News
Digitisation of ID under Indian grant: Personal data collection by Indian firm raises concern
Indian High Commissioner Gopal Baglay, presidential advisor Sagala Ratnayake, State Minister Kanaka Herath and officials of the Indian High Commission and the Sri Lankan government are seen at a ceremony earlier this month at the Presidential Secretariat to hand over the first instalment of the Indian grant to facilitate the new Natinonal Identity Card digitisation project
Moves to award the tender to develop Sri Lanka’s digital national identity (ID) card project system to a foreign company have raised concerns over the protection of citizens’ personal data.
The Sri Lanka Unique Digital Identity Project (SL-UDI) has been touted by the Presidential Secretariat as “a crucial milestone in the country’s digitisation drive” and has been given high priority by the government.
The project is being implemented through an Indian grant, and the Indian Government is overseeing the software development for the SL-UDI project in line with a Memorandum of Understanding (MoU) signed in March last year. The Indo-Sri Lanka Joint Project Monitoring Committee (JPMC) has been tasked with overseeing the progress of the ongoing project. It is co-chaired by State Minister of Technology Kanaka Herath and Indian High Commissioner
Gopal Baglay.
Earlier this month, the Indian Government provided an advance payment of 450 million Indian rupees (Rs. 1.74 billion) to State Minister Herath. It will cover 15% of the total cost for the successful implementation of the project.
Under the SL-UDI project, biographic as well as biometric information such as facial, iris, and fingerprint data of citizens aged 15 and above will be collected with the consent of the applicant and entered into a centralised system for the purpose of issuing identification cards. This will be done in accordance with International Civil Aviation Organisation (ICAO) standards.
The first phase of the project will focus on developing the digital platform, while data gathering will be conducted in the second phase by Sri Lankan agencies led by the Department for Registration of Persons, according to State Minister Herath.
Once complete, the ID programme is expected to resemble India’s ‘Aadhaar’ digital ID programme. Aadhaar is the world’s largest biometric ID system.
Given that the project is being implemented primarily with an Indian government grant, the terms of the MoU stipulate that all bidders applying for the tender to develop the system must be of Indian origin.
National People’s Power (NPP) Leader Anura Kumara Dissanayake raised the matter in Parliament last week. He claimed there were concerns over the personal data of millions of Sri Lankan citizens potentially falling into the hands of another country.
Mr. Dissanayake said the company that would be selected after the evaluation of the bids would get its hands on all biographic and biometric data of citizens registered within the digital platform. “The age where the world was ruled by weapons is coming to an end. It is now starting to be ruled through the control of data. How is it justified that a foreign company is being given access to all this data? From what I understand, there are local companies that are ready to do this, but they can’t complete it in one and a half years as specified. They will need four years,” he said.
The tender process had also been manipulated to suit one particular bidder, the NPP leader alleged. He noted that while seven companies had obtained bid documents, only two had submitted bids by the deadline, and conditions favour one of them specifically. Initially, the deadline for submitting tender bids was fixed for July 23 this year. It was then extended to August 14 before being changed again to July 18. The deadline was changed a third time to August 1 before being extended to August 2.
Multiple changes to the deadline for submitting bids meant that there was no level playing field for those competing for the tender, he noted. The decision to shorten and extend the deadline has raised serious questions about whether it was an effort to allow only pre-selected bidders to submit bids. If the deadline had remained at August 14, perhaps more companies would have submitted bids, Mr. Dissanayake said.
He also disputed the government’s claim that the winning bidder would not have access to citizens’ data as they would be collected by Sri Lankan authorities. The company will still be signing a maintenance agreement lasting several years, and there is no way to guarantee that it will not have any access to data given this necessity, the NPP leader told
the Sunday Times.
He insisted that his party had no objection to the SL-UDI project, adding that they acknowledged its importance in the country’s drive towards digitisation. “However, this is a question of sovereignty and the protection of our citizens’ data.”
State Minister Herath said the tender was still being evaluated and it was yet to be awarded. “I don’t even know the names of the two companies that have submitted the bids, though Mr Dissanayake seems to. The winning bidder will be awarded the contract by November or December. If there is any issue, the procurement committee will cancel the tender, and we will have to refloat it again. That will take about six months.”
The SL-UDI project will run on the MOSIP (Modular Open Source Identity Platform), said Mr. Herath. MOSIP was incubated at IIIT-Bangalore (International Institute of Information Technology, Bangalore). The platform is designed to provide countries with the flexibility to build their foundational digital ID systems in a cost-effective manner.
Given that Indian companies have the most experience helping to build a system for such a vast project, it was only natural for Sri Lanka to reach out to India for assistance with it, the state minister said.
Once data gathering is complete, all those who are registered with the system will be issued their own unique SL-UDI number. “It is simplistic to say that this is only a digital National Identity Card (NIC). The SL-UDI will be an interoperable system linking multiple agencies,” said State Minister Herath. The Information and Communication Technology Agency (ICTA) has been appointed to function as the local agency providing technical expertise for the project.
Outlining the benefits of the project, the state minister said it will ensure that people no longer have to submit physical documentation to different agencies to obtain various facilities. For example, when obtaining a passport, those who have been registered under SL-UDI will not need to submit any physical documentation, such as birth certificates. Their biographic and biometric data can be accessed to verify their identity, and the passport will be issued accordingly. The same applies when doing transactions with banks or paying taxes. The need to submit physical documentation will be minimised to a great extent.
While acknowledging that the system-developing company would have to be on board as part of the maintenance agreement, Mr. Herath insisted that there would be plenty of safeguards to ensure there was no backdoor access to people’s personal data. “We obviously have to guard against unauthorised access from any party and are putting in various safeguards. SLCERT (Sri Lanka Computer Emergency Readiness Team) will also be constantly monitoring the system to identify any vulnerabilities and implement measures to rectify them.”
It will take about one and a half years for the system to be in place. Thereafter, the company will hand it over to local authorities for data collection, which Mr. Herath said the government would complete within six months to one year.
The Telecommunications Regulatory Commission of Sri Lanka (TRCSL) has already identified between 800 and 1000 locations that can serve as data collection centres.
As part of efforts to speed up data gathering, he said the government was exploring the possibility of outsourcing some of the work to third parties. For example, if a bank agrees, authorities can provide the bank with facilities to obtain biometric data from customers who come to the bank’s branches for transactions. Customers would be asked if they would like to voluntarily provide the data, and if they consented, details would be recorded. The process is expected to take no more than 15 minutes, according to the state minister.
“We have to do this,” Mr. Herath stressed, referring to implementing the project. “We are already 15 years late when compared to the region’s other countries with regard to digitisation. It is also one of the main components that will help us improve our ease of doing business ranking,” he noted.
The best way to say that you found the home of your dreams is by finding it on Hitad.lk. We have listings for apartments for sale or rent in Sri Lanka, no matter what locale you're looking for! Whether you live in Colombo, Galle, Kandy, Matara, Jaffna and more - we've got them all!