A small plastic card may soon become one of the most consequential documents carried by millions of West Africans.

The ECOWAS National Biometric Identity Card, ENBIC, is designed to make movement across the region easier, replace the old travel certificate and provide a more secure means of establishing identity. But beneath the promise of seamless travel lies a question that deserves far more public attention:

When a citizen submits fingerprints, facial images, biographical information and other identity details for an ECOWAS biometric card, who ultimately controls that information?

And, perhaps more importantly, where does the International Organization for Migration (IOM) fit into a system that involves the collection, verification, sharing and potentially cross-border use of some of the most sensitive information a person possesses?

These are not merely technological questions. They are questions of sovereignty, privacy, accountability and citizens’ rights.

A regional identity project with national fingerprints

ENBIC is not simply another identity card.

ECOWAS says the card was established pursuant to Decision A/DEC/01/12/14 and is intended to facilitate free movement, serve as proof of identity and residence, and increasingly function as a travel document. The regional body says the card can also support services such as national identification, financial services and e-commerce.

In Nigeria, the ENBIC application platform is operated through the Nigeria Immigration Service. The official portal invites Nigerian citizens to apply, reissue cards, correct information, track applications and book appointments.

That immediately raises an important distinction.

ENBIC may be a regional instrument, but the biometric information collected from a Nigerian citizen does not automatically become the property of a regional organisation—or of an international organisation involved in supporting the programme.

Indeed, Nigeria’s own data-protection framework places obligations on organisations that determine the purposes and means of processing personal information.

The Nigeria Immigration Service’s privacy policy identifies NIS as the data controller for its digital services and expressly includes facial images and fingerprints among the personal information it may collect.

That is significant.

It means that the public conversation should move beyond the simplistic question of “Who owns ENBIC?”

The more useful questions are:

Who is the data controller? Who is the processor? Where is the database hosted? Who can access it? Under what law? For what purpose? For how long? Can it be transferred outside Nigeria? And who can order its disclosure?

Those questions become particularly important when identity systems cross national boundaries.

IOM is involved—but involvement is not ownership

IOM’s participation in ENBIC is not new.

ECOWAS documented IOM’s involvement in the initiative as far back as 2016, when the organisation supported member states by examining opportunities and challenges associated with rolling out a national biometric identity card for ECOWAS countries.

In 2019, ECOWAS also said IOM supported an advocacy and sensitisation campaign on ENBIC in Nigeria, Benin and Togo. The exercise involved border officials, transporters and communities and was presented as part of efforts to improve free movement, border management and the fight against trafficking.

More recently, in September 2026, ECOWAS and IOM again engaged the Nigerian media on the ENBIC initiative, explaining its anticipated contribution to mobility, identity verification and border management.

But there is an important distinction that should not be lost in the public debate:

Supporting, advising, sensitising or providing technical assistance does not, by itself, establish ownership of citizens’ biometric information.

Publicly available ECOWAS and Nigerian documents reviewed for this story do not establish that IOM owns the ENBIC database.

What they do establish is that IOM has had a role in supporting aspects of the broader biometric identity and migration-management agenda.

That distinction is crucial because allegations that an international organisation “owns” citizens’ biometric data require evidence of legal ownership or data-controller status—not simply evidence of participation in a programme.

But who controls the information once borders disappear?

This is where the ENBIC debate becomes more complicated.

A biometric identity card is valuable precisely because different authorities can trust the identity attached to it.

ECOWAS is pursuing interoperability between national foundational identification systems and ENBIC. In February 2026, the regional body said its roadmap work was intended to establish pathways from national foundational ID systems to ENBIC and clarify the functions of stakeholders involved in planning, designing, developing, deploying, operating and managing the card throughout its life cycle.

Interoperability brings obvious benefits.

A traveller should not have to prove identity repeatedly at every border.

But interoperability also creates a governance challenge:

The more systems communicate, the more important it becomes to know exactly what information is being exchanged.

A border official may need to know that a person is who they claim to be.

That does not necessarily mean the official needs unrestricted access to the person’s entire identity record.

The difference between identity verification and identity surveillance is therefore one that policymakers cannot afford to ignore.

Biometrics are not ordinary data

A lost password can be changed.

A compromised fingerprint cannot.

A person can obtain a new passport number.

They cannot obtain a new set of fingerprints.

They cannot simply replace the face they were born with.

