Resources
- Identity Use Cases & Scenarios.
- FIDIS Deliverables.
- Identity of Identity.
- Interoperability.
- Profiling.
- Forensic Implications.
- HighTechID.
- Privacy and legal-social content.
- D13.1: Identity and impact of privacy enhancing technologie.
- D13.1 Addendum: Identity and impact of privacy enhancing technologies.
- D13.3: Study on ID number policies.
- D13.6 Privacy modelling and identity.
- D13.7: Workshop Privacy.
- D14.1: Workshop on Privacy in Business Processes.
- D14.2: Study on Privacy in Business Processes by Identity Management.
- D14.3: Study on the Suitability of Trusted Computing to support Privacy in Business Processes.
- D14.4: Workshop on “From Data Economy to Secure.
- D16.3: Towards requirements for privacy-friendly identity management in eGovernment.
- Mobility and Identity.
- Other.
- IDIS Journal.
- FIDIS Interactive.
- Press & Events.
- In-House Journal.
- Booklets
- Identity in a Networked World.
- Identity R/Evolution.
Universal ID numbers in three Visegrad countries
Adam Foldes (Hungarian Civil Liberties Union)
Robert Pinter (BME – UNESCO Information Society Research Institute)
ID number in Hungary
Historical aspects
The Hungarian story of the universal ID number corresponds perfectly with the story of the deconstruction of the party-state. Throughout the communist regime a basic experience of the population was the defencelessness against the ubiquitous state. As the history of the surveillance state, the personal stories of the observed and their shadows, the everyday deals, the voluntary or forced collaboration with power, have yet not been written, thus suspicion remains even after 18 years of democratic change. More than a million people in a country of ten million were observed: in their workplace by colleagues who worked or collaborated with the secret agencies, in their home where caretaker of the public owned building noted the activities of the residents, in small communities where people reported on friends, relatives if they were blackmailed by the secret agencies, in churches where priests worked for the system. The entire society was interwoven by the paranoid system of power. The methods used by the secret agencies to reach cooperation varied on a wide scale. They had about 30,000 officers in service of the secret agencies in the Rákosi Era (1948-56) and about 20,000 in the Kádár period (1956-88). In addition, masses were blackmailed. If they did not report they would lose their jobs, would not get promotions, their children would be banned from current or further studies, their passport would be revoked, etc.. Most people did not even consider whether or not to collaborate with the totalitarian system or even supported it and helped the agencies voluntarily.
The Hungarian legislation could not solve the conflict between privacy and freedom of information which latter entails working on the dark side of the society in the comunist regime. Since the transition Parliament was unable to adopt legislation, which could provide access to the former secret agencies’ archives, by which means the details of the everyday observation, the stories of the victims and perpetrators, not to mention of those who were both the same at the same time, could be written. Many files have disappeared since 1989 and numerous have reappeared since, causing scandals over and over again. Every citizen had records in different registries: with their employer, for education, for medical care, with the political party, and many of them even with the political police. Since 1954, every citizen was obliged to carry an ID card that had to be shown to the authorities on request. The records could be linked with the help of the universal ID number which had been given to everybody at birth from the year 1974 on.
The first step towards dismantling the “Big Brother” system was the abolishment of the universal ID number in 1991. The Constitutional Court (CC) had started its work 1st January 1990, within five months it issued in its very first decisions that a ministerial decree cannot oblige anybody to disclose their ID number as it is a limitation of privacy, which can be prescribed only by Act of the Parliament. Not even a year had passed by the time before the Constitutional Court issued its ever since most cited privacy decision on the universal ID number, in which they abolished the universal ID number. The CC prescribed that the state shall pursue a shared information policy which means that the major registers must be split and each of them should introduce ID numbers on their own, independently from each other. The state registries were given deadlines to realise the separated systems and as long as they established them they were authorised by provisional legislation to use the old universal ID number but only to upkeep the elementary functions of the state. The interim period was to expire on the last day of 1995. In 1994 the CC has reaffirmed its previous decision on the ID numbers as they examined the Act on misdemeanours and a Governmental decree on social security numbers (both of them using the universal ID numbers) and abolished the decree which enabled the authorities to use the old universal ID numbers for social security administration purposes. The CC banned even the partial revival of the old system.
