Along with the type of data to be collected, determining who will be eligible to register in the ID system is a first-order decision with implications for the inclusivity, cost, utility, and overall development of the system.

Inclusion of non-nationals

In line with various international commitments made by countries to provide proof of legal identity to all people who reside in their jurisdiction without discrimination—particularly SDG target 16.9 to provide legal identity to all by 2030—countries should make foundational ID systems accessible to all resident non-nationals. While resident non-nationals—including migrants, refugees, asylum seekers, and stateless persons—will not be a large proportion of the population in most countries, they are often among the most vulnerable and need access to services and the ability to exercise their rights just as much as nationals. The denial of access to an ID system that is frequently required for access to rights, services, and opportunities can therefore lead to their marginalization.

Restricting a foundational ID system to only nationals can also be exclusionary for many people who are nationals but are unable to prove this. This is particularly the case in jus sanguinis countries, where—in contrast to jus soli countries that recognize citizenship for anyone born within their jurisdiction—nationality determination requires more than documentation of a person’s birth location (e.g., it may also require documentation of parental nationality). Poor people tend to lack this documentation at higher rates, as do other marginalized groups such as ethnic minorities or those living in border areas who may previously been discriminated against and denied citizenship. Therefore, ID projects that require people to prove their nationality in order to access ID run serious risks of disenfranchisement and exclusion.

There are two ways that a country can include resident non-nationals in a foundational ID system:

  1. Not making any distinction between nationals and non-nationals: Through this pragmatic approach, eligibility is exclusively based on a person having resided in a country for a certain period, and no data about the nationality or legal status of the applicant is collected. Importantly, this type of ID system does not ascribe any rights or entitlements, including to nationality or legal status and therefore is insufficient to provide authorization for certain purposes (e.g., voting). As part of this separation, these statuses must then be managed in other systems by relevant authorities with a legal mandate (e.g., an immigration agency) using the foundational ID as a source of trusted identity information and authentication (e.g., as a layer on top of the foundational ID system). This approach has a benefit of greatly simplifying the registration process, which could in turn significantly reduce the cost and time for registration. A notable example is India’s Aadhaar system (see Box 30).

  2. Making a distinction between nationals and non-nationals, while ensuring universal access and respect for rights: It could be that—due to the use cases of the foundational ID system or political dynamics—option 1 is not feasible. If a distinction based on nationality must be made, it is important that resident non-nationals do not face unnecessary barriers accessing the ID system and that their rights—particularly to non-discrimination and privacy—are protected. For example, requiring a residence permit during Identity proofing could exclude some refugees, stateless persons or irregular migrants who live in a country and who could have been born there. The requirements for registration should therefore be minimal. Likewise, issuing non-nationals with an ID number, card, or other credential that makes it visible that they are a non-national could lead to discrimination—instead, this attribute could be “hidden” in the database and/or the chip of a smartcard, and made accessible only to those who need access such as immigration authorities (see Box 30 for an example from the Philippines). If the ID system is intended to provide legal proof of nationality, then it is critical that there are sufficiently accessible and transparent grievance and appeal processes for people whose claim to nationality might be rejected, and for people to be able to easily transition from the non-national category to the national category.

Box 30. Country Experiences with ID and Nationality

In India, the Aadhaar system is accessible to every “resident” of India, defined by the Aadhaar Act as “an individual who has resided in India for at least 182 days in the last 12 months.” No data on the nationality or residency status is collected. In a country with complex nationality laws and procedures, this simplification of the foundational ID system is a significant reason why it managed to register more than one billion people in less than six years. However, there have been instances where police or other authorities have mistakenly arrested non-Indians in possession of an Aadhaar number or card for allegedly fraudulently obtaining Indian nationality, which highlights the need for effective awareness raising of what a foundational ID system is and is not.

In the Philippines, the Philippine identification system (PhilSys) system will be accessible to anyone who has resided in the Philippines for longer than 180 days. Unlike Aadhaar, however, it collects information about whether an applicant is a Filipino national or not—and, importantly, it does not collect what the other nationality might be. This information is not printed on the ID card nor is evident in the holder’s ID number, but it may be shared if legally required and consented. In order to reduce the complexity of registration, the PhilSys Act states that the PhilSys does not provide incontrovertible proof of Filipino nationality, because this determination is the mandate of the Philippine Bureau of Immigration.

Source: Adapted from the ID Enabling Environment Assessment (IDEEA) and expert consultations with World Bank staff.

Inclusion of children

Ensuring that children have proof of their legal identity is fundamental for ensuring their rights, protection, and access to services, such as enrolling in school, receiving public benefits, and preventing child trafficking, labor, and child marriage. For this reason, ensuring universal birth registration, as required by SDG 16.9, is a fundamental priority in any country.