That is why biometric databases require a higher level of scrutiny.

IOM’s own 2026 publication on biometrics and identity management acknowledges the potential benefits of biometric systems while identifying risks involving privacy, discrimination, accountability, security, interoperability, “function creep” and misuse. It recommends attention to legal frameworks, data-protection impact assessments, cybersecurity, oversight and redress mechanisms.

The warning about function creep is particularly relevant.

A system created to facilitate travel could potentially acquire additional functions over time.

Today, ENBIC may primarily answer:

“Who is this traveller?”

Tomorrow, policymakers could be tempted to ask:

“Where has this person travelled?”

Or:

“Which government services has this person accessed?”

Or:

“Which security databases should this identity be compared against?”

Some of those uses may be lawful or legitimate under particular circumstances.

But the central principle remains:

A new use of biometric data should not simply be assumed because the technology makes it possible.

What does ECOWAS law say?

West Africa is not without data-protection rules.

The ECOWAS Supplementary Act on Personal Data Protection establishes principles governing the processing and transfer of personal data.

Among other provisions, it requires information about the identity of the data controller and the purposes for which information is being processed, and places conditions around transfers of personal data to countries outside ECOWAS.

ECOWAS has also acknowledged that its existing regional data-protection framework requires updating. In November 2024, experts from member states and national data-protection authorities met to validate a revised Supplementary Act designed to respond to changes in the digital environment.

That development is revealing.

Technology has moved rapidly.

Regional governance is trying to catch up.

And ENBIC sits directly in that gap.

Nigeria has its own privacy obligations

Nigeria’s Data Protection Act 2023 provides another layer of protection.

The Nigeria Data Protection Commission says the law regulates the processing of personal data, protects data subjects’ rights and establishes an independent regulator responsible for supervising data controllers and processors.

The NDPC also lists rights including the right to be informed, access personal information, seek rectification, object to processing, restrict processing and report concerns to the supervisory authority.

This creates an important accountability chain for ENBIC in Nigeria.

If NIS is collecting the information, citizens should be able to understand:

what information is collected;

why each category is collected;

who determines the purposes of processing;

which organisations process the information on behalf of NIS;

whether information is transferred outside Nigeria;

how long the information is retained;

who can access it;

how breaches are reported;

and what remedies are available to citizens.

The NIS privacy policy states that personal information may be shared with government agencies, security services, service providers, international immigration or border authorities where legally required, and law-enforcement agencies responding to valid requests or legal processes. It also says transfers outside Nigeria may occur where necessary for service provision or international cooperation, subject to legal and security safeguards.

For an ordinary citizen, however, “where legally required” should not end the conversation.

The next question should be:

Which law, which authority and which procedure?

The unanswered IOM questions

IOM’s involvement therefore deserves scrutiny—not because participation proves ownership, but because international organisations operating around identity systems can occupy influential positions in programme design, technical assistance, migration management and border governance.

The public deserves clarity on several issues.

1. Does IOM have any access to ENBIC biometric records?

If yes, what categories of information can it access?

Is the access direct or through another institution?

Is the access temporary, permanent or project-specific?

2. Is IOM a data controller, joint controller, processor or simply a programme-support organisation?

These are not interchangeable descriptions.

Each can carry different legal responsibilities.

3. Where is the data stored?

Is Nigerian ENBIC data physically hosted in Nigeria?

Is any component hosted elsewhere?

Who operates the servers?

Who holds encryption keys?

4. Can data move between ECOWAS countries?

If yes, what information is exchanged during border verification?

Does the receiving authority obtain the complete biometric record, a verification response, or only limited identity information?

5. What happens when an international partner leaves a project?

Does it retain copies?

Are those copies destroyed?

Who independently verifies deletion?

6. What happens after a data breach?

Who must notify affected citizens?

Which regulator investigates?

Which institution pays for remediation?

And can a citizen obtain compensation?

These questions are not accusations.

They are basic governance questions for any regional biometric system.

The sovereignty question

There is also a deeper issue.

Biometric identity systems are increasingly becoming part of the infrastructure through which governments understand their populations.

Whoever controls the infrastructure does not necessarily “own” the people—but can acquire significant power over how people are identified, verified and permitted to move.

That is why data governance should be treated as part of national and regional sovereignty.

