Your Right to Know About How Your Information is Shared

Empower individuals to find out about “disclosures” of their data—meaning any time a person’s information in the ID database is shared with or accessed by a third party—at no cost.

Section 24 of the bill allows the Authority to disclose your identity information, but it does not grant you the right to know what disclosures have taken place, when, and to whom. This appears to contradict which grants everyone the right to access their own personal data and how it is being processed. Fixing this section of the bill is key to ensuring people’s rights are respected and preventing abuse of the database in the future.

What This Could Look Like in Real Life

01. Nadia’s identity has been stolen
02. Joel is being followed

Nadia has a real estate company that makes important financial transactions every month. From time to time, third parties that provide services to Nadia ask the Authority to disclose her personal information to them, including her biometric data. Nadia knows nothing about these requests.

One day Nadia gets a notification that her bank account is under investigation for fraud. She has always been very transparent and ordered with her transactions and it doesn’t make sense. Nadia knows that Authority can share her personal information with certain entities, so out of concern, she asks them for recent disclosures. The Authority refuses to answer her, which is allowed by the current draft of the NIDS bill.

Nadia went through a bureaucratic inferno to prove she is clear. While talking with the bank, Nadia realizes someone has used her personal data to impersonate her. Months later she learns one of her service providers had a leak of information, including her data, which the Authority gave without her knowledge. Knowing beforehand who had her information will have avoided months of investigation to Nadia.

Joel is a journalist who covers controversial issues, both from the public and private sector. Joel frequently visits different government institutions to gather information for the news he covers, and each location requires him to present his digital ID card to enter.

Recently Joel has noted that he is being followed, even if he changes his route. He suspects someone knows his route because of the digital ID track. Joel knows there are several actors that will be interested in profiling his behavior, so he asks the Authority if they have shared his information recently, but according to the current draft of the NIDS bill, the Authority is not obligated to give him an answer.

Without knowing who has requested his data, Joel doesn't know who to point out in case something happens to him, nor he can report it to the police or in the news he covers.

Details

Section 24 of the bill allows the authority to disclose your identity information (all the data about you stored in the national databases) in three situations: (1) you requested it, (2) a judge decides that the information should be disclosed to the police, and (3) as provided by other laws or by the act. The problem is that section 24 does not grant you the right to know what disclosures have taken place, when, and to whom, and this goes against the Data Protection Act.

The new Data Protection Act gives everyone the right to ask how their personal data is being processed and must receive an answer, especially when the person shared their information voluntarily based on a promise of utmost confidentiality. To achieve real data rights and data protection the NIDS bill needs to harmonize with the Data Protection Act.

What can be done? The bill should include a provision that gives individuals the right to access information about any disclosures at no cost. That way you will be able to verify how the disclosure that you requested happened, if your identity information was disclosed to parties to whom you never gave consent (this can help to identify cases of identity theft and fraud), and you will have the means to challenge the unconsented disclosure.

Recommendations

Establish a right to know when, how, and to whom the Authority has disclosed a person’s information. This right of access should be free of charge.
Establish an obligation to notify the individual prior to the disclosure, and grant the individual the right to reply unless a judge decided the contrary.
Establish transparency reports, indicating the category of the involved entities (police, private sector…), how disclosures were managed (how many requests were honored, disputed…), and the circumstances of the disclosure (who requested/ordered it).

Status: Pending

Watch this space! We will provide an update once the Joint Select Committee has made a decision on this issue.

Last updated 2021-05-27

Talk Up!

If this issue matters to you, talk about it. Share this page (and your questions or suggestions) with friends or government representatives.

Comments, Questions?

Is there something we overlooked with this issue?
Have questions? Let us know!