Legal identity

The World Bank estimates that approximately 1 billion persons lack official proof of identity¹, with these undocumented populations being disproportionately concentrated in sub-Saharan Africa and South Asia, and amongst marginalised and vulnerable communities within these regions in particular. This is often due to many such countries having weak legacy systems for civil registration, a history of political turbulence that has resulted in civil registration records being destroyed or misused, or the State excluding certain classes of persons on the basis of religion, refugee status, or sexual or gender identity.

Digital ID has been posited as a way to address this, by providing proof of identity by modernising existing identity infrastructure and addressing the lack of a foundation of trust and accountability between the government and its citizens. Digital ID promises to provide a reliable and trustworthy identity to all, help overcome barriers to political and economic participation, and provide access to entitlements.

It is important, however, to delineate our understanding of a “legal” identity from a “digital” identity. While a technological solution promises seemingly obvious benefits, particularly to countries with large undocumented populations and limited resources, it cannot itself address the underlying political and structural issues that have actually caused these gaps in identification (in fact, it poses the danger of escalating them instead). Moreover, the sensitive data collected and stored by digital ID systems raises concerns around privacy and surveillance, and a potentially adverse impact on civil liberties. Many national digital ID programmes have been observed to resort to the collection of biometrics and other unnecessary data points², which bring about their own security issues and fear of misuse. These result in databases that are potential targets for cyberattacks, amplify exclusions, or aid in the targeting of already vulnerable communities.

Therefore, it is critical to reconsider whether digital ID should be pushed as the first-line solution to these issues. It is crucial to allow for multiple forms of identification (including non-digital), particularly keeping in mind infrastructural, political and other factors that may prevent persons from enrolling for digital ID or successfully authenticating their identities, and the adverse outcomes that have arisen from being locked out of these systems or databases being misused.

National Population Registers and determination of citizenship

While the stated aim of many digital ID system is to include undocumented populations and provide them access to government entitlements, many countries have witnessed these systems being weaponised to determine citizenship, resulting in exclusion of stateless persons, or those who do not have access to the required citizenship documents.

In Kenya, a major concern raised by the Huduma Namba system was that evidence of citizenship would be tied to the new system, raising concerns among border communities, refugees and ethnic minorities who have not been able to obtain proof of citizenship due to systemic barriers in obtaining identification.³

In India, the controversial National Register of Citizens (NRC) and National Population Register (NPR) are built on existing Aadhaar infrastructure⁴ despite assurances to the contrary by the Ministry of Home Affairs.⁵ The forceful eviction of nearly 2 million persons who have resided in the border state of Assam for generations but did not have the required documentation⁶ is just one example of the adverse impacts of determining citizenship on this basis.

Welfare

The Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act was passed in 2016. The Supreme Court in its Aadhaar judgment held that the aim of the Act was legitimate, noting that it was “aimed at offering subsidies, benefits or services to the marginalised sections of the society for whom such welfare schemes have been formulated from time to time” and “the objective of the Act is to plug the leakages and ensure that the fruits of welfare schemes reach the targeted population, for whom such schemes are actually meant."⁷

The implementation of digital ID systems for this purpose is meant to increase inclusion and access to entitlements, while also tackling welfare fraud. However, making a digital ID the sole means of accessing basic services disregards the many barriers that hamper enrollment and authentication, and the difficulties in obtaining ID by persons for whom these welfare schemes are often intended. In the absence of alternative forms of identification, this has resulted in beneficiaries being locked out of basic entitlements.

The use of digital ID to tackle corruption in these systems has also been contested, on the basis that is assumes that the biggest source of corruption is through claims by people who don’t exist, or by people who have enrolled twice and therefore claim more than they are entitled to. Digital ID fails to address other major forms of fraud within welfare systems, such as quantity fraud.⁸ While estimates vary, one survey concluded that as much as 88% of ration cards that were deleted because they were not seeded with Aadhaar belonged to genuine non-ghost households.⁹ This highlights the high exclusion costs in pursuit of plugging leakages in welfare delivery systems.

