2.1. Data governance and (inclusivity)

A precise conceptual framing of the term data governance can be challenging. However, it can simply mean the exercise of control and authority by relevant actors in the management of data, aimed at harnessing the value of data and mitigating potential risks (Abraham et al., Reference Abraham, Schneider and vom Brocke2019). The term encompasses a wide variety of meanings and norms depending on use and context but could be treated as connoting the collaborative obligations of different actors in the management and treatment of data, such as its collection, usage, transfer, security, and limitations. It can also imply a framework that provides a formalized structure for the management of data use at different levels of corporate or institutional needs. It is trite that effective data governance can lead to better data analytics, which in turn leads to better decision-making that can improve system outcomes, and ultimately, public service support.

Data governance invites the active involvement of multiple actors, often with competitive struggles and power dynamics. These actors include States acting through relevant public institutions and supranational bodies, corporate big tech bodies usually with a high capacity to harvest big data, civil societies, and data subjects. These actors operate at different levels of power relations that produce asymmetric control (Micheli et al., Reference Micheli, Ponti, Craglia and Suman2020). High-tech entities mostly driven by market needs benefit at the detriment of less powerful actors such as data subjects, civil societies, and even states, who are grappling with how to regain the majority governance stake.

This power imbalance is particularly problematic for Africa since major big tech companies operate extraterritorially. This extraterritorial presence excludes these entities from understanding the social, legal, and economic context and nuances of data and AI in Africa. Hence, the diverse cultural and socioeconomic nuances of African states warrant a strategic data and AI governance regime at both the regional and state levels. It is imperative to develop governance regimes that promote inclusivity. We stress inclusivity as particularly relevant for AI and data trustworthiness in Africa. The approach reflects and underscores the imperativeness of context-driven governance interventions that consider cultural diversity and socioeconomic realities. It also implies the responsibility of global north players to respect these governance frameworks in data collection and the use and production of AI technologies for the African market. African states must clearly articulate the social and cultural logic that embeds the country’s governance and who benefits from it. As noted by Wakunuma et al., the AI ecosystem is a “value-laden” one that encompasses a country’s ethical, legal, sociocultural, and technical principles. As such, any governance framework in Africa must set out a vivid path for the integration of sociocultural and legal values in specific AI domains (Wakunuma et al., Reference Wakunuma, Ogoh, Eke and Akintoye2022). The efforts toward inclusivity must be for African states to jettison governance assimilation, or what Vincent Obia describes as “regulatory annexation” wherein existing standards and legal frameworks that are representative of values from other domains are imported and replicated without proper context fine-tuning (Obia, Reference Obia2023).

2.2. Framing data governance imperatives for AI in Africa

While the term data governance has a broad or narrow connotation depending on the context, we focus on its meaning in the sense of States’ (including supranational bodies) contributory interventions through policies, standards, and procedures when data are used for AI technologies. These governance interventions include the use of both hard laws and flexible recourse like policies, regulations, strategies, and guidelines. Indeed, AI-based technologies are becoming increasingly integrated into the modern lives of many Africans (Baijnath, Butcher et al., Reference Baijnath and Butcher2021). In terms of policy making, there is a need to consider the ways by which such technologies impact the lives and rights of Africans: from the initial design of these technologies; to how they are trained; also, how they engage with data (especially the management, anonymization, gathering, transfer, and storage of data); and then how these technologies are ultimately used. These are the entry points for data policy intervention.

As noted earlier, data governance on both macro- and micro-levels has become a top priority for many African countries (Ndemo and Thegeya, Reference Ndemo and Thegeya2022). Data governance has become even more fundamental as several state initiatives are beginning to give attention to the use of AI and other technological tools that require the use of data for their development and application (Effoduh, Reference Effoduh2021). Although challenged by various technological and developmental limitations, some states are still demonstrating readiness for establishing responsible data policies to create a framework for the research, development, application, coordination, and regulation of AI systems: Nigeria, Ethiopia, Rwanda, South Africa, Egypt, Tunisia, Mauritius, Senegal, and Kenya are examples of countries that have committed to instituting appropriate and adequate frameworks on the use of data as a tool to advance technological advancement, job creation, economic growth, and improved governance, among other goals (One Trust Data Guidance, 2022).

3.1. An assessment of domestic strategic priorities, strengths, and weaknesses

First, as it relates to the use of AI, this assessment should also cover where the use or deployment of AI systems will be most effective and at the same time be most responsible across the country. If a country’s digital infrastructure is below capacity compared to its needs, then there is a need to focus on the creation of easily accessible and affordable digital infrastructure, such as a spectrum of networks, computers, and storage capabilities required for the safe and secure processing, storage, and sharing of data. The proposed digital infrastructure should provide the successful delivery of applications and services that are accessible to all populations across the country.

