Domestic Law and Policy

While the intention to develop policies and regulations is included in Brunei’s Digital Economy Masterplan 2025,^[26] there is currently no legislation for data protection or regulations for the digital ID system.^[27] As such, there is no definition provided for digital ID in Brunei’s legislation. However, there are plans to amend the National Registration Act (2002) to accommodate digital ID.^[28]

Data Protection

The e-Darussalam Account digital ID is protected through blockchain technology with biometric authentication through facial recognition.^[29] The sharing of personal data between government agencies is governed by existing legislation. The government has plan to develop this legislative and policy framework further.^[30] While Brunei does not currently have legislation specific to data protection, existing legislation applicable to government use and  protection of personal data includes the Internal Security Act (1983), the Official Secrets Act (1940), the Computer Misuse Act (2000), the Electronic Transactions Act (2001), Brunei’s Data Protection Policy, as well as sectoral laws on personal data management.^[31] Under the Personal Data Sharing Agreement, data between government agencies does not require an application form whereas sharing data with entities outside of government does.^[32] Similarly, under the Personal Data Sharing Guideline, data can be shared to the private sector through an orderly process and according to set procedures, e.g. data sharing request forms and contractual agreements.^[33] Personal data may be shared by the government without consent in circumstances demanded by legal obligation, national security, public health, public order, public safety, public task, research purposes, to protect a person’s life, and when there is a disclosure in line with government policies.^[34] With national security reasons allowing for the use of users’ data without consent,^[35] it should be noted that migrants are at higher risk of being portrayed as a threat to national security.^[36] Stateless persons tend to be at greater risk of violation of their right to privacy as their data can be obtained for national security concerns, a result of national security reasons allowing for the use of users’ data without consent.

Brunei has a law called the Personal Data Protection Order (PDPO) as well as a Data Protection Policy.^[37] The PDPO has been enacted to govern the collection, use and disclosure of personal data by private organizations. It provides a framework that balances the private sector’s need to collect and use personal data with individuals’ right to protect their personal information.^[38] The Data Protection Policy aims to protect information collected on individuals and to facilitate data sharing within the Government.^[39] Together, the PDPO and Data Protection Policy establish a dual framework in Brunei, safeguarding personal data in the private sector while enabling secure government data sharing, in line with the Personal Data Protection Order 2025’s phased implementation.^[40]

International Commitments

Brunei has ratified several major human rights treaties such as CEDAW, CRC and CPRD. Under the CRC, Brunei is also obligated to uphold the right to education for children.^[41] Moreover, General Comment No. 25 by the Committee on the Rights of the Child states that digital ID systems should be created to enable all children to safely access essential digital public services and educational services without discrimination.^[42] Exclusion of stateless children without permanent residence from accessing the health and education services tied to legal identity violates this obligation.^[43] The exclusion of certain stateless children from legal identity raises concerns regarding the full realization of the principle of non-discrimination, protected under Article 7 of the UDHR.^[44]

Regionally, the ASEAN Framework on Personal Data Protection and Framework on Digital Data Governance set out non-binding principles to facilitate coordination and raise standards on data protection, privacy, and secure digital economies. These principles encourage member states to adopt national data protection laws and support mutual recognition. However, they do not establish binding commitments or specific requirements for digital ID systems, nor do they include provisions addressing  the protection of stateless persons.^[45]