Nigeria’s immigration authorities are already emphasising cybersecurity, data privacy and protection of critical information infrastructure as part of their digital transformation agenda.

The same principle should apply to regional identity infrastructure.

If ENBIC is to become a trusted regional credential, citizens need more than assurances that the card is secure.

They need to know who is accountable when something goes wrong.

The danger of confusing integration with unrestricted data sharing

There is a seductive logic behind digital integration:

One region.

One identity standard.

One interoperable system.

But regional integration does not have to mean unlimited information sharing.

A well-designed system can allow a border officer to verify that a traveller is legitimate without exposing every piece of information contained in that person’s identity profile.

This is where data minimisation becomes important.

Collect only what is necessary.

Use it only for clearly defined purposes.

Give access only to those who need it.

Keep it only as long as necessary.

And create an auditable trail showing who accessed what information and why.

These safeguards become even more important because the ECOWAS vision for ENBIC is broader than merely producing a plastic card. The Commission says the card is increasingly being developed as an instrument capable of supporting identification and other services beyond border travel.

The broader the system becomes, the greater the need for clearly defined boundaries.

A card is not the real story

The real story is the database behind the card.

The traveller sees a photograph, name, card number and security features.

Behind that card could sit fingerprints, facial information, biographical records and links to other identity systems.

That invisible infrastructure is where the real power lies.

And that is why the central question surrounding ENBIC should not simply be:

“Will this card make travelling across West Africa easier?”

It probably can.

The more difficult question is:

“Can West Africa build a regional identity system that makes movement easier without making citizens’ most sensitive information vulnerable to unnecessary access, indefinite retention or uncontrolled secondary use?”

That is the test that matters.

What IOM’s role should mean—and what it should not mean

IOM’s long-standing involvement in ENBIC and related identity-management discussions makes the organisation an important stakeholder in understanding the project’s development. But the available evidence does not establish that IOM owns Nigerian citizens’ ENBIC biometric data. ECOWAS and Nigerian authorities remain central actors in the system’s institutional and operational architecture.

That distinction should be preserved.

At the same time, international involvement should never be treated as a substitute for public accountability.

If IOM provides technical assistance, the public should be able to know the boundaries of that assistance.

If it processes information, the legal basis should be clear.

If it has no access to biometric databases, that should be clearly stated.

If it does have access, citizens deserve to know under what safeguards.

And if it does not control the data, the institutions that do should be clearly identified.

The questions West Africa cannot afford to postpone

ENBIC promises to make borders less cumbersome.

But digital borders can become invisible in another sense: citizens may never see the databases through which they are being identified.

That is precisely why transparency must precede convenience.

The ECOWAS Commission has acknowledged that the implementation of ENBIC requires clear institutional arrangements, legal considerations, infrastructure, risk management and coordination among stakeholders.

Those arrangements should be visible to the people whose identities are being digitised.

West Africans should not have to discover after a breach, a misuse or a disputed border decision who had access to their information.

They should know before handing over their fingerprints.

The fundamental principle is simple:

The citizen may carry the card, but the real power lies with whoever controls the data behind it.

And as West Africa moves toward increasingly interconnected identity systems, the question of who controls that power—and who can hold them accountable—must become part of the ENBIC conversation.

L’Organisation internationale pour les migrations (OIM) indique avoir aidé plus de 81 000 migrants à retourner dans leur pays d’origine ou dans des pays où ils avaient légalement le droit de séjourner en 2025, dans le cadre de ses programmes d’aide au retour volontaire et à la réintégration (AVRR).

Ce chiffre concerne les personnes qui ont expressément sollicité l’aide de l’OIM et ne doit pas être interprété comme représentant le nombre total de migrants retournés dans le monde, a précisé l’organisation.

L’OIM a expliqué que son travail en matière de retour des migrants s’effectue par deux voies distinctes : l’AVRR, qui est initié par les migrants qui choisissent de rentrer, et l’assistance après l’arrivée destinée aux personnes ayant été renvoyées dans le cadre d’opérations menées par des gouvernements ou d’autres acteurs.

Dans le cadre de l’AVRR, les migrants prennent eux-mêmes la décision de retourner dans leur pays et sollicitent l’aide de l’OIM. L’organisation affirme qu’elle n’initie pas les retours et ne procède pas aux expulsions.

