Civil Registry - knowing you by the company you keep

02 Nov 2017 - Cambridge, MA

Image of a paper pile to pose as the Brazilian bureaucracy

This piece is part of the Identity and Internet Series, written by Yasodara Cordova of Harvard Kennedy School and Coding Rights, a member of the Privacy International Network. It does not necessarily reflect the views or position of Privacy International.

Original in Portuguese

“Where were you born?” — a simple question whose answer says much about an individual. The place of birth and kinship information, both recorded on the Brazilian birth certificate, can indicate ethnicity and therefore cultural customs, among other things. This is information that should be kept more protected now that we live in the information age. The birth certificate is just one in a sea of registries, all of which share one objective: to show the “where, when, how and with whom” about someone, from their birth to death.

The civil registry, regulated by the Public Records Act of 1973, lists essential information about the social role of an individual in a given society. The biological sex, name, emancipations, interdictions, adoptions, marriages and deaths must all be listed in exchange for social benefits and rights.

The government, notary offices and other entities involved in the regular maintenance of these databases continue to work to enhance the integration and inter-operability of registries, with the idea that wide access to the information results in fewer cases of fraud. A recent decree (number 8,798 of 2016) made the sharing of the databases mandatory, together with the provision of an online consultation service for each registry.

Databases containing personal information are being integrated, and the information is held in an opaque manner. For the sake of public service efficiency and fraud prevention, government agencies held discussions about the integration of private citizen’s data behind closed doors between 2013 and 2015. None of the decrees aiming to enhance inter-operability of the personal information databases that were passed in this period were subject to a public debate. Privacy as a right, in many management spheres, is commonly considered the exclusive concern of social networking services.

Without wide-ranging debate, society loses the chance to evolve and innovate the citizen’s right to information, freedom of expression and self-determination.

Birth, Death, Marriage and other registries

Civil registry certificates are used as proof of marital status in Brazil. Depending on the type of certificate, it can attest whether someone is single, married, widowed, separated, divorced or dead. They inform the state that someone exists. A “Live Birth Declaration” (known as the DNV, or “declaracão de nascido vivo”), is a required and preliminary component of the birth record. They are both integrated into the National Civil Registry Information System (known as the SIRC). With this statement, the guardian of the child is required to go to an office to have the birth certificate made.

This document only became free of charge in 1997. Currently, the primary data it contains is: the day, month, year and time of birth;

  • the biological sex of the child;

  • the given name and name of the parents;

  • the names and surnames, the place of birth, profession, domicile and residence of the parents;

  • the age of the mother at the time of delivery;

  • the names and surnames of the paternal and maternal grandparents; and

  • the names and surnames, profession and residence of the two witnesses of the register, if the birth did not happen in a hospital maternity ward.

A discussion about which kind of data should be collected must precede any discussion of inter-operability between data sets. Without a debate about privacy practices of the government, data ecosystems can disadvantage the citizen. For example, using these certificates, genetic information can be combined with health data and create inconsistencies in the distribution of benefits.

The case of indigenous Brazilian citizens also throws up challenges. Indigenous Brazilians are not legally required to have a birth certificate. Curiously, their right to land derives from their family tree and lineage. The right to self-determination, to qualify themselves as indigenous, does not exist; their registration depends on the assessment of anthropologists working at a governmental agency, the FUNAI (Brazilian Indigenous National Foundation). Only FUNAI can collect personal data from indigenous populations in Brazil, or authorise the collection and distribution of certificates of registry. Some descendants of Brazilian slaves, called Quilombolas, cannot declare their origins in their birth certificate. Their data is collected and managed by the SEPPIR (Secretariat of Policies for the Promotion of Racial Equality), which has a decentralised committee responsible for the coordination of data collection, although it has no clear guidelines or policies around the privacy of these communities, according to the manual for the Quilombolas Public Policies of the Federal Government. Not by chance, all the reports can be accessed on the website called “Monitoramento”, or “monitoring”.

