Child biometric identification in Pakistan: A new threat to privacy?

On 1 January 2025, Pakistan introduced a system to collect biometric data from children aged between 10 and 18 as part of its civil registration process.

T

his new system is part of a series of reforms driven by the National Database and Registration Authority (NADRA) and the Ministry of Interior, with the stated aim of preventing identity document fraud and combating human trafficking. However, like other mass identification projects, this initiative raises ethical and security concerns that warrant critical examination. 

The new system implemented in Pakistan for registering children’s biometric data is based on the Child Registration Certificate (CRC), also known as the B-form. This document formalises the child’s existence within NADRA and is a fundamental requirement for accessing other identification services and civil rights. 

Requirements and procedure of Pakistan’s identification project 

To obtain the CRC, parents must meet certain basic requirements. It is mandatory to provide proof of the child’s birth, which can be issued by the Union Council either in Pakistan or abroad. Additionally, one parent must hold a National Identity Card (NIC) or a National Identity Card for Overseas Pakistanis (NICOP). 

The registration process can be completed through two channels: 

1. NADRA Registration Centres (NRC): Parents must visit one of the numerous centres distributed across the country to complete the process. Once there, a token is issued, the child’s photograph is taken, and fingerprints are recorded, along with a signature if possible. The data is then entered into the system, generating a form that must be reviewed and validated before final submission. If both parents are present during registration, their biometrics are also recorded, removing the need to have the form attested by a public official. 
2. Pak ID Mobile Application: This option is available exclusively for children under one year old, allowing parents to complete the registration process entirely online, without the need to visit a physical centre. 

Future phases of the project 

This initiative is not limited to the initial collection of biometric data from children aged 10 to 18. In upcoming phases, the scope will be expanded to include more advanced registrations, incorporating iris, fingerprint, and facial biometrics. These records will be managed directly by the Union Councils. 

Additionally, the Pak ID mobile application will undergo updates aimed at providing a more efficient user experience for citizens. These improvements include process automation and the integration of new features to enhance access to digital identification services. 

Risks and concerns 

Not all digital identification projects are the same and having transparent and concise information is essential. The collection of biometric data from minors raises ethical questions: to what extent are these practices invasive, or what does state interference in private lives through these mass records mean? 

Risks to children’s privacy 

Children do not have the capacity to fully understand the implications of giving away their data, making them vulnerable to decisions that could affect their privacy throughout their lives. Furthermore, the use of sensitive data such as fingerprints and facial photos could be exploited by third parties, especially if robust protection measures are not implemented. 

Vulnerability to hacks and leaks 

The centralisation of data in NADRA increases the risk of cyberattacks. Historically, biometric identification systems have been frequent targets for hacks. If the data of thousands of children were compromised, the consequences would be severe and irreversible, as biometric data cannot be changed like other types of information. 

Misuse of data 

There is a risk that biometric data may be used for purposes other than those originally intended, such as mass surveillance. In a context where data protection is not fully guaranteed, this could lead to overregulation and social control, limiting the freedom of minors. 

Impact on Children’s Future 

Biometric registration from an early age could have long-term implications. Children could become permanently identified by this data, limiting their privacy and autonomy. This could have negative effects on their freedom of movement and future opportunities, especially if the data is poorly managed or misused. 

A critical approach to the biometrics of minors 

Although the measure has logical objectives such as preventing fraud and human trafficking, it lacks adequate public debate and clear measures to protect the rights of minors. Additionally, less invasive alternatives should be considered to achieve the same goals. Personal data should only be given with absolute control granted to the user, including the possibility of deleting it at any time. 

For example, the system could focus on improving existing controls in identity documents without resorting to the mass collection of biometric data. It is also crucial to strengthen data protection laws in Pakistan to ensure that biometric data is not misused or exposed to risks. 

The biometric data collection project for minors in Pakistan raises an important discussion about the balance between security and privacy. While the stated objectives are commendable, the risks associated with the centralisation of biometric data for minors could outweigh the benefits. The lack of a robust regulatory framework, the absence of transparent public debate, and the failure to embrace self-sovereignty make this measure a controversial issue that requires significant review and adjustments to protect the rights of future generations.