By Children’s Health Defense (CHD) today sent a letter to U.S. regulatory authorities urging them to ensure that digital ID systems — if adopted at all — remain voluntary and optional for citizens.
The move follows the Biden administration’s release last month of a national cybersecurity plan that includes a strategic initiative to develop a “digital identity ecosystem.”
Biden’s initiative relies on the work of the National Institutes of Standards and Technology (NIST), the federal agency charged with providing “technical requirements for federal agencies implementing digital identity services.”
NIST, which is part of the U.S. Department of Commerce, plans to publish a revised edition of its digital identity guidelines later this year.
Miriam Eckenfels-Garcia, director of CHD’s Electromagnetic Radiation (EMR) & Wireless program, said when the agency revises its guidelines, it must clarify that digital IDs must be voluntary and optional.
In her letter to NIST’s digital ID program leader, Ryan Galluzo, Eckenfels-Garcia informed the agency of a recent Los Angeles Superior Court order that upheld residents’ right to navigate the city with a traditional ID, rather than a digital ID.
“To avoid conflict with the Court order,” Eckenfels-Garcia wrote, “… please ensure that appropriate references are made to digital identification as voluntary [emphasis original] or optional [emphasis original].”
The court order came as a result of a “smart city” lawsuit brought by CHD and two Los Angeles residents who were concerned that the city’s SmartLA 2028 initiative — launched in 2020 to create “a highly digital and connected city” by 2028 when the city will host the Summer Olympics — might violate their and their children’s privacy and consent rights.
Los Angeles’ SmartLA2028 plan included a panoply of digital infrastructure, including a surveillance camera network capable of capturing individual face and voice signatures that can be used for law enforcement or marketed to third parties.
The plan also aimed to create a single digital ID and login that each resident could use to access the city’s digital services.
The plaintiffs alleged that both California and federal law protect the right to know what personal information is collected, and the right to opt in or out of information sharing and sale.
CHD sought documents about the city’s current projects and future plans so the plaintiffs could exercise their consent and privacy rights.
A California judge on April 2 ordered the City of Los Angeles to release the documents, pointing out that the city’s Digital Code of Ethics recognizes residents’ right to navigate the city without digital ID and without having locational and other data tracked and stored.
France requires QR code to enter zones of Paris
Eckenfels-Garcia told The Defender that CHD’s win is especially important given what’s happening in France, which earlier this month announced people will need a digital pass to enter certain parts of Paris this summer as the city hosts the Olympic Games.
Anyone — including Paris residents — who want to enter certain zones will have to show a QR code on their phone.
Eckenfels-Garcia also noted that a Canadian municipality last month began requiring visitors to show a QR code to enter or leave the city.
“The U.S. must lead the way,” she said, “in ensuring that digital IDs remain voluntary and that privacy rights — including the right to opt out of digital tools that could be used for surveillance and control — are respected at all levels.”
She added, “We need to hold government agencies accountable and ensure transparency and adherence to existing laws and court orders — which is what we are asking NIST to do.”
Greg Glaser, one of the attorneys representing CHD and the Los Angeles residents, said one can “deduce” from NIST’s guidelines that digital IDs must remain voluntary and optional.
For example, a section in the guidelines says that consent is required when a person’s identity is being tracked — but that section doesn’t explicitly state that all digital IDs and their supporting technologies must be voluntary and optional, Glaser said.
“NIST needs to more prominently state the fact [that digital IDs are voluntary and optional] in the standard so that everyone can see it plainly.”
