Data security rules needed for Nepalese digital ID, Nigeria’s World Bank funding

A similar lack of data protection rules in Nepal and Nigeria could limit citizens’ confidence in the national digital ID systems, and in the latter case even hold up funding from international development partners.

The World Bank and other institutions backing Nigeria’s ID4D Project have made the passage of data protection laws a condition for releasing funds previously committed. A data protection bill is currently making its way through Nigeria’s legislative system.

Cybersecurity experts have called on the government of Nepal to put in place a specific regulatory framework for personal data protection and make it an integral part of the national digital ID scheme currently being implemented in the landlocked South Asian nation.

The experts, according to The Kathmandu Post, have also suggested the need for routine IT security auditing of the data management system and for government to increase its spending on data protection measures to gain more citizen confidence in the ID system which rolled out in 2018.

Authorities at Nepal’s Department of National ID and Civil Registration say they have already collected the biometric data of nine million citizens for the digital ID project, of a population of around 30 million, and the data collected is in safe hands.

However, concerns still linger especially as the country is reported to have a history of data safety issues, with many government websites allegedly hacked in the past few years, putting sensitive personal and official data in potential danger.

Rajib Subba, former deputy inspector general of Nepal Police and information and a security expert, says despite the large amounts of data being collected, there is no corresponding effort to ensure the data is safe and secure.

While underlining the importance of collecting the data, Subba alludes to the case of India where the Aadhaar biometric ID system has been accused of many data breaches putting the personal data of millions of people at risk.

Bijay Limbu, another cybersecurity expert tells The Post there are no “proper guidelines” by the Nepalese government to handle data, and that it seems not to have learnt any lessons from the Aadhaar situation in neighboring India.

“If we are not judicious, Nepal may face problems bigger than India is now facing. India is in trouble as its government failed to anticipate all the glitches that could arise while distributing Aadhaar cards,” says Limbu.

Other experts have also blamed the government for not carrying out campaigns to raise awareness on the importance of data security and how citizens can help in keeping their data safe.

“The government should run campaigns to make people aware of the security vulnerabilities and ways to protect their private data,” says Prabin Subedi, an IT law expert quoted by The Kathmandu Post.

The national digital ID became compulsory in Nepal in 2020 following the introduction of biometric passports, but there are a number of challenges standing in the way of the ID issuance process, including difficulties in obtaining citizenship papers. Four million are said to be without a citizenship card.

Funds for Nigeria conditional

The conditions for the release of funding to Nigeria’s government set by the World Bank, the French Development Agency and the European Investment Bank were revealed by Nigeria Digital Identification for Development Project Coordinator Solomon Odole and reported by Punch.

The World Bank and development partners committed $433 million (1.5 trillion Naira) to support Nigeria’s National Identity Number project in 2019. Punch reports the World Bank’s contribution is $115 million, while the French development agency is putting in $100 million and the European Investment Bank has committed $215 million.

“The data protection law or enactment is a disbursement condition of the project,” Odole says. “It simply means we cannot do certain things, like explore the area of identity, until the data protection law is enacted.”

The government plans to send the draft Data Protection Bill to the National Assembly as an executive bill in October, which could put it on track to be passed by December of this year.

Minister of Communications and Digital Economy Professor Isa Pantami emphasized that the data protection law is necessary due to the large amount of data collected by the National Identity Management Commission, which includes biometrics.

Article Topics

Africa  |  biometric identifiers  |  biometrics  |  data protection  |  funding  |  Identification for Development (ID4D)  |  legislation  |  Nepal  |  Nigeria  |  World Bank