Free to Read: China’s Digital ID Proposal Sparks Debate About Privacy and Security

Public security ministry and national internet regulator introduce system that aims to cut down on the personal information that internet platforms can collect from their users

People browse their phones while waiting to receive a Covid-19 vaccine in Hangzhou, East China's Zhejiang province, on Aug. 27, 2021. Photo: VCG

Chinese authorities are seeking public comment about a set of proposed new national digital identification rules that aim to cut down on the personal information that internet platforms can collect from their users.

The proposed digital ID, which was detailed in a draft provision released by the Ministry of Public Security (MPS) and the Cyberspace Administration of China (CAC) on Friday, has already set off a debate in the legal community and the broader public about whether the proposal might do more harm than good.

Authorities said the purpose of the digital ID is to “strengthen the protection of personal information” and standardize how public services operate, according to a notice issued by the MPS and CAC announcing that the draft provision is open for public comment until Aug. 25.

The new ID would work by creating another layer of identity that hides a user’s phone number or other personal information from the companies that run the internet services. Users could apply voluntarily for the ID using their real personal information, but that would be kept confidential by the authorities under normal circumstances. According to the draft provision, the digital ID could take the form of a separate identification number or some as-yet-to-be determined “credential.”

The kind of digital ID would give people an alternative way to verify their identity with internet platforms, said Zhao Peng, director of the Internet Law and Regulation Research Center at China University of Political Science and Law.

It came as some internet platforms have abused the current real-name registration system in ways that have left them with an excessive amount of their users’ personal information, exacerbating privacy concerns and risks of leaks.

In China, people have to provide their national ID numbers when they sign up for home and mobile internet connections, according to regulations including the country’s 2017 Cybersecurity Law. For online services that allow people to post information to the public, such as social media platforms, they have to submit “real identity information,” which is typically a phone number linked to their national ID.

Peking University law professor Shen Kui believes the digital ID system could maximize personal data security because having fewer entities that collect individuals’ information lowers the chances of a data leak.

Zhao and Shen also had concerns about whether the digital ID would be truly voluntary. While the draft stipulates that users can apply for one on a voluntary basis, it also included measures that encourage authorities and internet platforms to promote the system.

This kind of encouragement could turn something intended to be voluntary into something that for all practical purposes is mandatory, Shen said. Zhao shared similar concerns, calling for systems to ensure the IDs don’t end up becoming mandatory.

The draft also makes the MPS and the CAC responsible for managing the authentication procedure and overseeing security of the data. “There is an implicit presumption that information collected by state agencies is safer and more reliable than data gathered by internet platforms,” said Zhao Hong, another professor at Peking University Law School. “But this is not necessarily the case.”

There are other possible drawbacks as well.

“Compared with private entities, individuals may find it harder to refuse when state agencies are collecting and processing the information,” Zhao added.

Lao Dongyan, a professor at Tsinghua University’s School of Law, said the departmental draft regulation lacks fundamental legitimacy and may allow the agencies to overstep their authority because there is no higher-level law that provides a legal basis for the proposed digital ID system.