Second, as it relates to data, this assessment should consider what legal framework works best and how the protection of personal data, and the regulation of the processing of personal data, will be carried out. This data framework assessment could even include an appraisal of the range of data subjects’ rights and remedies for infringements that are already covered by existing law and marking where gaps lie. It could also consider if there are existing data regulatory bodies; if there is a need to coordinate their mandate and activities; or if there is a need to create one that can superintend over data protection and privacy issues and supervise data controllers and data processors within the private and public sectors. It is important to note that several African countries lack data centers, and this reduces the country’s competing power against Big-tech companies (Njanja, Reference Njanja2022). Therefore, an initial assessment and some strategic framings are a good starting point for a data governance policy for the inclusive use of AI.

3.2. A human-centric approach to data governance

Data are the fuel powering AI. Therefore, directives need to support a standardized set of data-protection rules and address ethical concerns around the collection, holding, and processing of citizens’ data. It is important to note that all data are in the past and is subject to change.

Furthermore, there needs to be the deliberate promotion of mutual trust between the AI institutions and the citizens who are the data subjects and deserve to know how their data are collected, stored, processed, shared, and potentially deleted. Data privacy frameworks are important to peg some of the threats linked to the use of AI. And so, data governance for the inclusive use of AI could impose limitations on the type of data that may be inferred, used, and shared. For example, children’s data should require special protection. The special protection accorded to children within the EU’s GDPR: Recital 38 notes that the use of a child’s data for marketing, creation of user profiles, or the collection of data when using services merits specific protection. The process of obtaining consent for children (and the validity of their consent is governed by Article 8 of the GDPR). Another example is UNICEF’s Policy Guidance on AI for Children (2021). Policy guidance explores AI and AI systems and considers how they impact children. It draws upon the Convention on the Rights of the Child to present three foundations for AI that upholds the rights of children. Both documents are instructive here.

Africans need to maintain control over their data. Individuals’ right to their data is grounded in concepts that are related to but distinct from ownership, including control, agency, privacy, autonomy, and human dignity. All these values are established under the African Union, ACHPR (1981). While some African countries have instituted some data guidelines that are progressive and commendable (Ghana, Kenya, Madagascar, Mauritius, Nigeria, Rwanda, South Africa, Togo, Uganda, and Zimbabwe are a few examples: McKenzie, Reference McKenzie2022), some of them are still insufficient in providing a robust and responsible foundation for data governance that will be accountable not only to the state but mostly to the citizens and publics as data subjects.

Data governance frameworks should be premised on human rights principles and should require periodic revisions. Comprehensive legislation that enforces a rights-centric data protection obligation for the benefit of citizens is generally required. Moreover, because the government is usually the largest data processor in a country, there needs to be an independent data ombudsman. Nigeria, for example, is proposing the establishment of a Data Protection Commission with enforceable powers, and a code of practice that ensures a rights-respecting data governance framework for the country (Nigeria Data Protection Act, 2023). No doubt multiple actors are involved in the overall management of data and are actively principal governance stakeholders. There is a need for a principled framework that emphasizes collaboration, honest dealing, and respect for data subjects’ rights by all actors. Although the proposal is not exhaustive, this is a step in the right direction. African states can help build empowered data communities, and a human-centric approach to data can help realize this. A human-centric approach to data governance should promote data processing practices that protect the security of personal data and the privacy of data subjects; it ensures that personal data are processed in a fair, lawful, and accountable manner; it minimizes the harmful effect of personal data misuse or abuse on data subjects and other victims; and promotes a beneficial, trusted use of personal data.

3.3. Data policy alignment with supranational rights-respecting AI standards

A report published by the Office of the United Nations High Commissioner for Human Rights in September 2021 outlines the human rights risks and implications of the widespread use of AI by governments and businesses alike, offering recommendations to mitigate these risks (United Nations Human Rights Council A/HRC/48/3, 2021). A moratorium was called on the use of AI technology that may pose a serious risk to human rights, such as the use of remote biometric recognition or real-time facial recognition technologies in public spaces.

Data policies must align with established human rights standards. Regional frameworks on rights-respecting data policies for AI are also significant as they could be relatively significant, especially in the African parlance. For example, the AU Convention on Cybersecurity and Personal Data Protection has established a normative framework that is consistent with the African legal, cultural, economic, and social environment to stress the protection of personal data and private life as this has become a major challenge in the Information Society for African states. The AU proposes data governance policies that will ensure a balance between the use of information and communication technologies and the protection of people’s privacy, while guaranteeing the free flow of valuable data. The AU also recommends cyber security befitting of the environment where data are collected, processed, transmitted, stored, and used (Malabo Convention, 2014).

Moreover, in February 2021, the African Commission on Human and Peoples’ Rights adopted a resolution on human rights, AI, and other new and emerging technologies in Africa. The resolution emphasizes the need for sufficient consideration of African norms, ethics, values, and communitarian ethos in the development of new data technological structures (ACHPR/Res. 473, 2021). The Commission calls on African States to ensure that the development and use of AI is compatible with African regional human rights norms and standards of human dignity, privacy, equality, nondiscrimination, inclusion, diversity, safety, fairness, transparency, accountability, and economic development. The Commission also resolved that all technologies that are imported from other continents into Africa should be made applicable to the African context and/or adjusted to fit the continent’s needs and peoples. AI systems to be used in Africa and for Africans should be trained on African data and if possible, developed with, and designed for Africans. There is also the need for reliable and consistent data interoperability with the potential for industry and/or sector-specific open standards, as well as safe and secure data portability, and data mobility (Open Government Partnership, 2021).

