as well as safe and secure data portability, and data mobility (Open Government Partnership, 2021).

3.3.1. Focus: The Africa-Canada AI and Data Innovation Consortium

The Africa-Canada AI & Data Innovation Consortium (ACADIC) (2022) mobilizes the use of AI and big data techniques to build equitable, resilient governance strategies and increase societal preparedness for future global pandemics and climate disasters. The consortium has been developing and deploying AI solutions to better inform the impacts of public health interventions put in place during the COVID-19 pandemic in Africa. For example, the consortium has developed COVID-19 monitoring dashboards that visualize locally relevant information to the public and policymakers. These dashboards are used by policymakers in Botswana, Nigeria, Eswatini, Mozambique, Namibia, Zimbabwe, and South Africa. ACADIC has been informing COVID-19 policies and COVID-19 vaccine roll-out strategies by using findings from its use of AI and big data to inform COVID policies and COVID-19 vaccine roll-out strategies in different African countries as well as supporting communication strategies with local stakeholders that address disinformation and misinformation about COVID-19 vaccines, COVID-19 prevention, and treatment (acadic.org, 2022).

“ACADIC ensures the continual evaluation of the quality of training data for AI systems, including the adequacy of data collection and selection processes, proper data security and protection measures, as well as feedback mechanisms to learn from mistakes and share best practices among all AI actors. The consortium encourages all AI actors, including states, to follow existing international standards and to carry out adequate privacy impact assessments, as part of ethical impact assessments, which consider the wider socioeconomic impact of the intended data processing, and to apply privacy by design in our systems, ensuring that privacy is respected, protected, and promoted throughout the life cycle of every AI system.” (acadic.com, 2022).

As a cross-border consortium, they posit applying a mix of “a principles-based ethics approach” with a “prescriptive-based ethics approach.” By a principles-based ethical approach, they must comply with the laws, rules, and guidelines both in Canada and in the African countries they are working with. This includes fulfilling general data protection and the protection of personal health information with the data sets used in their research. (ACADIC UNGA77, 2022).

“We must comply with the data protection laws in Canada: The Privacy Act and the Personal Information Protection and Electronic Documents Act, both of which are federal legislations, along with several provincial rules. Then, we must complement this with cross-border and international rules: The GDPR of course, and the data protection laws of each of the African countries we engage with. We have had to ask ourselves: How do we balance the free flow of data (argued to be necessary for AI health innovation) with data protection rights? How do you ensure shared national standards with countries of the global south that we work with to protect the data of citizens as they flow across borders?” (ACADIC UNGA77, 2022).

By prescriptive-based ethical approach, their use of data and AI seems to be more relative to the guidelines that govern health research with the use of AI: The WHO Guidance on Ethics and Governance of AI for Health provides them with the six key ethical principles for the use of AI for health as follows: 1) Protecting human autonomy. 2) Promoting human well-being and safety and the public interest. 3) Ensuring transparency, explainability, and intelligibility. 4) Fostering responsibility and accountability. 5) Ensuring inclusiveness and equity. 6) Promoting AI that is responsive and sustainable (WHO Guidance, 2021).

“We have also had to look at several other frameworks like the Good Machine Learning Practice for Medical Device Development, the Astana Declaration on the use of digital technology, the UNESCO principles on AI and even the standard Tri-Council Policy on Ethical Conduct for Research Involving Humans, although it does not cover anything on AI and is not specific to health research, but it is still relevant to us as our research involves humans.” (UNGA77, 2022).

3.4. Concerns about the use of AI systems in some key sectors: law enforcement, criminal justice, immigration, and national security

As several AI systems are deployed as forecasting tools, some algorithms are used to analyze large quantities of data, including historic data, to assess risks and predict future trends. While these may seem cutting-edge, some human rights issues can emanate from both the use of such data and the reliance on such AI systems (Data Governance Institute, 2022). For example, predictive policing is a method of deploying law enforcement resources according to data-driven analytics that supposedly can predict perpetrators, victims, or locations of future crimes. Using historic and current crime data (including social media posts, communications data, etc.) can largely perpetuate racial and ethnic bias, discrimination, and inequality (Richardson et al., 2019). Such technology should not be used as a substitute for community engagement and holistic crime reduction measures.

Data governance regimes and AI use in high-risk sectors are gradually attracting normative standards that African countries should consider. The European dimension has been the classification of data-driven AI systems into tiers of risk level and has introduced mitigating strategies including a complete ban or stringent regulatory pre- and post-deployment conditions. AI systems of “unacceptable risk” that can infer sensitive characteristics like religious beliefs based on biometric data are banned. Indiscriminate web or CCTV data scraping of images, systems with manipulative capacity, or systems that lead to the exploitation of vulnerable people are also barred. High-risk systems used for sectors like law enforcement, migration, asylum and border control management, employment, and education come under rigorous regulatory mandates. (EU AI Act 2023).

