Supreme Court's Historic Order Demands Strict Law and Independent Regulator for Personal Data Protection
The Supreme Court has scrapped the mandatory national ID and directed the government to enact a separate law and establish an independent regulatory body for biometric data protection. With sensitive data of over 20.7 million citizens already collected, this verdict sets a crucial milestone in protecting digital rights.
Kathmandu. The Supreme Court issued a historic and far-reaching order last Friday on the confidentiality and security of personal details and biometric identity.
Hearing a writ petition (No. 082-DI-1514) filed by advocate Sarita Adhikari, the joint bench of Justices Sapana Pradhan Malla and Meghraj Pokharel scrapped the mandatory national ID and issued a directive order to the government to enact a special law to guarantee the security, protection, and confidentiality of sensitive personal information, including biometrics.
Although the Nepal government claimed to have formed a data security committee under the chairmanship of the Home Secretary and issued Security Standards 2082, the Supreme Court deemed it insufficient. Guidelines or standards issued by the executive or administrative bodies cannot guarantee the constitutional right to privacy under Article 28 and full protection of biometric data. The order states that a strict, transparent, and independent data protection act passed by Parliament must be enacted immediately for this purpose.
Since biometric details such as fingerprints and iris are unchangeable for life and extremely sensitive, any theft or leakage of such data causes permanent damage. The Supreme Court has ruled that an independent regulatory authority must be formed to prevent misuse of data, monitor, hear complaints, and take action.
Looking at the current situation and data security risks, the Department of National ID and Civil Registration has stated that it has collected details of over 20.7 million citizens and 539 data collection centers are active. However, due to the lack of strong cyber security infrastructure and a separate data protection law in Nepal, a serious risk of data leakage remains when data is exchanged with government and private banks.
The Supreme Court has directed that when banks or third parties verify data, a secure system must be built so that they do not directly access biometric details but only receive a yes/no answer through encryption and tokenization systems.
This decision will compel the government and Parliament to create a legislative act on data security and digital rights in Nepal. It has set limits on circulars or guidelines issued by ministries or the regulatory body Nepal Rastra Bank that could curb citizens' fundamental rights, thereby curbing administrative arbitrariness.
The principle has been established that when implementing technology and digital systems, citizens should face minimal hassle and rules should not be imposed that halt citizens' economic life. Citizens' sensitive biometric data such as fingerprints and retina will be protected from misuse by third parties or commercial institutions.
The Supreme Court's decision does not put a complete halt to the journey of Digital Nepal, but rather lays the foundation to make it secure, responsible, and citizen-friendly. The decision sends a message that technology and digital identity services are tools for facilitation, not weapons to deprive citizens of their rights. Now, it would be wise for the government to move forward with the digital system only after immediately bringing a strict data protection act and forming an independent regulatory body.