3.4. Concerns about the use of AI systems in some key sectors: law enforcement, criminal justice, immigration, and national security

As several AI systems are deployed as forecasting tools, some algorithms are used to analyze large quantities of data, including historic data, to assess risks and predict future trends. While these may seem cutting-edge, some human rights issues can emanate from both the use of such data and the reliance on such AI systems (Data Governance Institute, 2022). For example, predictive policing is a method of deploying law enforcement resources according to data-driven analytics that supposedly can predict perpetrators, victims, or locations of future crimes. Using historic and current crime data (including social media posts, communications data, etc.) can largely perpetuate racial and ethnic bias, discrimination, and inequality (Richardson et al., Reference Richardson, Schultz and Crawford2019). Such technology should not be used as a substitute for community engagement and holistic crime reduction measures.

Data governance regimes and AI use in high-risk sectors are gradually attracting normative standards that African countries should consider. The European dimension has been the classification of data-driven AI systems into tiers of risk level and has introduced mitigating strategies including a complete ban or stringent regulatory pre- and post-deployment conditions. AI systems of “unacceptable risk” that can infer sensitive characteristics like religious beliefs based on biometric data are banned. Indiscriminate web or CCTV data scraping of images, systems with manipulative capacity, or systems that lead to the exploitation of vulnerable people are also barred. High-risk systems used for sectors like law enforcement, migration, asylum and border control management, employment, and education come under rigorous regulatory mandates. (EU AI Act 2023).

African governance stakeholders must follow suit by going tough on indiscriminate data use and the deployment of AI systems in these sectors. Extant continental AI readiness challenges, such as a lack of robust datasets and governance frameworks, require higher precautionary measures. There may be a need to reshuffle risk triaging; the use of high-powered AI systems for law enforcement, education, and employment may as well be flagged as “unacceptable” until there is domestic data to accommodate their effective deployment. This is because any AI system that will be used to create profiles of people or identify people as likely to carry out terroristic activity, or even flag individuals due to travel history, race, culture, or religious affiliation, can be prejudicial and derogate from the constitutive standard of the presumption of innocence. Any AI system that claims to deduce people’s emotional or mental state from their facial expressions could be highly susceptible to bias, discrimination, and false interpretations. AI assessments by themselves should not be a basis for reasonable suspicion due to the probabilistic nature of the predictions. States should be critical about the extent to which AI systems can be relied on in certain public sectors or departments and should justify the choice of using such technology if deemed necessary.

3.5. Prioritizing the use of representative data, promoting local AI systems, and ensuring a transparent procurement process for AI systems from abroad

Data processing and its representativeness, harmonization, interoperability, accessibility, accuracy, and reusability should be encouraged, and with the informed consent of data providers.

Due to the diversity of people and communities within African countries, quality control measures should be implemented to ensure the representativeness of data from different population groups is taken into consideration. This is because the use of low-quality, limited, and nonrepresentative data in AI could perpetuate and deepen prejudices, causing AI systems to make biased inferences that could be harmful, especially to vulnerable and minority groups. The effectiveness of most AI systems depends on whether the datasets are representative of the populations in which the technology will be used.

However, generating more data from Africa without value to Africans could carry the risk of “data colonialism” whereby, the continent is seen as a data mine and such data are used without due respect for consent, privacy, or the autonomy of the people (Coleman, Reference Coleman2018). There is also the issue of power dissymmetry between the collectors of data and the individuals who are the sources. Most of the technological software used in many African countries is imported (Kwet, 2019). Several AI systems operating within Africa are adopted from outside the continent with some of them hosted from abroad. This means that AI systems may be more expensive for Africans. In the meantime, codesign strategies should be pursued by actors in Africa and abroad. Governance frameworks are required to guide such interactions, including storage of data, how it should be handled after usage, transfer to third parties, rights of data subjects, and so forth.

Moreover, if AI technologies are increasingly protected by exclusive rights, there is a wider question of whether they will be available, appropriate, and affordable in Africa. Local AI systems need to be promoted and prioritized, especially where they are needed for public purposes. However, as the government (and other institutions) are increasingly seeking to capture the opportunities offered by AI from other jurisdictions, there is a need to use procurement processes that focus not on prescribing a specific solution but rather on outlining problems and opportunities and allowing room for iteration. Conditions for a level playing field among AI solution providers should include the interoperability of AI solutions and the cogeneration of data between countries/regions. These would require open licensing terms, bilateral agreements, and transparency to avoid vendor lock-in. Also, the public benefit of using AI needs to be defined while also assessing its risks. The procurement process should focus on mechanisms of algorithmic accountability and transparency norms, with the opportunity for local knowledge transfer and long-term risk valuation.