Domestic law and policy
The legal and policy framework surrounding digital identity for non-citizens in Palau is governed by RPPL 11-14 known as the Digital Residency Program Cyber Security Regulation.[21]This law allows Palau to issue digital residency identification, or a Palauan electronic ID to non-Palauans residing overseas.[22]The digital residency grants the holder a legal identity as a resident of Palau, enabling them to open accounts, engage in online trading, or perform other activities requiring identification.[23]According to domestic laws, a Digital Residency Identification Card (DRIC) is defined as a card that includes all the information mandated by the Act.[24]However, the framework does not establish any connection between digital ID and citizenship, as the digital ID provides residency status only, not citizenship.[25]There are no explicit mechanisms in place for filing or resolving complaints related to digital ID within the current legal framework, but the Digital Residency Program Cyber Security Regulation warrants that a disciplinary action against any employee who has committed an information breach or violated a provision of the Regulation that threatens the interests of the stakeholders of the Residency Program.[26]
Data Protection
While Palau does not have a digital ID for its citizens, this section will elaborate on the Digital Residency Program for global citizens. Palau has established cybersecurity policies and procedures in line with the International Organization for Standardization (ISO) 27001 for Cyber Security Compliance.[27]This Program hosted by Palau is decentralized, granting users greater security and privacy.[28]Palau’s Privacy Act specifically outlines requirements for the storage and access of personal information.[29]It mandates that any agency maintaining personal information must protect it from loss, unauthorized access, modification, disclosure, or misuse.[30] Personal information cannot be kept longer than necessary for the purposes for which it was collected and must only be used according to its original purpose, unless specific conditions are met. These include public availability of the information, consent from the individual, necessity for law enforcement purposes, prevention of threats to public health or safety, or if the information is used for statistical or research purposes without identifying the individual.[31]
In recent years, the country has become a potential target for sophisticated cyberattacks, especially given Palau’s limited cybersecurity infrastructure, where multiple cyberattacks were noticed in recent years.[32]In 2024, Palau’s Ministry of Finance experienced a ransomware attack that disrupted payroll processing, highlighting vulnerabilities in the nation’s digital infrastructure. The attackers, suspected to have links to entities in Malaysia and potentially Russia or China, claimed to have exfiltrated over 2GB of sensitive data.[33]Without comprehensive data protection laws or strong oversight mechanisms, citizens’ biometric and identity information could be misused or commercially exploited.
International Commitments
Palau has engaged with international initiatives such as the Global Digital Compact, aiming to foster enhanced digital cooperation across nations.[34]Palau is a member state of the International Telecommunication Union (ITU), the United Nations specialized agency for information and communication technologies (ICTs).[35]The ITU defines digital identity as the digital representation of an entity detailed enough to make the individual distinguishable within a digital context.[36]Palau has adopted this concept through its Digital Residency Program, where the government-issued identification card serves as proof of identity and facilitates access to the global digital market.[37]
In terms of data protection, Palau also closely partners with the United Nations Development Programme (UNDP), which highlights governance standards for identity services.[38]The UNDP emphasizes the use of anonymized data for national planning and service delivery, although it remains unclear if Palau specifically employs these practices.[39]Palau’s digital ID framework incorporates advanced digital techniques, such as end-to-end cryptographic encryption and Zero Knowledge Proofs (ZKPs), to ensure that only the digital residency holder can access their secured data, with no access granted to the RNS platform, partnered governments, or any external entities.[40]Despite these robust privacy protections, the Digital Residency Office does authorize the use of data for certain limited purposes, including the prevention or reduction of threats to public safety and the conduct of statistical or research activities.[41]This raises questions about whether such usage aligns with the UNDP’s recommendations for anonymization,[42]as it suggests potential access to identifiable data in specific contexts.
Regarding human rights obligations, Palau has been a member of the United Nations since 1994 and has ratified several international treaties.[43]As of now, there is no documented evidence suggesting that Palau’s implementation of its digital ID system violates these obligations. However, the verification process may exclude stateless and refugee individuals who lack existing identification documents, as the digital ID in Palau is only accessible to foreign citizens.[44]The application for the digital residency ID specifically requires verification using recognized identification documents,[45] which poses a significant barrier for those who do not have access to such materials.
