Paraguay issuing digital IDs and mDLs without adequate regulation, NGO argues

Digital IDs derived from Paraguay’s national identity card and driver’s licenses are now accepted as their legal equivalents, but a civil society group is warning that the in the absence of proper regulation, the system could undermine personal privacy and other human rights.

Paraguay-based digital rights advocacy the Association of Technology, Education, Development, Research, Communication (TEDIC) issued the report on risks of and recommendations for the national digital ID system.

In October of last year, Paraguay passed Law No. 7177/2023, which provides the legal basis for recognition of government-issued digital identity credentials.

The starting point of the analysis is made clear in an initial section on global context, in which mass privacy violations are attributed to India’s digital ID system, Aadhaar. The data protection inadequacies of select digital ID implementations in countries around the world are then reviewed, before TEDIC moves on to a section highlighting risks and concerns associated with biometrics use.

An examination of Paraguay’s social context notes that half of the country’s population would accept a coup against its democratic government, and that “Paraguay is the only country in Mercosur that has not separated the issuance of civil documents from the police agencies.” Mercosur is a South American trade bloc that also includes Argentina, Brazil and Uruguay.

Paraguay’s digital ID law is not yet accompanied by adequate regulations, according to TEDIC. An e-government platform established in 2018 for online access to public services, for example, has not updated its privacy policy to address the use of digital IDs. The group says that limitations on the collection of biometrics are needed, along with protections against unauthorized access, processes to correct or delete personal data and other safeguards.

TEDIC also sees the necessity and proportionality of the system as unproven, and its transparency as limited.

Perhaps most troubling is the lack of a legal data protection framework in Paraguay. The state has also acknowledged sharing digital ID data with Google Analytics.

Even the privacy policies that offer what scant protection Paraguayans have refer to repealed laws, TEDIC observes.

TEDIC has eight recommendations for improving the situation. Risk assessments and rights protections are needed, along with more transparency and public participation, and adequate regulation. Access should be inclusive and the system should align with international standards. Robust measures must be taken to protect the biometric data the system contains.

Article Topics

biometrics  |  digital ID  |  identity management  |  mDL (mobile driver's license)  |  national ID  |  Paraguay  |  regulation  |  TEDIC