Avant de fournir une assistance, l’OIM mène des séances de conseil individuelles afin d’informer les migrants sur les options qui s’offrent à eux et sur le soutien qu’elle peut leur apporter. Les personnes qui décident de poursuivre la procédure donnent leur consentement par écrit et peuvent se retirer du processus sans conséquences.

L’aide peut comprendre l’organisation du voyage et les dispositions logistiques, l’assistance pour l’obtention de documents d’identité et de voyage, l’identification des vulnérabilités, l’évaluation individuelle des besoins ainsi qu’une assistance spécialisée destinée aux personnes en situation de vulnérabilité, notamment les enfants non accompagnés, les victimes de traite des personnes et les personnes ayant des besoins médicaux.

L’OIM fournit également une assistance après l’arrivée et à la réintégration, destinée, selon elle, à favoriser l’autonomie économique, le bien-être psychosocial et la stabilité sociale.

En 2025, l’agence indique avoir aidé plus de 81 000 personnes à retourner depuis 115 pays dans le cadre de l’AVRR et avoir fourni un soutien à la réintégration à plus de 82 000 personnes dans 147 pays d’origine.

L’organisation souligne que l’AVRR est distinct du processus d’expulsion ou de renvoi forcé, qui relève des gouvernements.

Assistance après une expulsion

L’OIM indique que son rôle est différent lorsque les gouvernements procèdent à des expulsions ou à d’autres formes de renvoi forcé.

Dans de tels cas, le gouvernement du pays d’accueil peut demander à l’OIM de fournir une assistance aux personnes après leur arrivée. L’organisation précise qu’elle ne mène pas les opérations de renvoi, ne participe pas aux décisions d’expulsion, ne négocie pas les accords bilatéraux de renvoi et ne détermine pas le cadre juridique régissant ces opérations.

Son intervention ne commence qu’après l’arrivée des personnes et uniquement à la demande de l’État d’accueil.

Lorsque des migrants sont renvoyés dans leur pays d’origine, l’OIM peut fournir des soins de santé, des services de conseil, un contrôle des besoins en matière de protection, des services essentiels et un soutien à la réintégration, sous réserve d’une évaluation indépendante de la protection.

Cette évaluation vise à vérifier que la personne a été officiellement admise, que ses droits et sa dignité peuvent être protégés, que les conditions permettent à l’OIM d’intervenir et qu’un consentement véritable peut être obtenu.

L’OIM affirme qu’elle ne fournira pas d’assistance lorsque ces garanties ne peuvent être respectées.

Renvois vers des pays tiers

L’organisation distingue également les situations dans lesquelles des migrants sont renvoyés vers un pays autre que leur pays d’origine.

Ces transferts peuvent avoir lieu dans le cadre d’accords entre États. L’OIM précise qu’elle ne négocie ni n’approuve ces accords et ne participe pas directement aux transferts.

Lorsqu’un gouvernement d’accueil demande son assistance, l’OIM peut fournir des soins de santé, des services de conseil et un contrôle des besoins en matière de protection, sous réserve des mêmes garanties que celles appliquées aux retours vers les pays d’origine.

Les migrants présents dans un pays tiers qui décident par la suite de retourner volontairement dans leur pays d’origine peuvent demander l’aide de l’OIM dans le cadre de ses procédures habituelles d’AVRR.

L’organisation indique qu’elle évalue notamment les garanties relatives au statut légal, à la liberté de circulation et à l’accès à la protection internationale avant d’accepter d’intervenir. Lorsque ces conditions ne peuvent être garanties, elle peut refuser son intervention ou limiter l’assistance fournie.

L’OIM affirme qu’elle ne force pas les personnes à retourner dans leur pays, ne procède pas aux expulsions ou aux renvois forcés, ne négocie ni n’approuve les accords bilatéraux de renvoi et ne fournit pas d’assistance lorsque son intervention pourrait contribuer au refoulement, à la discrimination ou à des violations des garanties procédurales.

Environ 800 personnes aidées après des renvois des États-Unis vers des pays tiers

L’OIM indique que des informations publiques font état de dizaines de milliers de personnes renvoyées des États-Unis vers des pays tiers entre le début de 2025 et septembre 2026.

Cependant, l’organisation précise que son implication dans ces cas est restée limitée, car elle ne peut intervenir que lorsqu’elle est sollicitée par le gouvernement du pays d’accueil et lorsque les garanties de protection qu’elle exige sont réunies.

