A fresh wave of concern is sweeping across Nigeria’s digital governance community as experts warn that the proposed National Digital Economy and E-Governance Bill could jeopardise the security and stability of the country’s identity ecosystem.
Stakeholders say several provisions in the draft law may result in two different bodies becoming custodians of the national identity system, a development they describe as a “direct threat to Nigeria’s identity security architecture” with potentially far-reaching consequences.
The bill, which seeks to establish a broader governance framework for Nigeria’s digital sector, assigns sweeping regulatory authority to the Federal Ministry of Communications, Innovation and Digital Economy and its agency, the National Information Technology Development Agency.
Experts say these provisions appear to overlap directly with functions already assigned to the National Identity Management Commission under the NIMC Act 2007.
A major point of concern is Section 29 of the draft bill, which empowers the Ministry and NITDA to prescribe standards, architecture, and trust frameworks for digital identity systems in Nigeria.
Stakeholders argue that this function is already the exclusive responsibility of NIMC, the country’s legally recognised authority for foundational identity management.
“This is not a harmless technical clause. It changes who controls the backbone of Nigeria’s identity system,” a senior ICT governance consultant told our correspondent.
“The moment you have two different centres prescribing standards for identity, you have created confusion and weakened accountability.
“That is how identity systems get compromised,” experts say.
Another contentious provision is Section 35, which gives the Ministry and NITDA the power to set interoperability standards for government digital platforms, including areas explicitly linked to identity verification, authentication, and citizen data architecture.
Identity experts insist these core functions fall strictly within NIMC’s mandate and warn that delegating them elsewhere could damage the integrity of the national database.
“This goes to the heart of identity security,” a cybersecurity analyst working with a financial sector regulator said.
“Verification and authentication are the locks and keys of the identity system. If the locks and keys are being controlled from a different office than the one that owns the house, you have a security problem,” they noted.
Even more worrying to observers is Section 62 of the bill, which states that in cases where any existing law conflicts with the provisions of the bill on matters related to the digital economy, the new legislation will prevail.
Analysts warn that because identity systems have been classified as part of the digital economy within the proposed law, the clause has the potential to override the NIMC Act.
A constitutional lawyer who spoke on background described the clause as “a legal landmine buried in fine print.”
“In practical terms, Section 62 could place the Digital Economy Bill above the NIMC Act wherever identity touches the digital economy, which is almost everywhere,” the lawyer said.
“That means ministerial directives may end up trumping a carefully designed legal framework that was meant to insulate identity from political or bureaucratic interference.
“From a rule of law perspective, that is deeply problematic,” he added.
Concerns also surround Section 41, which outlines national digital public infrastructure and its components, such as identity layers, authentication rails, and data exchange systems.
The bill assigns supervisory powers to the Ministry and NITDA but makes no reference to NIMC, an omission that many stakeholders view as deliberate repositioning.
An expert in critical information infrastructure protection warned that such an approach risks treating identity as just another digital service.
“Identity is not simply an app or a platform.
“It is a core national asset. When you treat identity as ordinary digital infrastructure, you lower the threshold of protection around it.
That is when foreign actors, criminal networks, or even insiders find gaps to exploit,” he said.
Civil society organisations monitoring digital rights and data protection have also voiced worries.
A spokesperson for a coalition of digital rights groups said the bill, in its current form, could erode public trust in Nigeria’s identity system.
“Nigerians are already anxious about how their data is collected, stored, and used.
“If people sense that control of identity is shifting from a specialised commission to a more political space, it will deepen mistrust.
“Once trust is lost, even the best designed identity system will struggle to function,” he stressed.
Identity management professionals insist that identity systems cannot be governed like general ICT infrastructure because they carry national security implications, serve as the backbone of intelligence operations, and enable financial crime detection, border control, SIM registration integrity, social protection, and national planning.
Global precedents indicate that unclear institutional roles around identity systems often lead to crises.
India’s Aadhaar system and Kenya’s Huduma Namba project both faced prolonged legal and operational setbacks due to overlapping mandates between identity authorities and digital ministries.
In both cases, court challenges, public backlash, and inter agency disputes, delayed implementation and forced significant redesign.
Speaking on the issue, public policy analyst and development communication specialist, Dr Lemmy Ughegbe, described the risks as “too serious to ignore,” warning that the bill could quietly undermine the institutional foundation of Nigeria’s identity architecture if not carefully amended.
“Identity is the front door of national security. You do not create two custodians for the same front door.
“The National Assembly must ensure that this bill enhances Nigeria’s digital future without destabilising the one institution that holds the country’s foundational identity system,” he added.
Dr Ughegbe urged lawmakers to invite technical experts into the legislative process to avoid what he called “unintended and incalculable damage” to the identity infrastructure built under the leadership of NIMC’s Director General, Abisoye Coker Odusote.
He added: “NIMC was deliberately designed by law to be the single point of authority for foundational identity.
“If the National Assembly now creates a situation where standards, architecture, and authentication rules can be set elsewhere, then it is quietly rewriting the rules of identity governance without saying so openly.
“That is not reform. That is institutional displacement.”
Some policy analysts stress that the objective of modernising Nigeria’s digital ecosystem is legitimate, but caution that reforms must not come at the expense of institutional clarity.
“Digital transformation is important, but it must be built on solid governance foundations,” a member of a national data governance working group said.
“What Nigeria needs is coordination between NIMC, the Ministry, NITDA, NCC, and others, not overlapping mandates. When roles are blurred, responsibility is diluted. And when responsibility is diluted, security is weakened,” he added.
Stakeholders are therefore calling for the National Assembly to revisit the contentious clauses, harmonise the bill with the NIMC Act, and explicitly reaffirm NIMC’s exclusive mandate over foundational identity.
They propose that any provision touching on identity standards, verification, authentication, or identity layers should clearly state that such functions are to be carried out “in alignment with and under the authority of the National Identity Management Commission.”
As debate on the bill continues, observers warn that its passage without amendment could trigger institutional conflict, weaken Nigeria’s identity security posture, and create vulnerabilities in the national identity ecosystem at a time when digital security threats are rising globally.
“The risk is simple,” one expert concluded. “If Nigeria loses control or clarity around who truly controls identity, we may not immediately see the damage.
“But it will show up in fraud, manipulation, exclusion, and even national security breaches down the line. This is not a risk we can afford to take.”