Integration: official notaries go online

The government created the SIRC, also known as the Integrated System of Personal Records, in 2014. A Brazilian presidential decree states that notaries should periodically send the data recorded in their systems to a single, centralised database that will be under the supervision, management and analysis of a steering committee formed by the government. This committee has a mandate, in addition to other activities, “to authorise access to the data of the SIRC”.

The regulation does not detail the parameters for access, nor any limits to access, of personal data; it also does not require anonymisation of information. Among various agencies, such as the INSS (National Institute of Social Security), the Federal Revenue Service and the IBGE (Brazilian Institute of Geography and Statistics), data can be widely shared and combined. In the name of fraud prevention, there is an exchange of data between multiple agencies under the supervision of the Management Committee, which has broad powers over the system itself. It is an obscure cage, well-protected against audits.

The poor quality of state-owned websites gives a clue as to the limited IT capacity among government agencies. It is noteworthy that DATAPREV (Empresa de Tecnologia e Informações da Previdência Social), the national company that manages several systems that collect and store critical citizen data in Brazil, also lacks basic web security norms, like using HTTPS.

Some notary institutions, almost all of which are private, already have their systems of consultation and issuance online. It is not difficult to search the Internet for “online certificate” and, with only with a name, receive an electronic version of the civil registry certificate of anyone born in Brazil in the last 80 years. These services often make life easier for many people, as the cost of losing hours of work in queues at notary offices is particularly high.

As previously mentioned, from childhood, a Brazilian must present a birth certificate to access public schools and public health services. The document is required to obtain a National Identity Card, or for registration in social monitoring programmes of the government. Civil registries contain the names of grandparents, tracing the genealogical tree of all Brazilians. These datasets are facilitating projects like the one led by Jay Verkler, director and founder of Family Search and Findmypast, which are part of the Church of Jesus Christ of Latter-day Saints. These projects aim to scan birth and death records around the world to map the genealogy of all humankind.

The concept of the civil registry links to the idea of property, so information on marriages, deaths and divorces, which pledge the equal division of inheritance or the distribution of pension to widows, is necessary. It is no wonder that the CNJ (the National Justice Council in Brazil) also instituted a digitised and integrated system of real estate registration, which intends to aggregate information on registered property, simply by using the CPF number — “cadastro de Pessoas físicas” or “Individual Taxpayer Identification Number”.

Threats to privacy and freedom of expression

With the advent of connected platforms, an eagerness to collect and track citizens’ personal data arises as a solution to lend Internet-enabled efficiency to public service. The inability of government authorities to properly manage personal information makes them prime targets for exploitation by data brokers and malicious attackers. At the same time, the profusion of centralised databases as a response to security problems can be dangerous to democracy itself.

The preparation of the systems that hold the civil registry and its databases should be more broadly discussed. It is important to challenge the digital technology capacity of government bodies so data is not used in a discriminatory way. Ignoring the full potential of the Internet is to neglect the positive impact it can bring to society as a whole. Decentralisation of data management, a topic that has been debated both in academia and in the business world, should be explored for e-government as well.

The collective and collaborative shared control of resources, another promise of open government, depends on the integrity of the data and on the freedom of citizens to express themselves. Paraphrasing Jonathan Zittrain at the Harvard Magazine: “Over time, continued leaks will lead people to keep their thoughts to themselves, or to furtively communicate unpopular views only in person. That does not seem sustainable to me, and it doesn’t seem healthy for a free society.”

Self-determination can be facilitated by data sovereignty. When an individual has the agency to define their gender directly through the internet, the entire society gains not only from de-bureaucratising processes, but also from the social empowerment of citizens. Furthermore, it can assist in discussions currently viewed with biased judgment in most courts. The dispute over the formalisation of the social name, especially for transgender people or those wishing to change their first name for any reason, could easily be resolved using the Internet as a platform for citizenship.

The irresponsible and opaque retention of personal data facilitates fraud. The Internet has brought profound changes to how we live and relate. A change in the way we view the publication of information in the civil registries is something that should also be re-thought, since privacy protection is of paramount importance for the development of a democratic society.