In addition to a birth registration, children can also be included in other ID systems. Traditionally—both because of the rights and duties that come with attaining the age of majority in many countries, and because legal identity should be provided to children through the birth registration and certification process—national ID systems have only covered the population above a certain age, such as 16 or 18 years old. However, a growing number of countries have begun to extend foundational ID systems to children (often optionally), either by linking the issuing of a unique identity to birth registration and/or by making (often optional) “child IDs” available at a younger age (see Box 31). While clearly not a substitute for birth certificates, providing unique identities and/or credentials to children may be useful in certain instances. For example, many digital ID credentials are more portable and have superior security features (e.g., such as a photo) than the paper birth certificates issued in many countries. In addition, digital credentials offer some added functionality, such as the ability to transact at a higher level of assurance, which may make it easier for young adults access to SIM cards and other resources. At the same time, children typically do not engage in many transactions without the assistance of adults, so the added value of advanced credentials may be reduced.

However, the collection of data about children raises unique data protection and privacy risks, including in relation to consent and biometric capture. Children are more vulnerable than adults to identity theft and other privacy violations because they are less equipped to verify and monitor the accuracy and use of data about them, and such identity theft can go unreported for extended periods of time. Consent depends on the parent(s) or legal guardian(s), which must be recorded (but able to be removed when the child reaches the age of majority). Children without parents or legal guardians present at the time of registration can be complex cases that need to be dealt with in accordance with relevant laws on child protection. While biometrics can be captured as young as five years old, they will need to be recollected later at 15-18 years old when physical growth has stabilized. Furthermore, the collection of biometric data from children raises special practical and ethical considerations (more analysis forthcoming in UNICEF-World Bank publication on children biometrics). As an alternative to biometrics, the uniqueness of a child’s registration (including enrollment through birth registration) can be based on the unique identity of the parent(s) or legal guardian(s) (excerpted from IDEEA, see full text for more).

Box 31. Examples of the inclusion of children in ID systems

Belgium: An-eID card is compulsory for nationals from the age of 12. Children under age 12 may obtain a Kids-ID card (issued to the person with parental authority over the child), and this is compulsory for children under 12 who travel abroad. The Kids-ID card contains a safety feature which provides contact numbers in case of emergencies. The reverse side of the Kids-ID contains a hotline number that uses the child’s identification number to link automatically to the telephone number of one of the child’s parents or another relative. Parents may also provide up to five additional contact numbers, classified by order of importance. If there is no response to any number on the list, the call automatically goes to an agency for missing children. The Kids-ID contains an electronic chip designed to protect children on the Internet by enabling them to identify themselves in chat rooms that are reserved for children.

India: Children may be registered in the Aadhaar program from birth, but no biometrics are captured for children under age five. Their Aadhaar number is processed on the basis of biographic information and linked to their parents’ Aadhaar numbers. A facial photograph is taken for manual identification when needed. Children can re-enroll when they reach age five with ten fingerprints and iris and facial photographs. The biometric data is updated once they reach age 15.

Indonesia: Beginning in 2016, optional Child Identity Cards (Kartu Identitas Anak or KIA) have been issued to newborns along with their birth certificates and to children of older ages. There are two categories of identity cards for children: one for children under 5 years old (without a facial photograph) and another for children between the ages of 5 and 17 years old (with a facial photograph). The KIAs are automatically changed into Citizen Identity Cards (Kartu Tanda Penduduk or KTP) at age 17 (or younger for a married female), but the identity number does not change.

Malaysia: “MyKad” ID cards are issued at age 12 and updated at 18. Children below age 12 may apply for non-compulsory “MyKid” ID cards. The MyKid card, unlike the adult MyKad, does not record a photograph or a thumbprint but contains a chip with information about birth, health and education.

Thailand: Thailand assigns a personal ID number (PIN) on a child’s birth certificate. When the child turns seven years old (also the first year of compulsory education), they are required to provide four fingerprints and their facial image and will receive a national ID card. The fingerprints and facial image are recaptured at every subsequent issuance of a national ID card.

Uruguay: A Cédula de Identidad (identity card) is compulsory from birth. Enrollment takes place at birth, and parents must obtain an identity card for the infant within 45 days. A thumbprint is taken at enrollment. However, because of the difficulty of using the fingerprints of newborns for matching, this biometric information is initially stored but not used for identity validation or de-duplication. When a child reaches age five, a complete set of ten fingerprints is taken and stored as the basis for identity validation.

Source: Adapted from the ID Enabling Environment Assessment (IDEEA) (see publication for full sources) and expert consultations from World Bank staff.

Inclusion of nationals abroad

Countries may choose to make an ID system accessible to nationals who reside in other countries. The key benefit of covering nationals abroad in a digital ID system is that they will be able to accessible various e-services—e.g., filing taxes and registering or transferring property--remotely. The decision of how registration in the ID system is conducted, and which other services are offered, will be contingent on budget, since it is expensive and logistically challenging to ship equipment overseas, including to embassies and consulates. However, the ID authority may be able to justify charging certain fees to nationals abroad to recover these costs where these do not exclude people from accessing services. Alternatively, an ID authority can set up registration points at border crossing so that nationals who ordinarily reside abroad can register and pick up credentials when they are traveling to or from the country.