The Sustainable Development Goals, Identity, and Privacy: Does their implementation risk human rights?
The Sustainable Development Goals (SDGs) are the United Nations-led initiative to define the development agenda. Building on the eight Millennium Development Goals, the SDG’s 17 goals – and the 169 targets – serve as an opportunity to tackle many of the most pressing issues in the world today. The SDGs are also explicitly grounded in human rights. Goal 16 on “peace, justice, and sustainable institutions” aims to “Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable and inclusive institutions at all levels.” Within this is Goal 16.9, on identity: “By 2030, provide legal identity for all, including birth registration”.
Identity is massively important – the ability to prove who we are can be a provider of security and can form an important part of our ability to exercise our fundamental rights. This is particularly clear when looking at cases like those of stateless people, who often lack documentation to establish who they are, leaving them open to discrimination and abuse.
However, there are dangers with the design and introduction of ID systems, particularly in the way they are currently being designed as large, singular, nation-wide ID projects. If actors fail to consider the risks, ID systems can themselves threaten human rights, particularly the right to privacy. They can become tools for surveillance by the state and the private sector; they can exclude, rather than include.
There are thus risks in the implementation of an ID scheme – not only that it fails to meet the promise of SDG 16.9, but that it also builds a system for surveillance and exclusion. It is thus essential to critically engage with the interpretation of the goal, and the uses to which it has been put. Only then can we meet the true opportunity that this SDG brings, and the empowerment it could bring to billions of people.
Interpreting SDG 16.9
The challenge in interpreting SDG 16.9 is that there is no clear definition as to what “legal identity” means. This creates a ‘gap’ – a level of ambiguity about the intention of the goal – and thus what it would mean for the goal to be successfully met. However, each of the targets for the SDGs has an indicator – a more concrete measure of the success of the goals. The current indicator for SDG 16.9 is purely about birth registration – “the proportion of children under 5 years old whose births have been registered with a civil authority”. Other indicators have been proposed, including one based on the possession of a credential for ‘legal identity’, as seen on this World Bank blog.
Having a strong system of birth registration is not the measure to ensure that individuals have a strong way of proving who they are – for example, birth registration may not be enough for the existing millions of adults whose birth was not registered when they were young. Similarly, it is essential that the design of a system protects stateless persons, as well as those who have entered a state after their birth, including refugees. Yet the issue that is left ambiguous by the current wording of SDG 16.9 is this: for an individual, is having a birth registration sufficient - or necessary and sufficient – for them to have a “legal identity”?
However, this ambiguity in the definition has not prevented SDG 16.9 from having a large impact. The benefits of SDG 16.9 have been described as extending far beyond the issues immediately surrounding identity: from social protection (SDG 1.3) to women’s empowerment (SDG 5a and 5b); from combating epidemics (SDG 3.3) to reducing remittance costs (SDG 10c). The World Bank argues that SDG16.9 is “key to attainment of many other SDG goals”. They identify three overarching impacts of an identity system in the context of development: inclusion and access to services; effective administration of public services; and to measure “development progress”.
Perhaps more than any other single SDG, a sweeping range of initiatives have emerged from SGD 16.9 – or, rather, have stated it as part of the justification for their existence. This includes the World Bank’s Identification for Development (ID4D) initiative, which has attracted support from philanthropic funders The Omidyar Network and the Bill and Melinda Gates Foundation. ID2020 is an alliance between governments, NGOs, and the private sector. The GSMA – the industry trade body for telcos – has emphasised the role of SDG 16.9 in their own work on digital identities. And the World Identity Network argues that it is only through the use of technologies such as blockchain that this goal will be met. The private sector, too, has a role; from the big biometrics firms through to start-ups like AID:Tech with their blockchain-based technology.
So, what does this vast mixture of industry bodies, development players, and major donors want from SDG 16.9? The scope of what they are after goes far beyond that presented in the SDG itself – “legal identity for all, including birth registration” – to more complex forms of digital identities, and singular ID systems for the entire population. The World Bank has been pushing for digital identity systems for some time. In their 2016 World Development Report, they stated that the best way to achieve SDG 16.9 “is through digital identity (digital ID) systems, central registries storing personal data in digital form and credentials that rely on digital, rather than physical, mechanisms to authenticate the identity of their holder.” This claim was made despite the fact that, in the same report, they admit that the evidence of the impact of Digital ID remains “largely anecdotal”. For the areas in which they do suggest digital ID are of benefit, these have all been brought into question through the work of PI and its partners (election integrity and detecting civil service ghost workers). This World Bank report is also the source of the contentious claim that the Aadhar biometric digital ID in India would result in savings of $11 billion a year in subsidies, which has been oft-cited by the Indian government but the evidence base for which remains contentious.
Critiquing ID systems
It has to be remembered that the claim made for identity systems is not just that providing an identity for all can reach these goals (which can also be questioned). It is a claim that a single identity system can reach these goals. Such systems raise a lot of concerns.
