Domestic law and policy
Under the Registration of Population Records Act (2014), which covers the implementation of the paper Tazkira, citizens are required to have a paper Tazkira.[48]The Registration of Population Records Act defines the e-Tazkira as “an ‘official document that is printed on polycarbonate cards and distributed to the citizens of the country pursuant to the provisions of this law’, including biometric information.[49]In this domestic legislation, the e-Tazkira is directly linked to citizenship as they are only provided to citizens of Afghanistan and can be used to verify a citizen of Afghanistan based on the included definition of e-Tazkira.[50]There are no mechanisms for filing or resolving complaints included in the Registration of Population Records Act.[51]
Data Protection
Afghanistan does not have a general data protection law. The absence of a data protection framework raises concerns about the protection of sensitive data collected by the government.[52]Civil society organizations expressed concerns over the potential use of biometric and digital ID data being used against “human rights defenders, journalists, and minorities”, calling for the data to be erased and secured at the time of the Taliban takeover.[53] Data attached to the digital ID include home addresses, iris scans, pictures, occupations, names of relatives, and fingerprints.[54]There is a high likelihood, although no concrete evidence, that the biometric data held in the ABIS system of those working with the US government have been breached by the Taliban since the takeover.[55]Some reports have already confirmed breaches in the e-Tazkira system, which suggests that the data can easily be decrypted to gain direct access to this information.[56]While there has not been any direct reports of the use of this sensitive information to target stateless persons, refugees or migrant populations, there is widespread concern of the potential harm that could be caused by those in possession of the data.
With the Taliban takeover, the multitude of leftover digital ID systems implemented for both the Afghan government and foreign governments and militaries left millions of Afghans’ personal data at risk of being used by the Taliban for purposes they were not originally intended for.[58]This is especially of concern considering that the Taliban had used biometric data to target its enemies in 2016 and 2017.[59]In 2015, a technical review of the e-Tazkira system was conducted by Ashraf Ghani which revealed the system to have issues with data processing and security and lack robust testing.[60]
Human Rights Watch notes that these systems should not have been implemented without “a thorough human rights and data protection impact assessment that includes a contextual analysis, an analysis of the technology to be deployed within that context, a system threat model to assess the risk and possible outcomes of system failure, and a data protection and cyber security assessment specific to the Afghanistan context.[61]Further, as the takeover began to take place, there should have been prior reassessments of the security of the stored data.[62]
Given the security risks of the takeover, “all those involved in funding and building these biometric systems” should be transparent about the nature of data that could be breached, the structure and safeguards of the systems, and whether the systems were adapted to changing security concerns in the country.[63]Without transparency, the collection of sensitive biometric data is seen by some as irresponsible and not beneficial to the population it was supposedly made to benefit. [64]
If Afghanistan had a data protection law prior to the Taliban takeover, it could have influenced better practices that may have prevented the Taliban from being able to access personal data stored in the systems after the takeover.[65]
International Commitments
Discrimination resulting from exclusion of stateless persons from accessing forms of identity, whether digital or paper-based, contradicts Article 7 of the UDHR, which protects the principle of non-discrimination.[66]As a party to the ICCPR, Afghanistan is obligated to uphold the right to privacy (Article 17), and the right to be recognized before the law (Article 16).[67]The ICCPR further ensures freedom of movement under Article 12 and freedom of religion under Article 18, both of which are curtailed by the inability to list one’s religion (if non-Muslim) on their Tazkira and restricted freedom of movement for those without a Tazkira.[68]Additionally, Article 8 of the CRC protects the right to an identity, which a significant portion of the population does not have access to.[69]The right to an adequate standard of health is protected by Article 12 of ICESCR to which Afghanistan is a party, along with the right to education (Article 13) and an adequate standard of living, including housing (Article 11).[70]Further, gender discrimination such as discriminatory procedures in procuring identity contradict Afghanistan’s obligations under CEDAW.[71]Due to the exclusion of stateless persons from accessing the Tazkira and e-Tazkira, all of the above mentioned rights which Afghanistan is obligated to as a result of treaty ratification are under threat.Domestic law and policy
