Introduction

Turkey's attempt to introduce smart identity cards for citizens has been in development for several years. National electronic identification cards (eID) were introduced as part of the Information Society Strategy(1) in Action 46 of the Information Strategy Action Plan in 2006.(2) The first 14,000 national eIDs were issued in Bolu province in 2008 as part of a pilot scheme. The pilot phase finished in December 2014 and 25 million national eIDs are expected to be delivered to Turkish citizens under the Council of Ministers' Annual Plan for 2015.(3)

National eIDs

Identity security is of crucial concern to governments, which are responsible for national security, revenue protection and law enforcement. False identities are generally used for criminal activities and undermine border and citizenship controls, as well as e?orts to combat the financing of terrorism and financial crime. Identity theft is also a major invasion of privacy and a serious concern due to its legal and financial consequences. Countries began adopting national eIDs in order to combat these security challenges, as it is essential for all countries to ensure that the identities of people accessing government or commercial services, benefits, o?cial documents and positions of trust can be verified accurately.(4)

'National eIDs' are defined as "card-based identity documents with embedded storage tools, biometric, electronic or optical identifiers to facilitate the cardholders' electronic identification and authentication in addition to the visual identification typical of traditional national IDs". They are expected to be more reliable than traditional paper-based IDs since they will provide concrete data security due to in-built privacy features, such as using digital signatures to make forging IDs harder or even impossible; a duplicate national eID would need the digital signature embedded in the original. Citizens with national eIDs would have the ability to use a single means of identification for various di?erent services provided by government or private institutions, thus making it a multi-purpose card. Another advantage of national eIDs is their ability to authenticate citizens both in the real world and securely online. National eIDs can be used as trusted authentication tools (ie, digital signatures for both government and private transactions and even voting). Half of the world's population is expected to have chip-based national eIDs by 2018, while the global revenue generated by national eID programmes is expected to reach $54 billion.(5)

Transitional process

The national eID project developed from the Electronic Social Security Card Project, which was initiated by the Social Security Institution in 2006 as part of Turkey's e-transformation efforts. The stakeholders in the project included citizens integrated into the social security system. Since almost all citizens are covered by the social security system, it was decided to revise the Electronic Social Security Card Project into a national eID project. The Ministry of the Interior and the General Directorate of Civil Registration and Nationality were asked to coordinate the project within Action 46 of the Information Society Strategy Action Plan.

Pursuant to Prime Ministry Circular 2007/16, the new national eID will contain only static personal information and biometrics and will be used only for identification and authentication purposes. Agency or service-based smart card applications will not be allowed. The card will be in ID-1 format and equipped with appropriate visual and forensic security features. It will contain a contact chip developed by the Scientific and Technological Research Council of Turkey which takes relevant international standards into account, most notably the emerging European Committee for Standardisation (CEN) 15480 and International Organization for Standardisation (ISO) 24727 standards.(6)

The first stage of the pilot phase developed the chip and operating system and was completed in early 2008. The second stage of the pilot phase began in September 2008 when 14,000 cards were issued to citizens in cooperation with the Social Security Institution and the Ministry of Health in a district of Bolu province. The third stage of the pilot phase involved issuing national eIDs to all of Bolu's 250,000 citizens.(7) As of January 2015, the testing and piloting phases of the national eID project were completed and country wide distribution of eIDs has begun.

Legal framework

As of January 2015, national eIDs are mentioned only in one law and one regulation. Article 41 of Law 5490 on Civil Registry Services regulates Turkish IDs. On June 25 2009 an additional paragraph was added to the law, stating that national eIDs will replace other forms of IDs and will store the holder's fingerprint data. The biometric data cannot be recorded, held or stored anywhere other than the temporary memory used to transmit this data to the onset chip and the chip itself. The new paragraph states that national eIDs will be subject to the legal framework set out for traditional printed IDs. This point is likely to cause problems, as the legal ramifications arising from a traditional printed ID card and a smart ID card (which carries highly sensitive personal information) differ greatly. Therefore, the national eID requires a specific legal framework.

The legal gap for national eIDs is also a problem within the European Union where there is also no specific e-identification regulation. The proposed legislation for e-identification in the European Union has been pending since 2012.(8) The EU Electronic Signatures Directive (1999/93/EC) covers electronic signatures only. Similar to the European Union, Turkey has had a dedicated law for electronic signatures since 2004 (Law 5070 on Electronic Signatures), but no specific legal framework for national eIDs.

National eIDs are mentioned in Article 9 of the Regulation on the Methods and Principles of Evaluating Human Rights Violation Claims. It states that a human rights violation claim should bear the applicant's signature and, if the application is processed via mobile, electronic signatures or national eIDs, the requirement of including a signature will not be necessary. It is understood that national eIDs will bear the owner's electronic signature and could be used as a means for signing legal documents, as stated under various documents issued by the government in this regard.

Comment

The lack of specific legislation for national eIDs may have legal ramifications in the near future, especially in the context of privacy and data protection, as Turkey has no dedicated privacy and data protection law. Although the market for national eIDs is growing exponentially throughout the world and offers promising terms for fast return on investment, the lack of a clear legal landscape could cause problems for national and foreign investors and businesses operating in this market.

Gönenç Gürkaynak

İlay Yılmaz

This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.