China is considering a national cyberspace ID to safeguard data security and personal information, raising concerns among legal experts about tighter monitoring and social control.
Draft regulations issued last week by the Ministry of Public Security and the Cyberspace Administration would enable users to verify their identities online without disclosing sensitive personal information to internet service platforms.
According to the draft National Network Identity Authentication Public Service Management Measures, two forms of digital ID would be available through a national authentication app. The initiative is open for public comment until August 25.
The initiative aims to “protect citizens’ personal information, regulate the public service for authentication of cyberspace IDs, and accelerate the implementation of the trusted online identity strategy”.
The 16-article initiative proposes a unified network number, composed of letters and numbers, and a digital authentication credential, both corresponding to a user’s identity, so that no personal details would be revealed.
The system will be voluntary and “maximally reduces the over-collection and retention of citizens’ personal information by internet platforms under the pretext of implementing real-name registration”, the draft said.
Legal experts have expressed concerns over the proposal’s implications for privacy and government oversight. They warn that while it ostensibly aims to enhance privacy, the initiative could also intensify surveillance over individuals’ online activities.
Shen Kui, a law professor at Peking University, acknowledged that a unified network identity could simplify the authentication process during online transactions and make the misuse of personal information less likely.
“The fewer entities that collect actual personal identity information, the smaller the possibility of being asked to provide personal information beyond the necessary scope,” he said.
Shen said the initiative would also “lower the likelihood of those entities that collect and store user information leaking or illegally using that information”, in an article published on the WeChat account of the university’s Centre for Constitutional and Administrative Law.
But he cautioned that the notion of mandating a uniform network identity raises fears of a centralised surveillance system that could comprehensively track and analyse an individual’s online footprint.
At the moment, traces of a person’s online activities are fragmentally stored in “multi-centred, commercial service-providing platforms”, he wrote. Each platform can only capture “part of one’s identity”, such as shopping preferences and political opinions.
However, a unified network ID could connect all online activities to real identities via a centralised system, risking “complete exposure,” which would make users hesitant to express opinions, engage in discussions and explore freely online, Shen wrote.
“The vibrancy of the digital economy and internet society relies on a multi-centred system rather than centralised monopolies.”
Shen was also sceptical about the feasibility of the “voluntary” principle, suggesting that official promotion of the initiative is likely to lead to widespread adoption and user choice could eventually be eliminated if platforms mandate real-name registration using the credentials.
Lao Dongyan, a criminal law professor at Tsinghua University, had similar concerns. The network certificate system implies that accessing the internet or online services will effectively become “a privilege that requires permission to enjoy”.
Without the certification services provided by authorities, individuals will struggle to access internet services to comment and express opinions, she wrote on her Weibo account.
“The measures will bring significant social risks,” Lao said. As departmental regulations, they would “obviously lack a legal basis from higher laws,” she added.
According to the notice, the draft regulation is grounded in several national laws, including those relating to cybersecurity, data security, and personal information protection, as well as telecommunications and online fraud.
Lao questioned the necessity of a standardised network identity, noting that more than a billion internet users in China have already registered under existing real-name policies.
07:30
Why China is tightening control over cybersecurity
Why China is tightening control over cybersecurity
Weibo users were first asked to register their real names in 2017. Since then, the rules have been updated several times as Beijing intensifies efforts to clean up the nation’s cyberspace and tighten its grip on the internet.
According to Lao, implementation of the new rules will be similar to the Cyberspace Administration’s real-name registration policy, covering instant messaging programmes, microblogs, online forums and other communication websites.
“The true intention is to regulate people’s behaviour online. The claim of protecting personal information is merely a facade, at least not the primary goal,” she wrote.
Lao said the system will act like “a monitor for everyone’s online activities” and likened it to China’s health code app that was introduced during the Covid-19 pandemic.
The new system essentially “normalises and regularises social control”, just like the health code during the pandemic, she said.
