Myanmar: Human Rights Analysis of Biometric Digital ID Systems • The system should be designed to ensure that private sector actors respect the privacy and other rights of users. The private sector is frequently involved both in the development and implementation of biometric digital ID systems and in the use of the authentication options they offer. Effective systems and safeguards need to be put in place to ensure that these private actors respect data protection and other rules aimed at protecting users, including systems to hold these actors to account for any breaches of the rules.117 Private actors that process personal data should be obliged to establish internal mechanisms to ensure compliance, to issue data breach notifications in case of a breach, and to undertake privacy impact assessments.118 To prevent discrimination, the rules should limit the sharing of biometric data to what is necessary to achieve legitimate objectives, such as the universal provision of services. Anti-discrimination laws should also be introduced to prohibit and penalise discrimination. • Any biometric digital ID regime that is introduced in Myanmar should be based on residency rather than citizenship. Given the challenges regarding Myanmar’s tiered system of citizenship, and the experience of other countries, any biometric digital ID regime should follow India’s example and be based exclusively on residency rather than being linked in any way with citizenship status. India’s example shows that a biometric ID system can be introduced much more efficiently when it is not tied to citizenship, which would require a more complicated review of documents for each individual. In addition, this approach ensures that all residents have a legal identity under the law, regardless of citizenship status. For similar reasons, the programme should not collect data related to citizenship status. • A Myanmar digital ID scheme should not involve the collection of any data related to race, ethnicity or religion. The regime should also not collect data about ethnicity, race or religion since the risk of such data being misused outweighs any potential benefit from collecting it. None of the biometric ID systems discussed in the case studies collect such data and it is not necessary to create a legal ID system. As noted above, it is highly questionable whether such information should be included on paper IDs under international human rights law. However, when it comes to biometric data regimes the potential for abuse is even higher, given that such systems rely on central databases of immutable personal information. For this reason, even if ethnicity or religion is recorded on paper IDs, it should not be used in biometric digital ID regimes. This publication was produced with the financial support of the European Union. Its contents are the sole responsibility of CLD and IMS and do not necessarily reflect the views of the European Union 117 Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, note 29, paras. 76-77. 118 Report of the UN High Commissioner for Human Rights, note 19, para. 31. - 20 -