Digital identity should protect privacy

The Ministry of Technology announced this week that Sri Lanka will soon introduce a ‘Unitary Digital Identity’ framework with financial and technical assistance from India. According to the Ministry of Technology, the new framework is expected to introduce a personal identity verification device based on biometric data, a digital tool that can represent the identities of individuals in cyberspace, and the identification of the individual identities that can be accurately verified in digital and physical environments by combining the two devices. 

The technology transfer from India is expected to emulate the Aadhaar card in that country. This 12-digit unique identity number can be obtained voluntarily by citizens of India based on their biometric and demographic data. The data is collected by a statutory authority established in 2009 following the provisions of the Aadhaar (targeted delivery of financial and other subsidies, benefits and services) Act of 2016. Aadhaar is the subject of several rulings by the Supreme Court of India concerning its voluntary nature, ensuring that the government of India cannot deny any services for those who do not voluntarily obtain the digital card. 

In 2017 the Indian Supreme Court delivered a landmark verdict affirming the right to privacy as a fundamental right, overruling previous judgments on the issue. A five-judge constitutional bench heard various cases relating to the validity of Aadhaar on various grounds including privacy, surveillance, and exclusion from welfare benefits. The Indian Court also stipulated that the Aadhaar card is not mandatory for opening bank accounts, getting a mobile number, or being admitted to a school.

As the Indian experience shows, even in a country with an independent and activist judiciary many checks and balances are required to ensure that there is no abuse of the digital and biometric information of citizens. Sri Lanka does not have such a judiciary with a history of checking abuses by the executive branch. On the contrary the Sri Lankan state has a long history of abuse of private and individualised data of citizens. From using electoral lists to identify ethnic Tamils during the 1983 pogrom to the police recently obtaining phone records of several journalists even without a court order, the Sri Lankan State has weaponised such data and information of its citizens without concern for the legality, ethics or 

due process.

In this light, the digitisation of identities of the citizens with the collection of bio biometric data which can include fingerprints, iris of the eye and possibly digital facial recognition should be a 

cautious exercise.

Even in advanced democracies where such digital identification methods are used by governments, there have been serious concerns regarding privacy. Such technologies have been and continue to be used in developed countries to identify terror suspects and criminals. Close Circuit Television or CCTV cameras placed in public places use face recognition software to identify individuals of interest to law enforcement authorities. Due to the highly invasive nature of such surveillance, there has been a push back against the arbitrary use of these technologies.

While advancements in technology are most welcomed and Sri Lanka surely needs to embrace such advancements, it is absolutely imperative that necessary policy, legal and procedural safeguards are put in place before implementation of such a project. There should be clear legislation on this matter, as passed in India in 2016. A mere executive decision would not provide the necessary legal framework to handle numerous problems that may come up in 

the future.

The digital ID will no doubt make lives better for the general masses and definitely advance the ease of doing business. However, it must make sure that there is little room for abuse by the State of the most private information of its citizens and the project must be carried out in a manner that wins the confidence of the general public.