Domestic law and policy
The NID operates under the legal framework of Nepal’s National ID and Civil Registration Act (2020)[45]and the National ID and Civil Registration Regulations (2021).[46]For the government, the digital identity is a “secured smart card that contains biometric and demographic information of a citizen”.[47]The Constitution also mentions in Article 51, on State polices, that the country will pursue “developing an integrated national identity management information system, and manage it in an integrated way for all kinds of information and statistics relating to citizens, and integrate it to the services and facilities provided by the State and the national development planning”.[48]
There are not any systematic mechanisms for filing digital ID-related complaints to resolve governance issues other than administrative. Individuals can fill a form if they find an error in their ID card. Out of 16.35 million enrolment by November 2024, while the government has distributed the NID to 1.65 million, the users have rejected 1,61,113 cards citing an “error” in their information.[49]Once the error is registered while collecting the NID card or later, a request form can be submitted to make necessary changes. The complaints are usually reconfirmed by an operator and verified by a verifying officer.[50]
Data Protection
Article 28 of the Constitution of Nepal guarantees the right to privacy and protection of personal information.[51]Additionally, the Individual Privacy Act (2018) and the Individual Privacy Regulation (2020) were enacted to give effect to the provisions related to privacy and data protection. The National ID and Civil Registration Act (2020) includes some provisions ensuring the protection of personal privacy.[52]
The rushed pace of developing the NID raised national security concerns in 2019, particularly that it was initiated without proper safeguards for storing personal data.[53]Cyberlaw experts have identified that there is insufficient data protection in existing legal frameworks in Nepal, including loopholes that curb obligations to data privacy, and concerns over the security and privacy of data tied to the NID system itself.[54]Experts have recommended that the Nepali government set up a robust regulatory framework for the digital ID system.[55]Routine auditing of IT security in the government’s data management system and public awareness campaigns for personal data security were also recommended.[56]One barrier to proper security that Parliament members highlighted is the lack of financial and human resources such as staff in the IT department and skilled engineers to oversee the information systems.[57]In an effort to address these security concerns, government officials hope that the integration of NID with the new Nagaraik app will enhance data security.[58]
International Commitments
While Nepal is not party to any international or regional treaties pertaining to digital ID or data privacy and protection, it is a party to ICESCR, which enshrines the right to the highest standard of health in Article 12.[59]Due to Nepal’s policies which require Nepali citizenship in order to enroll for an NID [60]as well as require NID enrollment to access health insurance,[61]Nepal may be contradicting its obligation under ICESCR. The requirement of citizenship in order to register for a SIM card [62]may also be imposing on the right to information for stateless people in Nepal. The right to “receive and impart information and ideas through any media and regardless of frontiers” is protected under Article 19 of the UDHR.[63]
