According to World Bank estimates, about 1.1 billion people lack formal identification. Digital identity and access systems can unlock a range of services for individuals, including financial inclusion, healthcare and education. Equally, they hold significant promise for helping refugees and displaced populations access services. On the other side, digital identity can become a way to discriminate against minorities and to further marginalize people that are already marginalized.
Achieving progress in the field of Digital Identity requires significant shared challenges to be overcome. In addition to coordination challenges such as interoperability, individuals and communities have voiced concerns about flaws and vulnerabilities in existing systems that need to be addressed. The recent Facebook scandal juts being the tip of the iceberg when it comes to what is being done with personal digital data.
At the What is the Good, Bad, and Ugly of Digital Identities? Technology Salon in London, we looked at how can we ensure that Digital Identity will improve access to services and improve democratic rights and it will not become yet another tool to further discriminate people that do not have access to technology or that will have much harder time in controlling who uses and how their information. Our discussion was guided by thought leaders including:
- Aneela Qureshi, Co-founder, Symmitree
- Seb Mhatre, Data Innovation Lead, Data For Development Team, DFID
- Yiannis Theodorou, Director of Policy & Regulatory Affairs, Digital Identity Programme, GSMA
Digital ID: What are we talking about?
When we talk about Digital Identity these days we immediately think about the Facebook scandal and all of the multiple ways in which we technically build an identity through the use of the Internet and social media.
The over-sharing of information and the inexistence of a real regulatory framework combined have created a new form of identity that, in addition to our institutional identity (date of birth; name, surname, etc) had added an extra layer of information that says who and what we like, our political inclination, what we eat and what we watch, etc.
But while this phenomena or this type of identity is “new”, the creation of digital systems for institutional identity have been under way for years in developed countries, and the technical infrastructure does exists that seems to be, so far, more or less able to handle securely the data, even if stealing digital IDs is still a pretty common crime – see here and here.
If, as stated in the Millennium development goal, by 2030, we want to provide legal identity for all, including birth registration, the creation of digital institutional ID systems for developing countries remains problematic for lack of technical knowledge, the technical infrastructure and the national regulatory framework.
Not to mention the fact that these systems and the infrastructure to support them cost a lot of money, and not all government have that kind of money to invest. But regardless of these risks, two big questions remain, being a digital system in a developed or developing country:
- Political system changes, and so does the political inclination to consider all citizens of one country all equal citizens in their rights to access services. Does the creation of digital IDs in fact preparing the field for possible abuses of the system from part of any institutional actor? Ultimately, if governments are the one that control and protect our Institutional IDs, who controls the controller?
- Is the push for “the right to have a legal ID” also another way to just create an extra barrier to access services and have human being’s rights recognized? Meaning, should the ultimate prove of my ID be the fact that I exists, and therefore I am, and have rights?
Digital Literacy and Informed Consent
It goes without question that the role of governments is in ensuring individuals, including refugees, in their territory are able to access a legal or foundational form of ID (whether paper based or digital). If improving democratic rights such as voting has to be tied to a Government-issued or approved (digital) ID, not one issued by a private sector entity based on one’s online presence for example, than what happens when there is no government?
In development and most often in humanitarian crisis, the creation of Institutional Digital Identities, to allow for aid and services to be provided, is often left to NGOs and UN agencies, due to the lack of any government issued ID in some places, or the fact that those are destroyed during a disaster or war. In this case, Digital ID becomes a way for aid workers to plan and deliver aid in a way that is responding to the actual needs.
Suddenly we have non-institutional actors collecting, storing and using digital ID information, acting as “the facto” governments. In these situations the ability of citizen/beneficiaries of aid to understand what and how their data is used is pivotal to the transparency and accountability of the system.
The broader discussion here is about what is consent and how we make it informed – but also, how do we protect people from an improper use of their information when the countries were we work do not have often any laws or regulations about data protection. And to be honest neither does the humanitarian community.
The Marginalized of the Marginalized
If, as GSMA advocates, “Digital identity and access systems can unlock a range of services for individuals, including financial inclusion, healthcare and education” can it also exclude them forever?
Looking for example at projects like this one, we cannot not wonder: is the creation of a ID that becomes the prerequisite to access services, also a way to marginalize even further these members of the community that do not have access to any digital means whatsoever?
If around 70% of the population in the world has access to a mobile phone, what about the remaining 30%? For example, many organizations give out direct financial assistance in emergencies to speed the recovery process. DFS are also used to make regular payments to crisis-affected population.
One interesting consideration for DFS is who has access to the mobile phone, but in many societies, the mobile phone is controlled by the men in a household, while the finances can be held by the women. Moving payments from cash to digital here can disrupt previous family norms, increasing household stress.
Merging Institutional ID with Social Media ID
The recent events with Facebook and Cambridge Analytica have shown that the creation of a Digital Identity by non-state actors is something that we were not ready to address. The amount of data that we willingly share on social media, the internet and over mobile phones, paired with our Institutional ID, made of our credit cards numbers, ID numbers, etc, are merging together to form a valuable set of data that has a high price.
On the social level, this is also intensified by the fact that little education and guideline exists that support the adoption of these tools by all citizens, in an informed and responsible way.
And while the creations of systems like the General Data Protection Regulation (GDPR) by the EU are a step towards the creation of more institutionalized guidelines that apply to everyone, the fact remains that we do share more and more information, that are contributing to create a permanent digital ID that can be sold, bought and used in very different ways.
How do we build trust?
Aside from the alarmism of “they are watching us” type of approach to the issue of Digital ID, the discussion about who has control versus who has access to ID information, which are arguably two different things, remains.
The creation of policies, legal and technical frameworks that respect the privacy of citizens and set out data protection standards is crucial to building trust in any identification system.
This is also a well articulated principle in the World Bank led ‘Principles on Identification for Sustainable Development’, the World Economic Forum’s ‘Principles on Public Private Cooperation in Humanitarian Payments’, the ‘Barcelona Principles for Digital Payments in Humanitarian Response’, UNHCR’s Data Protection Policy, WFP’s Guide to Personal Data Protection and Privacy and others.
But the problem is also a reverse one: according to GSMA, increasingly governments are requesting to access communications data from mobile providers for example, which pose a risk to consumers’ trust and perceptions of identity solutions. Regulators and policymakers need to promote transparency and proper lawful management of such government access requests, to engender trust in identity-linked mobile services.
Lots of questions, not many answers
There are still no doubts that Digital Identification can be a huge step towards the creation of a system where more people can access more services, including financial services, that can allow them to become independent and rebuild their lives. However, many questions remains, that will need to be addressed sooner than we think. For now, posing the right questions is probably the best shoot we have at finding the right answers.