ACLU urges hard questions on mDLs to protect digital ID privacy

The American Civil Liberties Union (ACLU) is warning of the potential dangers mobile driver’s license (mDL) adoption in America could have on privacy rights in a new report, ‘Identity Crisis: What digital driver’s licenses could mean for privacy, equity, and freedom.’

Mobile driver’s licenses could increase inequity by excluding people without smartphones, by being forced to use digital IDs rather than physical ones. A poorly constructed digital identity system would lead to a loss of privacy, ACLU points out, also noting that a well-constructed one could improve user privacy. mDLs could also lead to greater demand for ID checks and more data being included on them.

The announcement of the report then links to an article in which an Idemia representative talks about using an mDL to verify identity for tax returns and other documents, as evidence that proponents are proposing mDLs store those documents.

The ACLU also refers to the International Standards Organization’s (ISO’s) committee working to build technical specifications for mDLs as “secretive,” noting that its membership is not public information.
Introductory explanations are provided for how the role of ID in American society has changed, particularly post-9/11, and how digital ID works, as well as the possible advantages of mDLs and the current environment.

The organization recommends that police officers should be prohibited from asking people to hand over their mobile phones, that mDLs should provide granular control over the data they release, and that people should have the right to use physical identity documents, all of which are part of current mDL rollouts and plans, as described by Thales VP of Identity and Verification Steve Purdy in a recent Biometric Update guest post on the topic. mDLs should also prevent issuers and their contractors from creating records of their presentation, should not “phone home” or support remote revocation and instead should operate offline only, and that the apps should have transparent source code.

They should also have standardized provisioning to give people choice of compliant mDL apps, and their use in commercial contexts should be restricted, the ACLU writes.

Identity checks are more prominent in American life than in the past, the ACLU states, and while there are situations where identification is “a social need,” the “explicit political conversations and debates about our identity systems” have been lacking. Policymakers need to start asking the hard questions, according to the ACLU.

“There are undoubtedly occasions when people’s ability to obtain and use fake IDs have serious consequences. But how common are those situations? How bad are their consequences?” the report asks.

Fraudulent pandemic benefits payments under the CARES Act were estimated at $36 billion in January.

“Policymakers should seek objective data on just how important more-secure IDs are in terms of reducing fraud and other serious crimes,” the report concludes. “They should ask just how much of a difference mDLs will make if they remain optional, and what the consequences will be if they’re made mandatory. They should ask broad, far-sighted questions about the likely future evolution of such a system. If the goal is a broader system that can cover a variety of authentication needs, they should ask if this is the right vehicle. And if they decide to allow digital identity systems to move forward, they should insist that they be built with the strongest possible technological and legal privacy protections.”

Article Topics

ACLU  |  age verification  |  biometrics  |  data protection  |  digital identity  |  driver's license  |  identity document  |  mDL (mobile driver's license)  |  mobile app  |  privacy  |  smartphones  |  standards