En septembre 2026, l’OIM indique avoir apporté son soutien à environ 800 personnes dans ce contexte, en leur fournissant des soins de santé, des services de conseil et un contrôle des besoins en matière de protection. Environ 300 de ces personnes ont ensuite choisi de retourner volontairement dans leur pays d’origine.

Selon l’organisation, l’écart entre les quelque 800 personnes qu’elle a assistées et les dizaines de milliers de personnes qui auraient été renvoyées s’explique par le nombre limité de gouvernements ayant demandé le soutien de l’OIM ainsi que par les cas dans lesquels les conditions nécessaires à son intervention n’étaient pas réunies.

The International Organization for Migration (IOM) says it helped more than 81,000 migrants return to their countries of origin or places where they had the legal right to stay in 2025, through its Assisted Voluntary Return and Reintegration (AVRR) programmes.

The figure covers people who specifically sought IOM’s assistance and should not be interpreted as the total number of migrants returned globally, the organisation said.

IOM explained that its work on migrant returns operates through two distinct channels: AVRR, which is initiated by migrants who choose to return, and post-arrival assistance for people who have been returned through operations conducted by governments or other actors.

Under AVRR, migrants make the decision to return and request IOM’s assistance. The organisation said it does not initiate returns or enforce deportations.

Before assistance is provided, IOM conducts individual counselling to give migrants information about their available options and the support it can provide. Those who decide to proceed give written consent and can withdraw from the process without consequences.

Support can include travel and logistical arrangements, assistance with obtaining identity and travel documents, vulnerability screening, individual needs assessments and specialised assistance for people in vulnerable situations, including unaccompanied children, trafficking victims and people with health needs.

IOM also provides post-arrival and reintegration assistance, which it said is aimed at supporting economic self-sufficiency, psychosocial wellbeing and social stability.

In 2025, the agency said it assisted more than 81,000 people to return from 115 countries through AVRR and supported more than 82,000 people with reintegration across 147 countries of origin.

The organisation stressed that AVRR is separate from deportation or forced removal, which are carried out by governments.

Assistance after deportation

IOM said its role is different when governments conduct deportations or other forms of enforced removal.

In such cases, the receiving government may ask IOM to provide assistance to people after they arrive. The organisation said it does not operate the removals, participate in decisions to deport individuals, negotiate bilateral removal agreements or determine the legal framework governing the operations.

Its involvement begins only after arrival and only when requested by the receiving state.

Where migrants are returned to their countries of origin, IOM may provide healthcare, counselling, protection screening, essential services and reintegration support, subject to an independent protection assessment.

The assessment is intended to establish that the person has been formally admitted, that their rights and dignity can be protected, that conditions allow IOM to operate and that meaningful consent can be obtained.

IOM said it will not provide assistance where those safeguards cannot be met.

Third-country removals

The organisation also distinguishes cases in which migrants are removed to a country other than their country of origin.

Such transfers can occur under agreements between states. IOM said it does not negotiate or endorse such agreements and does not participate in the transfers themselves.

Where a receiving government requests assistance, IOM may provide healthcare, counselling and protection screening, subject to the same safeguards applied to returns to countries of origin.

Migrants in a third country who subsequently decide to return voluntarily to their country of origin can request IOM assistance under its standard AVRR procedures.

The organisation said it assesses safeguards such as legal stay arrangements, freedom of movement and access to international protection before agreeing to intervene. Where these conditions cannot be secured, it may decline involvement or limit the assistance provided.

IOM said it does not force people to return, conduct deportations or forced removals, negotiate or endorse bilateral removal agreements, or provide assistance where its involvement could contribute to refoulement, discrimination or violations of procedural safeguards.

About 800 people assisted after US third-country removals

IOM said public reporting indicated that tens of thousands of people were removed from the United States to third countries between the beginning of 2025 and September 2026.

However, the organisation said its involvement in such cases has remained limited because it can only assist when requested by the receiving government and when its required protection safeguards are in place.

As of September 2026, IOM said it had supported roughly 800 people in this context, providing healthcare, counselling and protection screening. About 300 of those people later chose to return voluntarily to their countries of origin.

The organisation said the disparity between the roughly 800 people it assisted and the tens of thousands reportedly removed reflects the limited number of governments that requested IOM’s support and cases in which the conditions required for its involvement were not met.