The Digital ID Conundrum in South Asia
By Sarthak Satapathy and Sourav Panda
South Asian countries have been innovating and pioneering digital ID programs for over a decade. While India and Pakistan have been torchbearers for the same in the region and have issued digital IDs to most of their citizens, Sri Lanka and Bangladesh are in the process of rapidly setting up their biometric identity systems. McKinsey Global Institute report states that digital ID systems can add 6% growth to an emerging economy and 3% to an advanced economy’s GDP1. Key motivations for setting up these digital ID programs are that they help deliver public services efficiently to the right population and United Nation’s SDG 16.9 which advocates for a legal identity for all2.
Keeping the social benefits aside, it’s imperative that we are cognizant of the data security and privacy dangers that come along with them. Data security is primarily focused on preventing unauthorized access to data via breaches or leaks, while data privacy concerns itself with responsible use of data placing utmost importance on user consent.
India’s Ayushman Bharat Digital Mission (ABDM) which is issuing unique health IDs to citizens takes a technical architecture approach to secure both data privacy and security. The building blocks of ABDM follow a decentralized approach to storing data that prevents data security risks that a centralized approach faces. While this is an ideal solution on paper, it remains to be seen how all participants in this decentralized approach maintain sanctity of user data.
1 https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/digital-identification-a-key-to- inclusive-growth
2 https://unctad.org/meeting/digital-identity-new-era-data-protection
From a data privacy lens, user consent is at the core of ABDM. When another health facility or doctor or insurance company registered with ABDM wants to access a user’s historical health data, they are immediately notified to reject, accept, modify or revoke the request.
While these technical considerations provide a good starting point to strengthen the security and privacy of digital ID programs, political economy and legal frameworks play an important role in assessing and mitigating their risks.
As the Taliban took over Afghanistan in August 2021, it also came to light that they had seized US Military biometric devices3 and were trying to gain access to multiple databases in the country that hold various identification data points on millions of Afghan nationals. This was an attempt to target nationals who worked with the US and UK administrations in the country. In a widely reported incident in 2016, the Taliban used a fingerprint scanner to match against a local ID database to identify and kill 12 Afghan National Army service members 4.
It is increasingly becoming clearer that a political economy risk analysis needs to be a key design consideration while planning these biometric digital ID systems. Collecting minimal data as opposed to exhaustive data also needs to be deliberated on prioritizing individual safety over social benefits.
3 https://www.theguardian.com/global-development/2021/sep/07/the-taliban-are-showing-us-the-dangers-of
-personal-data-falling-into-the-wrong-hands
4 https://tolonews.com/afghanistan/taliban-used-biometric-system-during-kunduz-kidnapping
In India, there have been numerous breaches 5 with the Aadhar data similar to Pakistan’s National Database & Registration Authority (NADRA) that issues digital IDs6. While privacy is a constitutional right in Pakistan, the exemptions within the same weaken the legal framework.
Article 8 of the constitution does not apply7 to the armed forces in a country with a strong role of the military in its domestic politics.
Unique Identification Authority of India (UIDAI) also issued a recent alert to all Aadhar card holders to only share their Aadhar ID photocopies with UIDAI licensed organizations after there were cases of security breaches. They also highlighted that photocopies with masked IDs, displaying only the last four numbers should be used. This led to massive panic and pushback online that prompted UIDAI to take down the warnings, while stating that there’s adequate security of the data. Cases like these call for strict data protection laws that will help law enforcement take action against miscreants, and not just rely on warnings and policy measures8.
Robust legal frameworks not only create accountability among the stakeholders of the program but also creates the support of the judiciary for the citizens to fall back on, in cases of data breaches or invasion of privacy.
The emergence of digital ID programs in the South Asian countries has definitely led to improved service and program delivery, and in many ways has shown the world of the
5 https://www.tribuneindia.com/news/archive/nation/rs-500-10-minutesand-you-have-access-to-billion-aadh aar-details-523361
6 https://digitalrightsfoundation.pk/drf-condemns-yet-another-breach-of-nadra-database-and-demands-stron g-data-protection-legislation/
7 https://privacyinternational.org/state-privacy/1008/state-privacy-pakistan#dataprotection
8 https://timesofindia.indiatimes.com/india/india-withdraws-warning-on-aadhaar-card-after-online-panic/artic leshow/91868992.cms
Importance of digital IDs. However, the incidents of data breaches, targeting individual safety, and gross misuse of the data raises the urgency of establishing data protection legislation with clear accountability, reimagining technical architecture approaches, and factoring in political risks. It is time South Asian countries look at digital ID programs beyond the lens of inclusion and service delivery, while recreating a vision for the same.
(Sarthak Satapathy and Sourav Panda are continuing their post-graduate studies at the Fletcher School of Law and Diplomacy. Sarthak has a background in digital governance and development. Sourav's expertise is in the banking and investments sector.)
