Myanmar: Human Rights Analysis of Biometric Digital ID Systems Given the risks, data intensive systems (especially those that collect and store biometric data) should only be deployed “when States can demonstrate that they are necessary and proportionate to achieve a legitimate aim.”27 Furthermore, independent oversight of such systems is absolutely crucial. States should establish or maintain “independent, effective domestic oversight mechanisms capable of ensuring . . . accountability for State surveillance of communications, their interception and the collection of personal data”.28 Finally, digital ID systems that are linked to any kind of surveillance system raise additional human rights concerns regarding privacy and possibly other civil and political rights, such as the right to freedom of expression. Laws governing surveillance regimes should ensure that they: (a) Are prescribed by law, meeting a standard of clarity and precision that is sufficient to ensure that individuals have advance notice of and can foresee their application; (b) Are strictly and demonstrably necessary to achieve a legitimate aim; and (c) Adhere to the principle of proportionality and are not employed when less invasive techniques are available or have not yet been exhausted.29 Any actual surveillance should be based on an individual justification and be subject to a proportionality analysis, which cannot occur when mass surveillance is undertaken.30 Surveillance regimes which require the collection and indefinite retention of personal data are simply not proportionate. 31 In 2016, in Concluding Observations regarding Kuwait, the Human Rights Committee addressed the privacy impacts of a Kuwaiti counter-terrorism law which enabled DNA testing and the creation of a centralised database on DNA. Their concerns, which highlight the possible pitfalls for any surveillance regime which relies on the collection of sensitive biometric data, included: the compulsory nature and sweeping scope of DNA testing; the broad powers of authorities to collect DNA samples; the lack of clarity on safeguards to ensure confidentiality and prevent arbitrary use of the DNA samples; and the absence of independent oversight.32 As a result, any surveillance system which relies on biometric data should have transparent, clearly defined rules and oversight, along with strong safeguards and limits on the ability of authorities to access and use the data. 1.4 Social and Economic Rights Legislation that requires the use of a digital ID for access to goods and services might limit the ability of persons who do not qualify for or otherwise cannot obtain a digital ID to access those services. Where access to public benefits is limited, this may constitute a restriction on the right to health, education, food, employment or other social and economic rights. More generally, inasmuch as a digital ID programme is integrated into a system for distributing welfare 27 Report of the UN High Commissioner for Human Rights, note 19, para. 61(c). UN General Assembly Resolution 68/167, 18 December 2013, paras. 4(c)-(d). Available at: http://www.un.org/ga/search/view_doc.asp?symbol=A/RES/68/167. 29 Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, 17 April 2013, para. 83. Available at: https://undocs.org/A/HRC/23/40. 30 Report of the UN High Commissioner for Human Rights, note 19, para. 17. 31 Ibid., para 18. 32 Human Rights Committee, Concluding Observations on the Third Periodic Report of Kuwait, 11 August 2016, U.N. Doc. CCPR/C/KWT/CO, para. 20. Available at: https://undocs.org/en/CCPR/C/KWT/CO/3. 28 -6-