National ID System and Information Privacy

All this talk about National IDs and invasion of privacy is a reflection of the people’s lack of trust in the government. What fuels this mistrust is the absence of any controls limiting the ability of government to access the aggregated data.

But the debate has confused (perhaps left to the back burner) the critical difference between the existence of centralized databases and access to the data. People just assume that centralized databases means unfettered access. This is not necessarily true. Unfortunately, the Supreme Court in Ople v. Torres (striking down the earlier national ID system) added fuel to this fire. Even though the majority recognizes that the violation of the right to privacy is potential, it still concluded that the Ramos administrative order violated the Constitution. Now, I’m not a Constitutional Law expert but it seems to me that if no right has been violated, then there is no opportunity for the Court to exercise its power. In legalease, there is no “justiciable controversy” — this means that the courts are not permitted to intervene unless there is an actual violation of a right. But in Ople v. Torres, there was no actual invasion of privacy. Here’s what the Court said:

“Given the record-keeping power of the computer, only the indifferent will fail to perceive the danger that A.O. No. 308 gives the government the power to compile a devastating dossier against unsuspecting citizens.”

Noone’s record had been compromised. Noone’s right to privacy had been violated. Noone had been discriminated against, oppressed, harrassed, or otherwise molested by the system. The Court ruled on the basis of “WHAT IF.”

More importantly, the standard set by the Court for any national ID system is so high that any law will almost always fail. The Court said

“They must satisfactorily show the presence of compelling state interests and that the law, rule, or regulation is narrowly drawn to preclude abuses.”

How can this be workable? If Congress says that the ID system is for efficient delivery of government services, it won’t be good enough. That argument was used in Ople and failed to pass muster. The irrationally high standard becomes apparent once a “compelling state interest” is identified. Let’s say this “compelling state interest” is counter-terrorism. If the Court’s standard is to be followed, the law creating the national ID sytem must limit the ID’s use only for counterterrorism, and no other. If that’s the case, then is it worthwhile to set up a national ID system for a singular purpose? Will the Court require that the ID system be junked once the “compelling state interest” is no longer present? It seems then that the Court has foreclosed the possibility of enacting any national ID measure — either because the state interest is not compelling enough or even if it is, it’s not economically viable.

To make matters worse, the Court crafted this doctrine based on the potential not an actual violation of the right to privacy.

To be sure, Congress must be guided by the High Court ruling although since GMA has appointed a majority of the sitting justices, then maybe Malacanang can swing any new legislation through this Court. Who knows? Although, in my book reversing the decision is not a bad thing.

Back to my point which is this: we need to distinguish between creating and maintaining databases and access. The proper subject of legislation isn’t just the creation of a centralized ID system but a law that limits access to the data only for specified purposes and respects the right of the people to control the data for accuracy and unauthorized uses. Here’s a proposed law drafted by the UP Internet and Society Program that addresses these issues.

But anyone who knows about privacy (or security for that matter) knows that having the legal framework is half the battle. There must be a culture of privacy — the widespread acceptance of the notion that access to personal information must be regulated. In my view, that culture already exists in the government. In my experience, government employees already zealously guard against unauthorized access to government records. I’m told that in the last 5 years, the SSS, BIR and other agencies have been working to share their electronic databases and still nothing has happened. For me, this is an indication that there is a culture of privacy protection among the folks in government who guard our data.

The bottom line is this: any national ID system statute must be accompanied with a law that articulates and protects the informational privacy of individuals. Otherwise, it won’t be acceptable to the people or the Courts.

If you want to learn more about information privacy, read this paper written by the folks at the Internet and Society Program.