In 1995 the Government has started a major economic stabilisation programme which was implemented in an Act of the Parliament. In the frame of this Act the Government made an attempt to extend the interim period (see above) for the use of the universal ID number by 4 years. This was the second time that the CC abolished the universal ID number by concluding that the interim period shall not be extended any further as there was no guarantee that the legislative power will not seek even further extensions.
In 1997 the Government presented a plan on Central National Network for Updating and Forwarding Data and issued a decision on a network connecting the state registries. It would have been financed by the World Bank and 2.5 billion HUF was proposed in the 1998 National Budget for setting up the system. The Government argued for the system that the then introduced private pension system would not function without connecting the Central Statistics Bureau and the social security database, as the social security system had lost sight of 637 000 citizens and they were supposed to be earning their living in the black economy. Connecting these databases would have been only the first step, the cross-checking of personal data with the election register and the tax register was also foreseen. The Parliamentary Commissioner for Data Protection sharply criticised the plans of the system and recalled the CC’s decisions which prohibited the establishment of such universal registries. This universal database has never been set up due to the resistance of the Data Protection Commissioner and the change of the Government. Regarding this question the latest decision of the CC was issued in 2004 on an Act regulating among other things the data handling of the tax authority. The CC has reminded the legislator of its early decisions and stressed that no tax ID number can be established which could function as a universal ID number. Occasionally, public officials give statements in the media on their plans for universal databases, but none of them has reached so far as the plan on Central National Network for Updating and Forwarding Data in 1997.
Legal aspects
In 1991 the Constitutional Court (CC) laid down the cornerstones of the Hungarian ID number policy and even repetitious attempts of the legislature could not bring any change in this field. This decision of the CC founded the Hungarian personal data protection law. The decision comprises several important arguments which add up to a coherent general prohibition of the universal ID number.
The CC found that the legislature (in the early eighties) had a concept of setting up an integrated personal data bank which would have consisted of the widest possible range of personal data of the citizens including health care data, financial data, administrative procedures records. Therefore it had become compulsory to use the ID number in the population registry and in the administrative and judicial registries.
1. They pronounced that it is absolutely unconstitutional to process data merely for the ‘stock’ without specified purposes, which is due to the lack of defined purposes indivisible to different applications and renders the data accessible to undefined users. The CC also maintained no guarantee can overhaul the lack of the purpose-bound requirements of data processing as the legal conditions of the data transfer and the purpose-bound nature are not alternative but coupled guarantees of the informational self-determination (privacy).
2. The CC warned if there is no defined circle of data processors – as in the case of the universal ID number which can be used by anybody owing to its universality – it is natural for the data processors that they can access aggregated and interrelated data of the individuals. It renders the individual defenceless, makes their private life transparent and results in an asymmetric communicative situation where the individual will not know what is known about him by the data processor. It is a humiliating situation and excludes the free choice of the individual who does not know what kind of information his partner has on him. As the use of the universal ID number is wide-spread not only the administration gains power over the individual, but also the private bodies which have access to the ID number. At the same time the administration can extend its power through the control of the data originating from the private sector. As a result, if personal profiles are created, it violates the right to human dignity.
3. The CC declared that there is no constitutional right or interest which could require the restriction of the informational self-determination resulting from data processing without defined purposes. The efficiency of the administration especially can not be regarded as such an interest, as there is no proof that the grave restriction of the informational self-determination is the only possible way of the efficient work of the administration.
4. Consequently the CC pronounced the unconstitutionality of the universal ID number, required the legislature to adopt an Act on personal data protection, abolished the universal ID number, prohibited the use of the universal ID number in official documents, registries, administrative or court procedures, imposed a ban on requesting the ID number for any purposes be it the exercise of a right or performing a duty. They only allow the registries use it provisionally for internal purposes as long as new systems based on non-universal but specialised ID numbers would be set up.
The new systems were to be constructed with specialised ID numbers useable only within the administrative sub-system and, for an interim period, as an internal code between the separated sub-systems. Meanwhile the CC had rendered void the appendices of a Governmental Decree as it, not much later, reintroduced the use of the universal ID number without regard to the fact that the health care card has its own registry number and also comprises personal data of the holder. The CC announced that it was unconstitutional to use two parallel identification systems for the same purpose and nor is it allowed to use the old universal ID number for the health care cards, as the administration is authorised only to use it as an internal ID. The Data Protection Act entered into force 1st May 1993, since then it explicitly prohibits the universal ID number.
