Brazilian Senate approved (04/11/2017) Bill no. 19/2017, creating the National Civil Identification (ICN). Introduced in 2015 at the Chamber of Deputies (where it was called Bill no. 1775/2015), it radically alters Brazilian civil identity law.
It arrived at the Senate by early March, and it was approved by its Commission on Constitution, Justice and Citizenship by April, 5th,. Afterwards, it followed a five days deadline for any amendment proposal (as per Article 235, II, d, of the Senate’s rules). However, before the deadline, the bill was approved.
Its proponents argue that the bill will help fight fraud and bureaucracy, allowing “citizens to identify themselves and establish simpler and safer relationships in the public and private spheres”. Indeed, accurate citizen data is fundamental to the good functioning of public services. For citizens, it ensures civil rights and social participation.
In reality, however, the matter is not that simple. The ICN will use citizen’s CPF number (the Brazilian social security number) to integrate their personal data in a centralized database, to be managed by the Brazilian Superior Electoral Court. This database will store biographical (name, address, ID number, affiliation) and biometric data (fingerprints), and even information from public identification authorities. It is truly a massive aggregation of personal data.
As security breaches involving public databases make the headlines, concerns over the safety of public information systems (such as the ICN’s) are raised. Personal data from 12 million students taking the Brazilian SAT (called ENEM) was leaked, and the São Paulo State Government and the Rio de Janeiro State Legislature databases were also breached.
Though one might expect the Bill to draw limits on aggregation, access and usage to prevent breaches, it does not. In addition, more concerns are raised as Brazil still lacks a general data protection law.
This type of initiative is not unique in Brazil. In Estonia, the i-card is issued to citizens and permanent residents at the age of 15. Argentina’s Documento Nacional de Identidad is the only accepted ID for Argentinian citizens or residents. In India, the Aadhaar, covers 67% of its population: citizens receive a 12-digit unique code combining biometrics such as fingerprints and data for facial and retinal scanning.
Other countries, like the UK, have backed down from similar programs. The Identity Cards Act, approved after 9/11 incident, would create a central database called the National Identity Register. Though the act had passed by the Labour Government in 2006, it was later repealed when the opposition took office as part of measures to “reverse the substantial erosion of civil liberties under the Labour Government and to roll back state intrusion.”
In Brazil, the ICN has remained largely undiscussed by the public, being subject to a hasty legislative procedure in Congress, resulting in a legal text containing several issues. It is, thus, important to participate more actively in the project’s discussions. To contribute with that debate, we at Privacidade Brasil released today the following technical paper, which was also sent to our senators.