Why should we all pay attention to the Brazilian Digital ID system?

The implementation of digital identity systems is increasing around the world, especially in Global Southern countries. The model widely adopted is known as Big ID, promoted by or linked to public administration bodies which use centralized biometric databases to identify and authenticate citizens (Access Now, 2021).

There are developments in the field of identity systems across Global Southern countries, like the case of India, and Brazil is no exception. In 2017, the Brazilian government enacted a federal law which established the National Civil Identification System (ICN or Identificação Civil Nacional). The ICN is composed of one centralized database, composed, mainly, of citizens’ biometrics that had been collected by the Superior Electoral Court for electoral purposes. By the end of 2020, more than 120 million Brazilians had already completed their biometric registration (Superior Electoral Court, n.d.), which represents more than half of Brazil’s large population. 

Together with the ICN, the federal government created a platform called gov.br. Following the same path of platformization of public policies that is being  undertaken in countries such as the UK, gov.br aims to gather in one place all the information and digital public services offered by the federal government. The ICN and the gov.br platform have a close relationship, since the authentication process within the platform is performed by the ICN system, through the users’ biometrics. Currently, this is the main use of the ICN in Brazil. .

In the past two years, Brazil has experienced a significant growth related to the numbers of its platform users, due to the pandemic. In June 2022, gov.br registered 130 million users, which is equivalent to 80% of Brazil’s population over 18 years old (Agência Brasil, 2022). According to the national Digital Government Strategy, the goal of the government is to digitize all of its public services by the end of 2022, and make all of them available through the gov.br platform. 

Brazil’s large population and territorial size have given it a leading role in international affairs and politics, especially in the Latin American and Global Southern context. The rapid implementation of its digital identity system, combined with the platformization of public services, has thus a significant potential to influence other countries – and that is why we should all pay close attention to what is happening in Brazil.

Between visibility and exclusion: mapping the risks associated with the National Civil Identification system and the usage of its database by the gov.br platform

In order to dive deep into the processes that have been undertaken in Brazil, Data Privacy Brasil Research Association conducted a one-year research project on the National Civil Identification and gov.br. The research culminated in the launch of the policy paper “Between visibility and exclusion: mapping the risks associated with the National Civil Identification system and the usage of its database by the gov.br platform”.

The report mapped two  main types of risks posed to individuals’ fundamental rights and civil liberties by the digitization processes the federal government has been undertaking. The first type of risk was the abusive processing of personal data, due to the ICN’s information and governance architecture, and the second type of risk was of excluding citizens from access to public policies, when using the ICN database to access the gov.br platform. Both these risks can be seen in other countries, specially the ones located in the Global South, where digital identity systems are being similarly implemented. 

The research classified these risks as high in the Brazilian context. Despite a lack of specification in the local General Data Protection Law (LGPD) of what poses high risks to data subjects’ fundamental rights and civil liberties, the National Data Protection Authority (ANPD) has been issuing some guidelines in that sense. More specifically, CD/ANPD Resolution No. 2 of January 2022, states that large-scale data processing and the use of sensitive personal data (such as biometrics) – both of which characterize the ICN and the gov.br data uses – are triggers for high-risk findings. Moreover, the Brazilian DPA has a guideline that argues that producing a DPIA would be highly recommended in scenarios in which sensitive data were being processed on a large scale.

In the face of this context, the policy paper concludes that the implementation of digital identity systems and the digitization and platformization of public services, especially as happening in Brazil, should have been preceded by the conduction of a Data Protection Impact Assessment – which hasn’t happened. In addition to conducting such assessment, the policy paper sustains that it should be publicized, first for a logical reason, that is, that the goal of the assessment is to protect the data subjects, hence, they should have access to the document. And second, that considering the Constitutional principles regarding the activities of the Public Administration, such as transparency and publicity of acts, it is necessary for it to be made public.

To understand more on the Brazilian case and on the conclusions and recommendations offered by the policy paper, you can download its English version [here]. The report is also available in Portuguese [here].