Good digital ID needs great data protection

The rapid digitalization of our world is creating enormous opportunities to use personal data to empower people and promote inclusive growth more broadly. The COVID-19 pandemic has highlighted how digital platforms and systems—including digital ID—can improve the accessibility, efficiency and transparency of service delivery, and serve as a foundation for the digital economy.  However, now more than ever, it is essential that guardrails are in place to fully deliver on this promise, protect people’s data and build trust and confidence in the system.
 
Building inclusive and trusted digital ID systems therefore requires proactive measures to protect people’s data by design and by default. This includes legal and technical safeguards, as well as operational controls, to address risks related to data privacy and security. Data protection and privacy by design are core elements of a trust framework that ensures that data are accessed, processed, or shared by and with authorized users for pre-specified purposes that have been agreed in advance. Implementation should be governed by effective institutions, such as strong data protection commissions. 
 
The integrity, security and protection of data are therefore critical for advancing inclusive and trusted digital ID platforms through advocacy, research and technical assistance.  Data privacy and security is part of the DNA of each engagement which includes or leverages identification systems for development. Through the Identification for Development (ID4D) initiative, the World Bank Group supports countries to realize the promise of inclusive and trusted ID systems that embody its Principles on Identification for Sustainable Development.  Safeguards to protect the most vulnerable and build trust have been a core component of ID4D’s support for ID and civil registration systems.  For example: 

• In Nigeria, the Bank is supporting the Government to develop a comprehensive legal and regulatory framework for data protection and privacy, including the establishment of a data protection commission to enforce the provisions of the law. The Bank is also providing technical assistance for a revamped enrollment system with privacy by design at its core.   
• In Somalia, financial and technical assistance are supporting the establishment of the country’s first, digitized foundational ID system, in alignment with the Principles.  To underpin its inclusive and privacy-conscious approach to identification, Somalia is preparing new legislation on ID, data protection and cybersecurity to support its digital transformation, drawing on an ID Enabling Environment Assessment (IDEEA).   
• In the Philippines, the Bank is supporting the Philippines Statistics Authority (PSA) to identify and deploy privacy-enhancing technologies and privacy-by-design features as part of the new Philippines Identification System (PhilSys). Some key elements include data minimization for registration, consent and proportionality for personal data sharing, and pioneering the use of tokenization to protect and obfuscate the permanent PhilSys Number (PSN) including by not printing the PSN visibly on the card and generating tokens that would be stored by relying parties instead of the PSN itself. Leadership by and collaboration with the National Privacy Commission (NPC) has been instrumental.  

The emphasis on data protection, security and the integrity of digital systems generally is set to accelerate in the coming years. The upcoming World Development Report 2021: Data for Better Lives will put data protection principles at the center of efforts to develop the digital economy.  There is no question that data protection and security are essential for identification systems and digital platforms to deliver on their enormous transformative potential. They provide the foundational building blocks which build trust, expand coverage and participation, and empower people to gain access to social and economic opportunities.