Technology

Significant components of the legal framework for NIDS have been left to future regulations. Key areas include the process of application and enrolment, how authentication will be managed, how verification will be conducted, the manner in which accredited third parties will be managed, the business processes associated with NIDS, and other components. While it is not controversial to relegate operational matters to subsidiary legislation, in some cases the Bill does not establish foundational clarity and direction. We recommend improvements to these specific areas in later sections. However, given the significance of the matters to be prescribed in future regulations and the far-reaching implications of NIDS as a novel system of legal identification, we recommend that: (a) The government commit to publishing the draft regulations ahead of their consideration in Parliament and allow for public input on their contents. (b) The Parliament and the wider society receive the draft regulations prior to the passage of the Act, given that the manner in which the Bill is drafted requires an understanding of the regulations to interpret the Bill properly. (c) The government publishes technical and operational documents that will guide key processes within NIDS and allow for public input. Many of the national identification systems lauded by the GOJ as references and exemplars, such as those established in Estonia and India, published multiple white papers and technical specifications to provide greater transparency and engage the private sector and civil society in dialogue.

Interpretation of this Bill is incomplete without the Data Protection Act’s regulations in place. The Government of Jamaica has decided to proceed with the NIRA Bill's formulation and the implementation of NIDS ahead of the operationalization of the Data Protection Act (DPA) or even the appointment of the Office of the Information Commissioner. In the case of the NIDS, institutional reforms(such as those at the Registrar General’s Department) and the procurement of systems from third parties have even preceded the Bill's passing before this Joint Select Committee. We believe that this is suboptimal sequencing for establishing a NIDS best positioned to achieve the policy objectives, create confidence in the population, and minimize the risks of replicating the harms caused by biometric-based identity systems in other jurisdictions. Core functions of the Authority contained in the Bill, such as the disclosure of identity information to third parties, or the manner in which it organizes and secures the databases of sensitive personal information would be shaped by the Data Protection Act’s regulations. Any analysis of the Bill, therefore, cannot fully interpret the adequacy, compliance, or appropriateness of the Bill's proposed safeguards without an operational data protection framework.

NIDS should not be made “de facto" mandatory by requiring it to access basic goods and services. People should not face the prospect of social exclusion because of non-enrolment, nor should their conditions be made more difficult in order to influence their enrolment. This includes making certain services contingent on enrolment in NIDS. This Bill and subsequent regulations must be clear to not have the effect of degrading or introducing limitations on existing identification options Jamaicans have available to them today. It is important to note that this does not negate the new avenues for identity verification that NIDS will enable due to the features of the system. However, these avenues must be viewed as additive, expanding access to legal identification for all Jamaicans.