For proper and secure data management, the Authority should be independent, shielded from political influence, and respond to a politically neutral oversight body.
The Authority will enroll people, verify their identity, issue an ID card, and authenticate your identity. It has a lot of power in the management of sensitive information. Right now, the bill proposes that the Authority goes under a parent Ministry, but a Commission of Parliament or other independent body will be more neutral and safe.
These are examples of what the NIDS Bill allows. These examples may not necessarily reflect the intention of the Bill, but are possible based on how the Bill was worded when it was tabled in 2020.
A company is interested in getting access to the authentication logs showing where people have used their NIDS cards. The Authority is not yet processing this data or providing access to it as a service to the public.
The company goes over the Authority decision, and without its knowledge, it approaches the Minister responsible for NIRA and proposes ideas and technical advice on "national security" based on the authentication logs, that could be valuable to the government and private sector, although in a big scale it will mean immanent surveillance.
Under Section 27 of the bill, the Minister can give directives on what policies the Authority should implement. The Authority could be pressured to process transactional data in new ways, such as creating profiles based on the use of the national ID cards. This data could be anonymized and sold without the knowledge of individuals.
The bill creates an Authority that will manage the identification databases. This means it will enroll people, verify their identity, issue an ID card, and then, when requested, authenticate their identity. It gives the Authority great power over the management of sensitive information, and if the system were ever misused, the consequences could be severe.
Establishing the Authority within a Ministry directable by a politician (as proposed in the bill) is a critical weakness and a vulnerability easy to exploit. The risks of having an Authority that can be influenced by political decisions include tracking of people’s lives, biometric mass surveillance, targeting of users at risk (activists, opposition leaders, journalists), or simply use of the system for political and commercial agendas.
Jamaica has had issues of corruption, and the NIDS proposal has been politically polarizing. Protecting the Authority from these risks will not only safeguard its integrity but minimize the degree to which its operations shift with the ever-changing political tides. The Authority’s operations should be like its legal identification services: consistent, reliable, neutral, independent, safe, and beyond speculation.
The Authority should instead be an independent body — for example, a Commission of Parliament — shielded from political influence. It should be established in a way that prevents political actors from influencing or modifying its operations without law reform through Parliament.
Jamaica has previously implemented independent bodies for other areas with great success, like the Office of the Public Defender and the Integrity Commission.
Watch this space! We will provide an update once the Joint Select Committee has made a decision on this issue.
Last updated 2021-05-27
Is there something we overlooked with this issue?
Have questions? Let us know!
NIDS Focus is a coalition of civil society groups and individuals collaborating with the GOJ to develop a rights-based, people-centric national ID project. Learn more
We would love to hear from you.
© NIDS Focus Coalition 2021