In 1995 the CC abolished the universal ID the second time as the government adopted the economic stabilisation programme which upheld the once abolished ID number. They reaffirmed the above principles and noted that the logic of the universal ID number is contrary to the principles of the personal data protection, such as the purpose-bound nature of the data processing and the shared information systems. Without the latter the route of the personal data becomes untraceable which precludes the individual of exercising his fundamental rights. In this case the automatic connection of databases through the universal ID number might end up in a personal profile on which basis the administration takes decision although the profile will not perfectly correspond with the reality, but will leave the individual at the mercy of the administrative power.
Finally, in 1996 the universal ID number has been divided into three specialised ID numbers.The Tax ID Number is created by the tax authority, and it is shown on the Tax ID Card together with very basic personal identification data. Tax ID can be used only for the purposes regulated in different Acts by social security authorities, labour authorities, courts, law enforcement, national security bodies, private pension funds and health care institutions. The Health Care ID Number is created by the National Health Insurance Fund, contained on the Health Care Card together with very basic personal identification data. For purposes regulated by Acts the health care ID number can be used by health care providers, private pension funds and approximately the same sphere as authorised by law for the tax ID number. The third ID number is the old universal ID number which was renamed and its scope of use has been significantly limited. It can by used within the limits enacted by different Acts for the purposes of personal data and address register, registrars, embassy authorities, land-register, military register, election register, register of persons without suffrage, assessors register, criminal register, referendum, gun register, law enforcement, courts, national security and traffic authority. The different registers are allowed to contact each other in individual cases by connection codes (with some exceptions); the connection codes are temporary sequences and must be different from the three ID numbers. Personal data can be transferred only when the authority needs updated information for legal purposes, the transfer must be limited to those individuals whose data needs to be updated.
Political aspects
The abolishment of the universal ID number and its division into three specialised ID numbers seems to be irreversible. Any attempt to set up a new universal ID number would be considered by the public as an attack against the rule of law by giving up the data protection in Hungary. The key actors in this issue are the following.
The current President of the Republic, László Sólyom has been the first President of the Constitutional Court between 1990 and 1998, in the period when the public debate on the personal ID number has taken place. Throughout his Constitutional Court presidency he tended towards the German type of data protection which was determined by the Volkszählungsurteil of the German Federal Constitutional Court. The Constitutional Court time and again consistently cites the first decision on the abolishment of the universal ID number, their jurisprudence seems to be unchanged in the last fifteen years.
According to his common practice, developed since 1995, the Parliamentary Commissioner on Data Protection would also clearly oppose any change in this question and he would be backed by the civil society. Presumably it would also cause public unease, as the population considers ID numbers as generally prohibited and precariously use even its successor which has the same form as the old universal ID number.
The only window of opportunity to develop the current ID number practice is to leave the legal framework untouched and find solutions within the current system. The use of the connection codes can be further developed so as to enhance the work of the public administration and, at the same time, privacy concerns which are clarified by the Hungarian legal practice, must be also addressed. If individuals were enabled to follow the way of their personal data handled in any sector of the public administration (which they cannot at the moment), their right to informational self-determination would be highly enhanced. Thanks to IT technologies this improvement could, at the same time upgrade the quality of privacy and administration. As good governance is the antithesis of the surveillance state, privacy and user friendly ID number policy is contrary to the once dismantled universal ID number system.
ID number in the Czech Republic
Historical and legal aspects
Apparently there are some common aspects in the history of the ID number in the Visegrad group countries. The universal ID number persists from the communist time in the Czech Republic. In the 1980s of the twentieth century a massive data revision took place in Czechoslovakia as the automation of the data processing in the registries was introduced. After the verification of the registers a brand new regulation was adopted. It lasted for 18 years and the „rodné číslo“ (birth number) survived without sharing the fate of the Hungarian birth number which was split into three. The next regulation was adopted in 2000 and it is the one still in force with amendments from 2004. The administrator of the register of inhabitants is the Ministry of Interior.
The ID number is widely used both in the various fields of public administration such as election register, land register, tax register, social security register and in the private sector. In 2004 the Office for Personal Data Protection has issued an interpretation on the use of the Act. No. 133/2000 Coll. after it was amended. They pointed to several risks which might be solved by the amending Act. The Office has been entrusted by a new competence to impose sanctions for “other administrative torts” in case of unauthorised disposal or utilisation of a birth number. An administrative delict has been also introduced for legal person or any natural person - entrepreneur that repeatedly make unauthorized utilisation of birth numbers.
