EPAN – eGovernment WG Interoperability of eGovernment systems The identification number, data sharing and data protection issues Luxembourg, 12 May 2005

Public Research Center – Gabriel Lippmann Study by Public Research Center – Gabriel Lippmann Research Unit in Information Systems B. Otjacques (otjacque@lippmann.lu) & P. Hitzelberger (hitzelbe@lippmann.lu) Ordered by Ministère de la Fonction Publique et de la Réforme Administrative, Luxembourg EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Agenda Motivation Project Definition and Planning Main Results Conclusions Questions & Answers EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Motivation e-Government interoperability Single Identification Number for citizens and companies is one of the building blocks SIN underpins and eases Data sharing Must tackle Political, Legal, Organisational, and Technological Issues, among which Data Protection Issues EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Project Definition National Collaboration Ministère de la Fonction Publique et de la Réforme Administrative Centre de Recherche Public – Gabriel Lippmann, Cellule de Recherche, d’Etude et de Développement en Informatique Commision Nationale pour la Protection des Données Centre Informatique de l’Etat - Service du Répertoire général des personnes EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Project Definition Update of the Belgian study in 2001 on « Electronic identification of citizens and organisations in EU » Minutes of WG eGov, Nov. 2001: « … necessary for the future debate in this WG to split up the theme of unique id. keys, electronic signatures and electronic id. cards and treat them separately… » EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Project Definition Update of the 2001 Belgian study on e-Id Restriction of scope Limited to Single Identification Number Issue Excluded: PKI issues, electronic id. card Extension of scope 10 new Member States + 4 Candidate Countries Impact of Data Protection Issues on Data Sharing EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Project Planning Elaboration of the questionnaire (12/04 –01/05) Questionnaire sent to 25 + 4 States (01/05) 1st EPAN meeting (02/05) Analysis of the answers (03/05 – 05/05) Draft of final report presented at the 2nd EPAN meeting (12/05) Last modifications to the final report (06/05) EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results The global picture Drivers Better service to the citizen (e.g. Belgium, Sweden) Quest for efficiency (e.g. Sweden) Provision of personalised public services (e.g. UK) Reduction of risk of mistake (e.g. Cyprus, Lithuania) Financial factors (e.g. Sweden) New legislation (e.g. Hungary) Law enforcement purposes (e.g. Cyprus) Security issues (e.g. Cyprus, UK) EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results The global picture SIN? Risk evaluation Yes No Drivers (service, cost, security …) Risk evaluation SIN? Yes No Selected solutions SIN based sol. #3 SIN based sol. #2 SIN based sol. #1 Non SIN sol. #6 Non SIN sol. #5 Non SIN sol. #4 Legal Org. Techn. Interoperability L1 O1 T1 L2 O2 T2 L3 O3 T3 L4 O4 T4 L5 O5 T5 L6 O6 T6 Candidates Solutions (sect. spec. id, SIN …) Eval. criteria (cost, culture, data protect…) EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Use of identification number Is there a single identification number for natural persons in your country? EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Use of identification number Is there a single identification number for legal persons in your country? EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Use of identification number General trend to adopt a SIN for natural persons Exceptions: Germany and Hungary Main trend does not mean unique, standardised solution all around Europe Diversity in the solutions adopted! EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: technical construction of the SIN Chiefly two main groups Majority: Semantic coding (birth date, sex, others) Some countries use random numbers for the reason of data protection concerns Further differences of length and other details… EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: data linked to id. Number Minimalist approach: restricts data to identification needs (e.g. name, date of birth, sex, consecutive number) Multi-purpose approach: add and centralise sector specific data, e.g. financial, security or statistical-related data A couple of countries store historical data EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: groups of persons covered by SIN Common understanding: Citizens of a country In reality, some nuances! Residents Persons born in the country Foreign workers Migrants, refugees Persons who are liable to tax affairs EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: documents comprising the SIN Identity cards, passports Sector specific documents (e.g. social security card) Other types of documents: driving licence tax statements city transport cards documents for enrolling children at university EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: legislative framework for id. number(s) General legislation on Pers. Data. Protect. General legislation on Pers. Data. Protect. with specific provisions Specific legislations for specific id. numbers Legislation organizing national register EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: role of supervisory authority Variances concerning the situations when it has to be notified when it is consulted for comments when it has to be asked for authorisation Various exemptions to the notification requirements EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: 3 basic rights of the data subject Information and notification right Composition of the data set notified to the data subject: purpose of the processing, name & address of the controller recipients of the data, rights of the data subject, mandatory/optional nature of answers, consequence of refusal to answer, legal basis of the processing… Exemptions Consent of data subject, processing imposed by law… EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: 3 basic rights of the data subject Access right Data set that the data subject can access: Existence of processing, processed data, process purpose… legal basis of the processing in an intelligible form, progress of the processing, location where the data has been collected… Mode of access (id. card, online, e-mail, by writing) Exemptions to the access right Right to object No significant diversity EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Diversity: legal aspects of shared databases Yes, but under various conditions Prior check and authorisation of supervisory auth. (Austria, Belgium) Authorisation by specific law (Denmark, Malta) Kept up-to-date, not considered as reference (Belgium) Monitoring the admissibility of individual access (Germany) No, but mechanisms to exchange data Czech Rep., Hungary EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Main results Future: diversity of viewpoints No need to change the current approach (e.g. Germany) Plans to change the current approach (e.g. UK) Going forward with the current approach (e.g. Austria) Enlarging the current approach at the EU level (e.g. Belgium) Reflection for going backward with the current approach (e.g. Lithuania) EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Conclusions Similar general concern about privacy Nuances in the assessment of risk Diversity in the solutions adopted Evolution of current solutions still going on EPAN, eGov WG, 12.05.2005 Interoperability - Identification number

Conclusions Thank you for your attention… Questions & Answers EPAN, eGov WG, 12.05.2005 Interoperability - Identification number