Under the Registration of Population Records Act (2014), which covers the implementation of the paper Tazkira, citizens are required to have a paper Tazkira.[48]The Registration of Population Records Act defines the e-Tazkira as “an ‘official document that is printed on polycarbonate cards and distributed to the citizens of the country pursuant to the provisions of this law’, including biometric information.[49]In this domestic legislation, the e-Tazkira is directly linked to citizenship as they are only provided to citizens of Afghanistan and can be used to verify a citizen of Afghanistan based on the included definition of e-Tazkira.[50]There are no mechanisms for filing or resolving complaints included in the Registration of Population Records Act.[51]
Data Protection
Afghanistan does not have a general data protection law. The absence of a data protection framework raises concerns about the protection of sensitive data collected by the government.[52]Civil society organizations expressed concerns over the potential use of biometric and digital ID data being used against “human rights defenders, journalists, and minorities”, calling for the data to be erased and secured at the time of the Taliban takeover.[53]Data attached to the digital ID include home addresses, iris scans, pictures, occupations, names of relatives, and fingerprints.[54]There is a high likelihood, although no concrete evidence, that the biometric data held in the ABIS system of those working with the US government have been breached by the Taliban since the takeover.[55]Some reports have already confirmed breaches in the e-Tazkira system, which suggests that the data can easily be decrypted to gain direct access to this information.[56]While there has not been any direct reports of the use of this sensitive information to target stateless persons, refugees or migrant populations, there is widespread concern of the potential harm that could be caused by those in possession of the data.
With the Taliban takeover, the multitude of leftover digital ID systems implemented for both the Afghan government and foreign governments and militaries left millions of Afghans’ personal data at risk of being used by the Taliban for purposes they were not originally intended for.[58]This is especially of concern considering that the Taliban had used biometric data to target its enemies in 2016 and 2017.[59]In 2015, a technical review of the e-Tazkira system was conducted by Ashraf Ghani which revealed the system to have issues with data processing and security and lack robust testing.[60]
Human Rights Watch notes that these systems should not have been implemented without “a thorough human rights and data protection impact assessment that includes a contextual analysis, an analysis of the technology to be deployed within that context, a system threat model to assess the risk and possible outcomes of system failure, and a data protection and cyber security assessment specific to the Afghanistan context.[61]Further, as the takeover began to take place, there should have been prior reassessments of the security of the stored data.[62]
Given the security risks of the takeover, “all those involved in funding and building these biometric systems” should be transparent about the nature of data that could be breached, the structure and safeguards of the systems, and whether the systems were adapted to changing security concerns in the country.[63]Without transparency, the collection of sensitive biometric data is seen by some as irresponsible and not beneficial to the population it was supposedly made to benefit. [64]
If Afghanistan had a data protection law prior to the Taliban takeover, it could have influenced better practices that may have prevented the Taliban from being able to access personal data stored in the systems after the takeover.[65]
International Commitments
Discrimination resulting from exclusion of stateless persons from accessing forms of identity, whether digital or paper-based, contradicts Article 7 of the UDHR, which protects the principle of non-discrimination.[66]As a party to the ICCPR, Afghanistan is obligated to uphold the right to privacy (Article 17), and the right to be recognized before the law (Article 16).[67]The ICCPR further ensures freedom of movement under Article 12 and freedom of religion under Article 18, both of which are curtailed by the inability to list one’s religion (if non-Muslim) on their Tazkira and restricted freedom of movement for those without a Tazkira.[68]Additionally, Article 8 of the CRC protects the right to an identity, which a significant portion of the population does not have access to.[69]The right to an adequate standard of health is protected by Article 12 of ICESCR to which Afghanistan is a party, along with the right to education (Article 13) and an adequate standard of living, including housing (Article 11).[70]Further, gender discrimination such as discriminatory procedures in procuring identity contradict Afghanistan’s obligations under CEDAW.[71]Due to the exclusion of stateless persons from accessing the Tazkira and e-Tazkira, all of the above mentioned rights which Afghanistan is obligated to as a result of treaty ratification are under threat.[72]
