No Decision About ID Should be Made in Secret, Fast

By Thea Anderson and Abiah Weaver, Omidyar Network

Earlier this month, the Kenyan government released the first draft of proposed legislation that would update the core aspects of the National Integrated Identity Management System (NIIMS). The Huduma Namba Bill 2019 gets its name from the government service number that, with biometric data, would uniquely identify everyone residing in Kenya, if the bill passes.

The proposed law takes several positions that are concerning, and in the last week, several local legal groups have taken steps to elevate them and propose interventions. In addition to the substance, the process by which this bill is being introduced and considered is worrisome.

Public consultation is required under Kenya’s Constitution. In this instance, the government has limited the public comment period to 18 days. According to this process, interested parties have the opportunity to officially raise questions and concerns via a one-time, public forum on 31 July in Nairobi or to email and mail comments by 5 August. We believe this is a grossly inadequate form of public consultation for a system that would collect sensitive data on the entire population and replace existing systems.

When approaching major policy changes, especially those linked so intrinsically to human rights as identity and privacy, the government should leverage its democratic framework and lead a robust, transparent, inclusive, and accountable consultation process.

This is in the best interest of the government in that:

• it can provide officials with multiple forums to share their perspectives with the public;
• the public can gain access to the leaders and information they would require to fully understand and trust any changes;
• the public and community organizations can share ideas to improve the system and suggest alternatives while still in the concept phase, which is always less expensive to implement and speeds up adoption during rollout; and
• this process can supply the government with complete and real-time feedback on its assumptions, including the underlying belief that digital IDs, as conceived, are the best solution.

An ID system can actually increase in value to the government and its partners the more responsive it is to the public’s needs.

At a minimum, we believe the Kenyan government should postpone the advancement of this bill (and Huduma Namba registration) until after:

• the legislature has approved and funded a robust data protection law; and
• the High Court has heard all pending complaints on NIIMS and determines the appropriate design and use of national ID in Kenya.

If not, people’s data is at extreme vulnerability for mistakes, misuse, and loss. Any technology can be introduced without any proof of efficacy. And power asymmetries and distrust will likely persist. Only through transparent, inclusive, accountable and continuous engagement with the public and sincere attempts to respond to feedback will NIIMS stand a chance of achieving the Good ID standard.

Ideally, the consultation process for the Huduma Namba Bill 2019 and all major digital identity system decisions would expand to include the government:

1. Releasing a consultation paper widely and hosting public dialogues that explain the issues to be addressed with NIIMS, the government’s goals and objectives, their legal basis, potential governance and technology options, and a cost-benefit analysis;
2. Widely encouraging the public to submit comments and counter-comments, in various formats, for a minimum of 60–90 days and publishing all of the comments;
3. Introducing the draft policy authorizing the ID system and sharing it widely with an explanatory memorandum that provides responses to all of the public’s comments up to this point;
4. Hosting several, live-streamed public consultations and open-house discussions on the proposed bill, accommodating various languages, schedules, locations, physical abilities, and other needs, before the lawmakers debate and decide on the policy; and
5. Repeating the process for all drafts of the bill, and ultimately, releasing the final policy widely with an explanatory memorandum that provides responses to all of the public’s comments up to this point.

For each of these phases, the government should plan to reach and engage the entire population, even those temporarily residing outside of the country. Providing information in multiple languages, various formats, in all communities, via repeated conversations, and over an extended timeline lead to the best outcomes. The government must also offer the public protection against retribution for expressing their opinions.

Kenya’s diverse civil society organizations have a special role to play in this process. They have a unique ability to represent the public’s interests in this type of process and hold governments and businesses accountable for good policy, technology, and practice. They bring evidence and experience to the debate. They have seen outcomes of poorly-designed systems, and people struggle to secure identification. They have also witnessed a generation exponentially empowered by safe, trusted, and useful forms of identification.

Other experts, including from the private sector and other countries’ governments, can also aid Kenya in bringing more transparency, accountability, privacy, inclusion, user value, user control, and security to the national ID system. These groups have access to research, open-source technology embedded with privacy and user control, and operational guides oriented to the Identification Principles for Sustainable Development. Independent technology policy advisors can also help the government understand the risks and establish important checks and balances in ID systems via privacy impact assessments of the system and robust data protection legislation.

All stakeholders should be prepared as the consultation process may raise questions and concerns about the system’s overall value, aggregation of data in a centralized database, reliance on biometrics and smart cards, and the compulsory nature of the Huduma Namba. This is an important debate, and it should be leveraged to find solutions that offer value to individuals, industry, and the government, even if that means not introducing a digital ID and/or replacing the existing systems.

No one should have to surrender their human rights for a digital identity. Identification should be a force for good. Whether digital or analog, ID should enable greater access to valuable services for more people and trust between people and institutions. It should strengthen societies and economies. That potential is hampered, though, when the process for designing, introducing, and implementing identification is cloaked in secrecy, made too quickly or out of sequence, and separated from the will of the people. We believe that all decisions about ID should be made openly, with prudence, and inside a legal framework that protects people’s rights.

Huduma Namba should not be the “single source of truth”; people should. When their right to question decisions, shape their future, and protect their identity is constrained, it ultimately erodes democracy and the institutions that keep our societies safe, fair, and free. Digital identity is the vehicle Africa has chosen for inclusion and development, and therefore individual empowerment, agency, and control must be the focus of any new policy, technology, and practice — and the processes that define them.

This will not be the last decision Kenyans make about digital identity, and everyone involved has the opportunity to help improve the process going forward.

Specifically, as the deadline for comments on the Huduma Namba Bill 2019 approaches:

• The public and civil society organizations should take the opportunity evaluate the bill and participate in the consultative process by asking questions, raising concerns, and offering concrete suggestions for improvement or alternative pathways.
• The elected officials should also take this opportunity to share the choices and decisions about NIIMS that have been made along the way as well as to remain open to alternatives plus more transparency and dialogue.
• The technology providers who are involved in the project should also introduce themselves, explain their approaches to privacy and security, and help the government design in response to the public’s feedback.
• The NIIMS project teams can also build trust by following the High Court’s guidance issued in April to work within the current legal framework, extend the process, make Huduma Namba voluntary, prevent further data sharing, and be more inclusive.

Most importantly, the government should embrace the public, civil society, industry, and other stakeholders as key allies. Not as critics to be placated, but as agents of their own identities and constituents to empower.