African governance stakeholders must follow suit by going tough on indiscriminate data use and the deployment of AI systems in these sectors. Extant continental AI readiness challenges, such as a lack of robust datasets and governance frameworks, require higher precautionary measures. There may be a need to reshuffle risk triaging; the use of high-powered AI systems for law enforcement, education, and employment may as well be flagged as “unacceptable” until there is domestic data to accommodate their effective deployment. This is because any AI system that will be used to create profiles of people or identify people as likely to carry out terroristic activity, or even flag individuals due to travel history, race, culture, or religious affiliation, can be prejudicial and derogate from the constitutive standard of the presumption of innocence. Any AI system that claims to deduce people’s emotional or mental state from their facial expressions could be highly susceptible to bias, discrimination, and false interpretations. AI assessments by themselves should not be a basis for reasonable suspicion due to the probabilistic nature of the predictions. States should be critical about the extent to which AI systems can be relied on in certain public sectors or departments and should justify the choice of using such technology if deemed necessary.

3.5. Prioritizing the use of representative data, promoting local AI systems, and ensuring a transparent procurement process for AI systems from abroad

Data processing and its representativeness, harmonization, interoperability, accessibility, accuracy, and reusability should be encouraged, and with the informed consent of data providers.

Due to the diversity of people and communities within African countries, quality control measures should be implemented to ensure the representativeness of data from different population groups is taken into consideration. This is because the use of low-quality, limited, and nonrepresentative data in AI could perpetuate and deepen prejudices, causing AI systems to make biased inferences that could be harmful, especially to vulnerable and minority groups. The effectiveness of most AI systems depends on whether the datasets are representative of the populations in which the technology will be used.

However, generating more data from Africa without value to Africans could carry the risk of “data colonialism” whereby, the continent is seen as a data mine and such data are used without due respect for consent, privacy, or the autonomy of the people (Coleman, 2018). There is also the issue of power dissymmetry between the collectors of data and the individuals who are the sources. Most of the technological software used in many African countries is imported (Kwet, 2019). Several AI systems operating within Africa are adopted from outside the continent with some of them hosted from abroad. This means that AI systems may be more expensive for Africans. In the meantime, codesign strategies should be pursued by actors in Africa and abroad. Governance frameworks are required to guide such interactions, including storage of data, how it should be handled after usage, transfer to third parties, rights of data subjects, and so forth.

Moreover, if AI technologies are increasingly protected by exclusive rights, there is a wider question of whether they will be available, appropriate, and affordable in Africa. Local AI systems need to be promoted and prioritized, especially where they are needed for public purposes. However, as the government (and other institutions) are increasingly seeking to capture the opportunities offered by AI from other jurisdictions, there is a need to use procurement processes that focus not on prescribing a specific solution but rather on outlining problems and opportunities and allowing room for iteration. Conditions for a level playing field among AI solution providers should include the interoperability of AI solutions and the cogeneration of data between countries/regions. These would require open licensing terms, bilateral agreements, and transparency to avoid vendor lock-in. Also, the public benefit of using AI needs to be defined while also assessing its risks. The procurement process should focus on mechanisms of algorithmic accountability and transparency norms, with the opportunity for local knowledge transfer and long-term risk valuation.

4. Governance implementation and setbacks

There are several challenges to the effective implementation of the proposal that are common knowledge, some of which have been highlighted earlier. Many African states grapple with challenges in allocating sufficient resources for data governance, facing budget constraints, and manpower shortages that impede program establishment. To overcome this, stakeholders must proactively prioritize and allocate resources for data governance as a strategic imperative. At the corporate level, effective data management, even with a robust data governance framework, can be challenging. Handling data often fragments within different departments or systems, hindering effective decision-making and obstructing a holistic organizational view. Breaking down these silos necessitates promoting cross-functional collaboration and implementing integrated data management strategies.

African regulatory bodies for data governance struggle to keep pace with the dynamic digital landscape, lacking the necessary tools to handle complexities. To address this issue, policymakers should invest in building regulatory capacity and adopting governance structures to adapt to the evolving digital environment. Similarly, ensuring data security and privacy pose critical challenges, with threats such as cybersecurity threats, data breaches, and unauthorized access jeopardizing sensitive information (Sutherland, 2018). Robust data protection laws and effective enforcement mechanisms are essential to address these concerns. Infrastructural and institutional setbacks also persist. Unequal access to services like electricity and internet connectivity hampers data collection and utilization in Africa. Limited infrastructure further impedes data availability and quality. Resolving these disparities requires substantial investment in infrastructure development and digital inclusion initiatives. The quality of democratic institutions significantly impacts data governance. Transparent, accountable, and participatory governance fosters sound data practices, contributing to effective data governance. In summary, addressing these challenges mandates a holistic approach that combines resource allocation, regulatory adaptation, and infrastructure investment.

5. Conclusion

Designing policies on data governance as it relates to the use of AI requires an inclusive approach: one that ensures a responsible use of data and technology that will respect the human and people’s rights in Africa. There is a need for sufficient consideration of African norms, ethics, values, and communitarian ethos in the development of new technological structures and policies. Governance interventions for the use of AI in Africa should maintain standards of algorithmic accountability, fairness, transparency, security and safety, reliability, data protection, interoperability, explainability of decision-making by machine-learning models, and the protection of human rights from infringements. It should emphasize the recognition and compliance with fundamental human rights provisions, particularly the right to privacy, nondiscrimination, and the protection of the dignity of Africans. Due to the diversity of people and communities within African countries, data processing and its representativeness, interoperability, and reusability should be encouraged.