Digital Governance

Adopt a legal instrument (such as a law or regulation) that defines what counts as DPI, states its purpose, names the responsible institution for each system, and makes open standards, interoperability, and public interest governance principles part of each system.

Maintain a centralised public register in the overseeing ministry of every system classified as DPI, to be updated at least annually. Alternatively, the DPI inventory could be included in other public and organizational records databases at agency or central levels.

• Public purpose: At minimum, the register should record purpose, legal basis, responsible institution, operators, categories of data processed, and a public contact point.

Publish an assessment of each system against existing access to information, data protection, and open format obligations, with a road map and timetable for closing the gaps and incorporating legal requirements into design. This roadmap can serve as an input for the system design phase.

Ensure the authority can receive and investigate complaints of DPI-related harm, inspect systems, require information, and refer cases for enforcement. Require it to report annually to the legislature and the public. (See the Open Gov Guidechapter on “Automated Decision-Making, Algorithms, and Artificial Intelligence” for more specific guidance.)

Supreme audit institutions, ombuds offices, consumer protection bodies, information commissioners, and legislative committees have governing statutes that may implicitly give them jurisdiction, but that should be made explicit. Where possible, extend (and fund) their mandates rather than building new bodies, such as by ensuring that they are able to report publicly on how they fulfill their mandates and can receive public complaints or open investigations as a result of public input.

Major systems can move goal setting and assessment through an existing open government forum, or create a dedicated body with standing civil society seats. This can include several actions, as seen in the list below.

• Publish selection criteria, terms of reference, and terms of service for civil society seats.
• Publish agendas, minutes, and decisions within a stated period of each meeting.
• Report on each major DPI system to the body at least twice a year.
• Include people who use the system, not only organizations that study it.
• Providing capacity-building, access to relevant technical documentation, and resources for participation (and outside observation) alongside the creation of formal participation opportunities
• Assign seats to multiple agencies with equities in the program early on in the design process, to ensure inter-ministerial coordination

Require human rights, data protection and privacy, and exclusion measures in impact assessments before a DPI system is deployed and again at regular intervals following deployment or when its purpose or scope changes. Publish them, and provide a period in which the public can comment before deployment proceeds. Canada’s Directive on Automated Decision-Making offers a model for the assessment, while the Philippine Identification System Act offers one for legislating safeguards before rollout rather than after.

Set aside funds to directly cover DPI governance. Ensure that these costs are embedded within the relevant government budgets and financing agreements from the outset, including where DPI is being financed through development assistance, loans or other external financing.

Publish enrollment coverage, authentication failure rates, exception rates, transaction failures, complaints, and appeal outcomes, disaggregated where the data allow, for each type of DPI system (such as ID or payments). Where the data show exclusion, publish the corrective measures, the deadline, the responsible institution, and regular progress to address it.

Consult membership organizations representing (or regularly serving) groups such as people without documents, people with disabilities, migrants, rural populations, and people with low literacy at the design stage, not after launch. Fund their participation, including the cost of travel and staff time, so that participation is not restricted to organizations and representatives that can already afford it. Structures to implement this may include an advisory board, design committee, adoption forum, or other multi-stakeholder participation bodies as described above.

Provide civil registration and legal identity credentials free of charge for digital ID and digital payment systems. Where fees apply to reissue credentials or process transactions, require that they be proportionate and published, and report on them periodically.

Write purpose limitation into the legal instrument, and require any new purpose to be authorised through a public process rather than an administrative decision. This can include several actions, as seen in the list below.

• Require every relying party, public or private, to register its use case in a public registry, stating the functions and data attributes it uses.
• Publish the registry and any additions to it before they take effect.
• Require published justification for each new connection to a DPI system.

Publish the agreements under which DPI data moves between agencies and between government and private parties, including law enforcement and intelligence agency access. Where the content of an arrangement is lawfully withheld, publish its existence, its parties, and its legal basis, and aggregate statistics on its use. Require systems to show users the identity of any party requesting data, money, or identification from them.

ournalists, researchers, and civil society organizations are the practical source of most evidence about how these systems fail. They are also exposed to risk for reporting on DPI-related issues, and should be protected accordingly. This can take several forms.

• Surveillance ban: Prohibit the use of DPI-derived data to profile, locate, or restrict journalists, human rights defenders, and civil society organizations, and provide a remedy when it happens.
• Retaliation bans: Prohibit the denial or withdrawal of DPI access as a response to protest, criticism, or political affiliation.
• Whistleblower protection: Establish a protected channel through which system operators, contractors, and independent researchers can report defects and misuse without retaliation.

Ensure DPI procurement undergoes competitive bidding and publish the process according to the Open Contracting Data Standard, including tender documents, awards, contract values, amendments, and beneficial ownership of the winning supplier. More recommendations can be found below. For details on open contracting best practices, see the Open Gov Guidechapter on “Open Contracting.”

• Exit provisions: Require exit provisions, data portability, and the right to migrate to another provider in every DPI contract, and publish those clauses.
• Modular buildout: Structure systems in modules so that components can be replaced independently.

Publish system architecture documentation and technical specifications. Adopt open standards and protocols across components, and publish the certification process. Where source code is publicly owned, release it under an open licence. Ethiopia, Morocco, and the Philippines have built national identity systems on shared open-source code, which is what makes migration and independent inspection possible.

Require contracts, licenses, and participation rules for private operators to carry transparency, auditability, data protection, non-discrimination, consumer redress, and public reporting obligations. Publish the allocation of responsibility and liability between public institutions and private operators for each system, and the remedies available when it fails. Settle liability and redress pathways before a system goes fully operational.

Publish dedicated budget lines for each major DPI system, covering build, operating, and maintenance costs, alongside fee and transaction revenue, in a published annual financial review.

• Independent accountability: Separate the role of regulator from the role of infrastructure operator.
• Rules for participation: Publish the rules on which providers may join the system, including non-discrimination conditions.
• Competition reporting: Report periodically on provider numbers and market concentration in each DPI system.

Designate complaint, appeal, ombuds, judicial, or quasi-judicial channels for DPI-related harm, and publish procedures, service standards, response times, and escalation paths.

• Responsible parties: Display the responsible public authority and its contact details on the system interface itself, including where the service is delivered by a third party.
• Complaint channels: Provide channels for complaints to be made offline and by telephone, not only online. This is important because the people most likely to need a complaint channel are the ones the system has already failed.

Establish in law that a user is not liable for unauthorized transactions or misuse of their credentials unless the operator can show otherwise. Publish the loss allocation rules in terms people can read and require auditable transaction records sufficient to resolve a dispute.

Require periodic independent audit of major DPI systems by supreme audit institutions, data protection authorities, or accredited third parties, covering exclusion and rights compliance as well as security. This can include the following actions.

• Audits: Publish audit findings, the corrective measures they generate, deadlines, and progress.
• Enforcement actions: Publish investigations, sanctions, contractual breaches, and corrective orders, subject to lawful privacy and security limits.
• Governance review: Assess whether governance mechanisms work in practice, not only whether they exist on paper.

Establish a transparent funding mechanism for civil society monitoring of major DPI systems, open to service-facing and non-technical organizations, and provide access to independent legal aid for people harmed by these systems.

• Case disposition data: Establish channels through which monitoring findings reach the responsible institution, and publish what was done in response.
• Independent monitoring: Fund monitoring during piloting and early deployment, when the design is still changeable.
• Lifecycle learning: Encourage periodic or thematic public reviews of whether the underlying legal, institutional, business and technical arrangements supporting DPI are working as intended.