Benin E-Government and AI: Keeping Citizen Data Sovereign

In Benin today, you can request an identification certificate, a criminal record extract or many other official documents without queuing at a counter. Behind these online services sit millions of records about citizens: names, dates of birth, personal identification numbers, addresses, family situations.

As generative AI arrives in government offices and among their contractors, a simple question comes up. What happens to this data when a civil servant or a consultant pastes it into ChatGPT to save time? For a country that has built its digital state with care, this is a matter of sovereignty as much as compliance.

A digital state built step by step

Benin has made clear choices over several years. The national public services portal, service-public.bj, was launched in 2020 as a single entry point to administrative procedures. It relies on a secure data exchange platform between government bodies, developed with Estonia's e-Governance Academy and the company Cybernetica.

In 2022, the government merged several bodies into the Agence des systèmes d'information et du numérique (ASIN), which runs many of these projects. The same year, the national identification agency, ANIP, issued more than one million personal identification certificates online in less than a year. In 2023, the Council of Ministers adopted the National Strategy for Artificial Intelligence and Big Data (SNIAM) for 2023 to 2027.

Citizen data as a national asset

A digital state concentrates highly sensitive data. The personal identification number (NPI) links a person to their civil status, their social rights and sometimes their access to credit. Tax, health and education databases say a great deal about people's lives.

This data was collected for specific purposes under Law No. 2017-20 on the Digital Code, amended in 2020. Book V of the code governs its processing, and the Personal Data Protection Authority (APDP) enforces it. We covered these rules in our AI checklist for companies in Benin.

The principle is clear: data collected to issue an official document should not end up, unchecked, on the servers of an AI provider outside the country.

Where AI creates risk in public services

Tempting use cases are everywhere, and most are well meant:

• a civil servant summarising a pile of citizen complaints with a consumer AI assistant;

• an IT contractor pasting a database extract into an AI tool to fix a query;

• a communications officer drafting a personal reply to a citizen, including their name and NPI;

• a consultant analysing a table of social programme beneficiaries for a report.

In each case, personal data leaves the controlled environment of the administration. The Digital Code requires safeguards approved by the APDP for transfers to countries without adequate protection. A copy and paste into a chatbot comes with none of these safeguards.

Sovereignty beyond the slogans

Digital sovereignty is not only about hosting servers on national soil. It means knowing where data goes, who can access it and under which legal framework. A country can invest in national data centres and still lose control of its information through a few everyday habits.

European debates on this topic are useful, even if the context differs. We summarised them in our article on sovereign AI from the European CISO's view. For the region, we also published an overview of AI and data protection in West Africa.

For Benin, the takeaway is practical: AI can serve the administration, provided citizen data stays under control.

Practical measures for agencies and contractors

Here is what public bodies and the companies working for them can put in place:

1. A written rule. Which data must never go into an external AI tool: NPI, health data, civil status data, tax data.

2. Approved tools. Offer a validated solution rather than banning everything, otherwise staff switch to their phones.

3. Automatic anonymisation. Replace names and identifiers with fictitious values before sending, keeping the format. We explain the method in format preserving anonymization.

4. Contract clauses. Public IT contracts should spell out how the contractor may use AI.

5. Traceability. Keep a log of incidents so you can answer the APDP or an auditor.

What contractors need to anticipate

Integrators, software vendors and consulting firms supporting the state's digital transformation are on the front line. They handle real data during migrations, testing and support. They also rely heavily on coding and writing assistants.

A typical example: a developer has to fix a bug in the application module of an online service. To move faster, he copies real records, with names and NPIs, into a coding assistant. The bug is found in five minutes, but the data has left the country without anyone noticing.

Showing that they control these data flows is becoming an argument in public tenders. Conversely, an incident involving citizen data can cost a contract, on top of the fines set by the Digital Code.

Summary

Benin has built a solid digital state, with a single portal, a secure data exchange platform and an AI strategy. The citizen data flowing through these systems is a shared asset. Protecting it from generative AI takes simple rules, approved tools and a control at the moment the data leaves the screen.

ZeusLock detects and anonymises personal data before it reaches an AI assistant, and keeps a record of every incident. Book a ZeusLock demo to protect your users' data.