The challenge of this push towards ID is that, while an individual having access to the ability to prove their identity may very well be of benefit, it does not follow that a particular ID system is of benefit to either the human rights or the development of a population. The recognition of the dangers of ID systems have been growing. Dr Mariana Dahan was formerly of the World Bank’s ID4D programme and was one of the co-authors of the section on digital identity in the 2016 World Bank report cited above. For all the support that ID4D has directed towards the Aadhaar programme, Dahan’s position appears to be very different. In describing Aadhaar in a 2018 Ted Talk she noted: “But then something terrible happened, something unplanned. In a stream of high-profile security and privacy breaches…. the world realised that we are on the cusp of something critical for our humanity. The risks of creation of an Orwellian system became too obvious to be ignored.”
An ID system can become a mechanism used for government surveillance and control, often with limited safeguards. Our research has shown that the fears of the growing scope of ID, including when tied to biometric technologies such as facial recognition, can give governments the potential for unprecedented control and monitoring over populations. We see the scope of ID systems grow and change, as systems originally used for one purpose begin to be used for others. For example, research on the NADRA biometric database in Pakistan showed its use extending into projects utilising facial recognition CCTV cameras. These ID schemes are utilised by the private sector, too. Using a single ID number across data sets is a powerful tool to link together different data sources: what is referred to as the “360 degree” view of people. In other words, knowing more and more about people, potentially without their knowledge as to the nature of the datasets being used, or how the interaction of these different data sources can be revealing.
These concerns have not gone ignored by the development community. For example, the World Bank has developed its Principles on Identification for Sustainable Development: Towards the Digital Age. This presents a step forward on some issues – through recognising that ID systems are capable of presenting a serious risk of harm that needs to be addressed in the design of the system and making sure that the choices of technology are appropriate for the country in which a system is being introduced. However, the position of the principles means that it is ultimately limited in the protections that can be provided. The stated goal of the principles is based on the creation of an ID system that meets the needs of a broad range of stakeholders, including government and the private sector. That creates some inherent problems.
One of these problems is that of exclusion. There is an inherent idea within much of the development literature that ID is required for the enjoyment of rights and government services, for example healthcare and education. The difficulty here is that it is always the case that exclusion from the system is, in practice, an inevitability. All systems can exclude – whether it’s the farmer whose fingerprints have worn down, the person in borderlands whose residence is questioned, or the child of migrants who has no documents to their name. Furthermore, as ID becomes required for more and more services and actions, being excluded from an ID system means that an individual is excluded from the overall ‘system’ and therefore denied a vast array of government and private sector services - and even citizenship itself. A bureaucratic slip – let alone systematic exclusion – presents an escalating challenge in the case of a singular ID system.
One of the reasons that an ID system excludes is that the purposes are so diffuse that they stand in opposition to each other. For example, if the goal is to gather statistics to aid development interventions (such as to combat child mortality under SDG 3.2), then it is essential to gather these statistics as broadly as possible across the population, and in particular those who may be in a more vulnerable position in society. However, this runs into a problem if the very same ID system also has the goal of fighting corruption (for example, to aid SDG 16.5 on the reduction of corruption and bribery). Designing a system to aid in that would probably, by necessity, require a higher level of proof for enrolment. The systems have very different needs and would be designed and implemented very differently. Meeting the diffuse needs, within a single system, seems an insurmountable challenge.
Moreover, the reality of the introduction of ID systems could be seen as going against the spirit of Goal 16 – of building “effective, accountable and inclusive institutions”. As an ID system is essentially a very large, nation-wide, expensive infrastructure project – touching upon every citizen in the country – it is particularly important that the decision-making process surrounding the introduction of this system is lawful and transparent. We have seen all over the world that ID systems are introduced by decree, or without the debate that we would expect from the rule of law in these contexts. Can we say that the decision-making process in these cases amounts to “responsive, inclusive, participatory and representative decision-making”, as called for in SDG 16.7?
Towards a positive future for identity and SDG 16.9
The Sustainable Development Goals should give us the opportunity for radical change: they present the possibility that, with concerted effort, the most pressing developmental needs of our time can be tackled. This included identity. However, the current emphasis of that approach is misguided. By building an ID system, the barriers are reinforced: either formally or through more subtle forms of “function creep”- the presence of ID means that ID is made a prerequisite for more and more things. And this means that those who are not able to get an ID are further excluded from the system.
Rather than the risks of exclusion, and the other privacy concerns of singular ID systems, it is essential to interrogate the other ways in which these problems can be solved. Key to this will be birth registration. Yet, while birth registration is the only form of identification specifically mentioned in SDG 16.9, in the initiatives that have emerged from the goal seem to have barely considered it. Rather, they are concerned about other technologies: the likes of national ID cards, biometrics, and more exotic and untested technologies like blockchain.
“Identity” is an important part of all our lives and having the ability to prove who we are is empowering. Having control over our identity can help not only achieve the necessities of life, but also more fundamental concerns of dignity and autonomy. Implementing SDG 16.9 could be done in a way that does not risk this. Yet, if the push is towards greater implementation of some centralised, unique, insecure, one-size-fits-all identity systems which fail to consider the individual, their needs and rights, it can prove to be the opposite. ID systems can lead to surveillance, tracking and profiling by states and private companies; they can exclude rather than include; they can limit opportunities and become a tool for control and repression. Without proper consideration, SDG 16.9 could lead to a move against not only the broader Goal 16 for peaceful and sustainable societies, but also be damaging for human rights, and ultimately harm the very people it was intended to help.
