Biometric Verification and the Ghana Card: L.I. 2523 Meets the Constitution
What the Regulations Do
The National Identity Register (Amendment) Regulations, 2026 (L.I. 2523), signed under Section 73(1) of the National Identity Register Act, 2008 (Act 750), mandate real-time biometric verification of the Ghana Card and prohibit the photocopying, scanning, or retention of the card for identification purposes. The National Identification Authority (NIA) announced the regime on 16 July 2026, with a compliance deadline of 2 November 2026 for banks, telecom operators, hospitals, and other institutions that currently rely on card impressions for verification.
The regulations are grounded in primary legislation, but the specific obligations—real-time biometric matching, penalties for non-compliance, and the technical integration requirements—are set out in subsidiary regulations signed by the Minister for the Interior. This distinction matters legally.
The Constitutional Question
Ghana's 1992 Constitution guarantees the right to privacy (Article 18) and protects personal dignity (Article 14(1)(c)). While the Constitution does not contain an express data-protection clause, the courts have recognised that the processing of personal information engages privacy protections. The Supreme Court retains jurisdiction to determine whether a legislative or quasi-legislative measure is compatible with these guarantees.
The central legal question is whether a regulatory instrument of this scope—imposing mandatory biometric matching on all institutions that verify identity—can be validly issued as subsidiary legislation under Section 73(1), or whether subject-matter of this constitutional significance requires primary parliamentary enactment. Regulations that create a new category of civic obligation, impose financial penalties, and restructure how public institutions interact with citizens arguably exceed the delegating scope of a section that was designed to permit procedural and administrative amendments.
A Fair but Critical Assessment
The problem the regulations address is real. The widespread photocopying of Ghana Cards has created a large, unsecured corpus of personal data that is vulnerable to alteration and misuse. Eliminating that practice is a legitimate governmental aim, and biometric verification at the point of use does reduce the attack surface for identity fraud.
Yet the critical question is not whether the aim is legitimate but whether the chosen instrument and its implementation architecture are constitutionally adequate. Three concerns stand out.
First, the concentration of biometric data in a single government-operated database (the Identity Verification System Platform) creates a single point of failure. If that database is breached, the compromise is not a set of photocopies that can be reissued but a biometric template that, unlike a password, cannot be changed. The dossier makes no mention of encryption standards, access-control protocols, independent audits, or breach-notification obligations attached to the platform. Without these safeguards, the regime trades one risk (data proliferation through copies) for another (centralised data concentration with untested security). The constitutionality of the measure may ultimately turn on whether such safeguards are demonstrably in place.
Second, the penalty structure cited in the regulations—fines measured in penalty units and potential suspension from the platform—arises from a subsidiary instrument. If a challenge succeeded on the ground that L.I. 2523 exceeds the delegated authority of Section 73(1), the penalties would be unenforceable, and institutions that had already incurred compliance costs would have no clear statutory remedy. The absence of a grand-fathering or transition-cost provision makes this a practical as well as a legal risk.
Access and accountability in practice
A verification rule should be assessed by what happens when it cannot be followed. If a person's biometric information cannot be captured or a system cannot connect, the applicable procedure should explain how identity can still be established and how an erroneous refusal can be corrected. The question is especially serious where identification is needed to obtain an essential service. These are policy and rights questions raised by the reported measure; they do not establish that any particular denial has already occurred.
The responsible authorities should publish accessible alternatives, limits on data retention, security safeguards and an effective complaint route. Independent scrutiny of the precise instrument and its implementation would help separate legitimate fraud prevention from unnecessary exclusion. A sound identification system succeeds when it is both reliable for institutions and usable by the people it is meant to serve.