The amending Act regulates that the birth number ‘may be used by the subjects listed in the said provision, i.e. ministries and other administrative authorities, bodies authorized with the exercise of state administration, courts when acting within their jurisdiction defined by law, and notaries in administering the Central Register of Testaments’ and these authorities ‘may act only for what the law authorizes them, they are obliged to enable bearer to do the choice of the identification data whenever the Act enables the selection to use as an identification data the birth number or other personal data’. According to the legislator the purpose-bound nature of the data processing and the thriftiness with the data are the principles, backed by sanctions, which might result in a privacy friendly system.
A Bill which seems to be the greatest challenge to the right to privacy with regard to the ID numbers has been mentioned by Vladimír Šmíd, Karel Schelle and Renata Veselá in their study. ‘The strategic documents of the government of the Czech Republic titled State Information Policy Way to Information Society dated 1999 and the State Information and Communication Policy e-Czechia 2006 dated 2004 envisage the advancement in the particular field up to an even higher level. The central idea thereof is the establishment of basic registers of public administration, which will extend usability of information systems, interconnecting subsystems and registers of public administration usable also for the needs of the general public, with the goal to achieve not only cost cuts but also acceleration of administrative processes, removal of duplicities and cuts in state machinery’. The Draft Bill on Data Sharing in Public Administration was proposed by Ministry of Informatics in 2005 and has not been adopted until the spring of 2007.
Political Aspects
In the Czech Republic there has not been much criticism on the use of the ID numbers. Sometimes the Head of the Office for Personal Data Protection warns the public not to disclose their birth number if it is not explicitly required by law. The Office was established only in 2000 and it might take many years before the population becomes privacy conscious.
In 2000 there was a national census (registering all population, houses and flats and other data), that has raised privacy concerns and civic protests, especially in the internet community. The administrative court later ruled that one question on the questionnaire form exceeded what the state is allowed to ask.
In 2006 the Finance Minister won a Big Brother ‘award for its proposal to create a new tax identification number that would be partly composed of the numbers on peoples’ national ID cards. An unsecured national ID number opens the door to identity theft’, as the data would be available in a database accessible by public’ – stressed the jury of the award.
ID number in the Slovak Republic
Until 1st January 1993 the history of the ID number for the Slovaks is the same for the Czechs as the two republics used to be the same country. In Slovakia there is a universal ID number that every citizen holds from birth (birth number). This number is used by all state registers in order to identify the person. During the communist regime, only the universal ID number existed, later a tax ID number has been introduced, but most institutions use the ID number.
The Slovak Data Protection Act prescribes that ‘[i]n the processing of personal data, an identifier of general application stipulated by a special Act may be used for the purposes of identification of a natural person only provided that its use is necessary for achieving the given purpose of the processing. Processing of a different identifier revealing characteristics of the data subject, or releasing of an identifier of general application shall be prohibited.’
The purpose-bound nature of data processing is enacted here as in the Czech Republic and in Hungary with the difference that in Slovakia only legal guarantees can safeguard the personal data in the public registries, but the registries are not split and the universal ID number is useable in all of them. As we can see above in the Slovak Data Protection Act, the 29/1994. (V. 20.) decision of the Hungarian Constitutional Court and the above cited interpretation of the Czech Office for Personal Data Protection of the same tenor as the Czech Data Protection Act stipulates, there exists a general approach in the three countries which means that no authority can request further identification details if the ID number is provided and is sufficient to identify a person. Therefore any further personal data is unnecessary.
In Slovakia there has not been much criticism about the universal ID number issue. The only concerns were about the protection of the ID numbers from unauthorised disclosure, but not from its existence.
References
ALDA 2006
Kristina Alda. Watching you. The Prague Post November 8th, 2006. See at: http://www.praguepost.com/articles/2006/11/08/watching-you.php ; See further details at: http://www.bigbrotherawards.cz/en/index.html.
LAZAROVA 2003
Daniela Lazarova. Personal data protection still a problem in the Czech Republic [13-02-2003]. See at: http://www.radio.cz/en/article/37530.
SMID, SCHELLE, VESELA
Vladimír Šmíd, Karel Schelle, Renata Veselá. The Never Ending Story or 15,000 years of attempts to register inhabitants. See at http://www.fi.muni.cz/~smid/neverendingstory.html
14 / 20 |