The UN’s Legal Identity Task Force: Opportunities and Risks

Unlikely as it may seem, the UN institution that has one of the greatest potential to impact upon people’s rights around the world is now the UN Statistics Division. And why is that?

Last week, they had a crucial meeting where they endorsed the UN’s Legal Identity Agenda and the UN’s Legal Identity Task Force. The stakes could hardly be higher. One of the UN’s Sustainable Development Goals, SDG 16.9, states that “by 2030 provide legal identity for all including free birth registrations”. As has previously been observed by Privacy International, the interpretation of SDG 16.9 has been the subject of much debate. Rather than being purely about civil registration, it has been interpreted by some international bodies, governments, and the private sector to justify intrusive identification systems. The establishment of the UN’s Legal Identity Agenda and the Legal Identity Task Force begin to give a bit more clarity on these issues. However, the key question remains: Will we see them tackle issues of civil registration alone, or will their work justify the implementation of repressive ID systems that exclude, exploit and surveil?

Civil registration, for example the registration of births and deaths, has advantages for individuals, and there is no doubt that efforts must be made to strengthen civil registration systems. The problem is that we have seen this take a path that leads to systems that have major implications for people’s rights. For example, the interpretation of SDG 16.9 has long been used by powerful institutions and the private sector to justify the use of biometrics and similar technologies. Similarly, in the recent Huduma Namba case in the Kenyan court, the implementation of a giant and potentially exclusionary biometric ID system was justified by the government on the grounds of its necessity for improving civil registration systems. Thus we’ve seen how the clear need for civil registration has been distorted by governments, international bodies, and the private sector to serve their own ends.

The key aspect of UN’s Legal Identity Agenda is to “ensure a holistic and interoperable approach between civil registration, vital statistics production and identity management” . While there’s nothing inherently wrong with developing the capacity of states to implement civil registration systems, the model that they are proposing creates severe risks. We have seen protests in India over the development of a National Population Register in India and fears over the exclusion of Muslims, and its close links to the Aadhaar identity scheme. The Task Force praises the assigning of a unique identification number to everybody at birth: “assigning a unique identifier, most commonly referred to as a personal identification number (PIN) or unique identifier number (UNIN) to each individual upon birth and retiring it only after the individual’s death”

The very creation of this ‘unique identifier’ sets the foundation for and is the facilitator of surveillance, by giving the ability to link information on an individual from birth, through childhood and into adulthood. In addition to establishing a system of surveillance, linking these systems has almost unparalleled powers at different stages to exclude, to deny access to goods and services to particular individuals and groups. This can include groups that are historically marginalised, as we saw with the case in Kenya, as well as migrants.

If you build these capabilities of surveillance and exclusion into the civil registration system, it so closely integrates them into the functioning of the state that they may never be untangled. A key question to ask at this stage is: will the Task Force’s pursuit a single model for what these systems will look like lead to the overlooking of the already known abuses resulting from centralised identity systems, especially when these systems are designed with surveillance and exclusion at their core?

The Task Force seems to be cognisant of some of the risks to people’s rights that emerge from the implementation of identity systems. They are clear on the importance of comprehensive data protection regimes:

Since the collection, use, sharing, accessing, merging and otherwise processing of personal data in legal identity systems constitutes an interference with the right to privacy and other rights, States must demonstrate that each of these acts have a legitimate objective and are a necessary and proportionate means to achieve that objective. All Member States should adopt comprehensive data protection and privacy laws.

They are concerned with removing barriers to people, particularly from marginalised communities, in exercising their rights and accessing services. They are concerned about the spread of unique identifiers - like a single ID number that follows people for life - and the risks that this poses as they can “facilitate the linking of personal information across all databases that use these identifiers, allowing comprehensive profiling of the persons concerned” The conclusion of the Task Force is that the use of these identifiers by the private sector must be “Function creep, for instance into private sector use, should be avoided.”

We expect that each of these areas of concerns be reflected in the work of the Task Force. We expect them to recommend concrete steps to ensure the safeguards are in place. Some of the more troubling aspects of the Task Force’s approach, for example their failure to problematise the use of biometric credentials issued by identity management agencies, need to also be opened up to public scrutiny, if they are to meet the commitment of the Task Force to upholding and protecting human rights.

The Task Force will be conducting pilot studies of their approach in various countries: as of yet, they have not made public the identity of these countries, and we’d urge them to do so as soon as possible. In conducting these pilot studies, they must be aware that their recommendations have the potential to lead to the introduction of identity systems that have the potential to lead to human rights abuses and great harm. They have an opportunity to reflect on what has been done badly so far, by so many across the world, and what the lessons learned are so they develop guidance and present an approach to identity which empowers people and protects their rights. They must always remember differences between the civil registration and identity management systems: for example, the former can be mandatory, whereas courts have again and again found that biometric IDs are not. They must establish that their recommendations are purely surrounding civil registration systems, and must not be used to justify more intrusive or extensive identification systems. They must also use their skills and expertise to develop the civil registration and vital statistics infrastructure of the countries in question in a way which protects fundamental rights, and empowers and serves people. This way, and by being explicit in the dangers posed by this work, they can make the world a better place.

Finally, they must not forget the real experts, who combine the day-to-day work in communities with a deep knowledge of the problems related to identity that people face: civil society. Starting a meaningful, inclusive and open engagement with civil society organisations - on an international, national and local level - is perhaps the most powerful tool that the Task Force would have at its disposal in protecting the rights of individuals and communities.