In order to enjoy the potential benefits of creating a system like NIDS, the right safeguards must be in place. Digital ID is a new technology and the current NIRA bill doesn’t confront some of the most obvious and longer-term risks. These risks relate to the new capability that NIDS provides: to link many large databases filled with personal information together. This is called interoperability. The risks connected to interoperability are amplified by the fact that because NIDS will provide authentication of identity (See Position 6: Authentication and Verification), the system could track detailed information down to the time and place of every transaction connected to your ID. This information is called “metadata” relating to those transactions. The NIRA bill also leaves us guessing about which personal data are really needed in order to perform its core function of providing identification (See Position 2: Make Non-Essential Information Optional). That means that in order to use NIDS you might be required to give more information than is absolutely necessary to identify yourself and that information could be shared widely with other agencies and the private sector and that information could be connected with other data generated in real time, like your transactional metadata.

Up until now, the personal information collected by healthcare providers, the education system, social welfare agencies, and private sector entities like banks, was housed separately. What we don’t know yet is how connected this information will be once NIDS is fully operational, and how metadata on individual transactions will be handled. That’s because there are no provisions in the NIRA bill that address this central question around interoperability at all. Because the Data Protection Act is not yet in place, we cannot even rely on its protections and we have no way to judge if those protections are sufficient to remedy the risks. That’s why the government must fully implement the Data Protection Act before moving forward with the NIRA bill and the implementation of NIDS (See Position 3: Data Protection Act).

The best way for the government to address this concern is by conducting what is called an impact assessment, releasing the results to the public, and allowing for further consideration of the NIRA bill in light of the results. An impact assessment is a process that is done before a major information system like NIDS is ever built. The purpose of an impact assessment is to share detailed information about the design of the system, identify risks that it poses to individuals, communities and the public, and talk about how those risks can be addressed. These impact assessments are routinely conducted in other countries and are increasingly common when it comes to digital ID projects.