Access and onboarding to private services

In addition to accessing public services, many digital ID systems are being adopted by private actors (including essential services such as banking and telecommunications) for purposes such as KYC and anti-money laundering. Digital ID is seen as a way to provide verification and authentication to a high degree of assurance, ensure uniqueness of each customer, and ensure that the customer provides individual consent, their privacy is protected, and they maintain complete control over their personal data. Industry estimates project that it could have the potential to help countries unlock a value equivalent to 3 to 13 percent of GDP by 2030.¹⁰

A survey of digital ID systems across 10 countries in Africa has found that most digital ID systems have few regulatory controls over access to data by private actors, allowing sensitive data to be accessed without any oversight.¹¹ In addition to this, there are concerns about digital ID being made mandatory to access these services.¹² Being locked out of accessing basic banking and telecom services denies persons the opportunity to participate meaningfully in the economy, since these are essential for their daily existence as well.

Voter fraud concerns

Attempts to combat voter fraud involve making voter ID requirements increasingly strict. However, this has been shown to disproportionately affect minority communities, often as a deliberate attempt to systematically exclude certain sections of the population from voting.

In India, almost 3 million voters had their names struck off electoral rolls in the state of Telangana in 2015 after ​​the then chief electoral officer of the state began linking Aadhaar data with election photo identity card (EPIC) or voter ID under the National Electoral Roll Purification and Authentication Programme (NERPAP), in order to weed out duplicate and bogus voters. This also highlighted that ​​the state government had collected sensitive data such as caste and religion under the State Resident Data Hub (SRDH), which is an Aadhaar-seeded repository of information consolidated from multiple government databases.¹³ Despite this, the Election Commission of India recently mooted a proposal to link Aadhaar records with voter IDs and faced widespread criticism on the grounds that this would actually cause mass disenfranchisement and increase voter fraud (with self-reported errors in Aadhaar higher than that in the voter ID database). The additional introduction of biometric authentication for voting would cause additional exclusions, and linking of these two databases would result in demographic information from Aadhaar being linked to the voter database, increasing the likelihood of voter profiling and violating the fundamental right to privacy. This is illustrative of the need to keep databases separate, and allow for different forms of ID for different purposes.

National security

Because of the high levels of assurance for identity verification and authentication that it claims to provide, digital ID has also been touted as a solution to address national security concerns - to prevent cyberattacks, ransomware attacks and identity fraud by adversaries.¹⁴

However, this requires a comprehensive regulatory and accountability framework to govern the use of personal data, strict identity checks at the time of enrollment, robust security features, and transparency in the role of foreign players in the ecosystem. Many of these conditions are often not met, resulting in digital IDs in many countries not being conclusive proof of identity, residence or citizenship. Moreover, data protection laws usually grant an exemption in cases of ‘national security’, but the term itself is often broadly or not at all defined in statutory law. This opens up major avenues for abuse of sensitive personal data in the absence of any oversight, accountability or means for recourse. As with all such surveillance and profiling in the name of national security, this will inevitably impact the fundamental freedoms of communities that are considered to be ‘threats’ by the State.

Handling COVID-19

The COVID-19 pandemic and the ensuing difficulties in claiming benefits, receiving vaccinations, the need for digital payment solutions and e-services, and the push for digital vaccine passports to resume international travel resulted in a worldwide push for various forms of digital ID.¹⁵

The shortage of vaccines faced by many countries in the global south was exacerbated by enrollment for vaccination programmes sometimes being completely digital, and often linked to possession of a national digital ID. This led to many sections of the population without documentation or access to the internet being denied access to vaccines in a critical situation that required as many people to be vaccinated as quickly as possible.

In India, despite Aadhaar not being mandatory in order to get vaccinated, many patients have complained that hospitals have rejected other official forms of identification and demanded Aadhaar for registration instead.¹⁶ India also witnessed many instances of patients in need of critical COVID care being denied admittance to hospitals in the absence of an Aadhaar card.¹⁷

Notes