Domestic law and policy
There are several legal frameworks surrounding digital identity in Vanuatu. In 2017, the Vanuatu National Identity Card Policy was established.[20] The goal of the policy was to “facilitate the establishment of a National Identification System that supports secure, reliable and robust identity verification and authentication of citizens and persons ordinarily resident in Vanuatu by 2030.”[21]In 2021, Parliament approved the Civil Registration and Identity Management (CRIM) Act and the Vanuatu National Identity (VNI) Act.[22]Both Acts were introduced to establish data accuracy for all citizens and other residents in Vanuatu and to ensure one record per identity.[23]Digital identity is not defined in any of the legislatures, but the National ID was created with the purpose of being an identity verification source and identity assurance for residents and citizens in Vanuatu.[24]Every citizen is afforded a Digital ID because an E-ID is given in conjunction with any National ID card.[25]As the app to access the digital ID card is still in development, there is no current indication of any mechanisms for filing and resolving digital ID-related complaints.
Data Protection
In 2024, the government passed the Vanuatu National Data Protection and Privacy Policy.[26]The policy was established to create a foundation of data protection and privacy laws related to the protection of personal data, associated rights of individuals, and the right to privacy.[27]The Data Protection and Privacy Act No. of 2024 outlines several safeguards including purpose limitation, data minimization, data accuracy, and security measures.[28]For purpose limitation, the act requires that all data must be collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes.[29]For data accuracy, the Act requires data to be accurate and kept up to date.[30] For security measures, the act mandates reasonable and appropriate security measures against unauthorized or unlawful processing and against accidental loss, destruction, or damage. The Act does not mention protection measures for biometric data, require that data for the digital ID be encrypted, or prohibit government access to the data collected.
The implementation of the E-ID system in Vanuatu raises several concerns. There is a risk that personal data could be exposed or misused if not properly protected. The centralization of personal data may lead to increased surveillance capabilities. Given that the Data Protection and Privacy Act does not prohibit government access, a concern is that the government could use the data for corruption.[32]The E-ID may also significantly decrease access to public resources in the country, especially for services that can only be accessed through the digital system.
International Commitments
The exclusion of stateless persons without permanent residence from access to identity cards in Vanuatu contradicts Article 6 of the UDHR, which establishes the universal right to a legal identity.[33]The right to identity is further protected under Article 8 of the CRC, which has been ratified by Vanuatu in 1993.[34]Under the CRC, Vanuatu is also obligated to uphold the right to education for children.[35]Exclusion of stateless children without permanent residence from accessing the health and education services attached to legal identity violates this obligation.[36]As a result of the exclusion of some stateless persons from legal identity, the principle of non-discrimination, protected under Article 7 of the UDHR, has also been contradicted.[37]The right to identity is also protected under Article 16 of the ICCPR, which has been ratified by Vanuatu.[38]
