© 2023 International Bank for Reconstruction and Development/The World Bank 1818 H Street, NW, Washington, D.C., 20433 Telephone: 202-473-1000; Internet: www.worldbank.org Some Rights Reserved This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Nothing herein shall constitute or be considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, or of any participating organization to which such privileges and immunities may apply, all of which are specifically reserved. Rights and Permission This work is available under the Creative Commons Attribution 3.0 IGO license (CC BY 3.0 IGO) http://creativecommons. org/licenses/by/3.0/igo. Under the Creative Commons Attribution license, you are free to copy, distribute, transmit, and adapt this work, including for commercial purposes, under the following conditions: Attribution—Please cite the work as follows: World Bank. 2023. Identification for Development (ID4D): Diagnostic of ID Systems in São Tomé e Príncipe, Washington, DC: World Bank License: Creative Commons Attribution 3.0 IGO (CC BY 3.0 IGO). Translations—If you create a translation of this work, please add the following disclaimer along with the attribution: This translation was not created by The World Bank and should not be considered an official World Bank translation. The World Bank shall not be liable for any content or error in this translation. Adaptations—If you create an adaptation of this work, please add the following disclaimer along with the attribution: This is an adaptation of an original work by The World Bank. Views and opinions expressed in the adaptation are the sole responsibility of the author or authors of the adaptation and are not endorsed by The World Bank. Third-Party Content—The World Bank does not necessarily own each component of the content contained within the work. The World Bank therefore does not warrant that the use of any third-party-owned individual component or part contained in the work will not infringe on the rights of those third parties. The risk of claims resulting from such infringement rests solely with you. If you wish to reuse a component of the work, it is your responsibility to determine whether permission is needed for that reuse and to obtain permission from the copyright owner. Examples of components can include, but are not limited to, tables, figures, or images. All queries on rights and licenses should be addressed to World Bank Publications, The World Bank, 1818 H Street, NW, Washington, DC, 20433; USA; email: pubrights@worldbank.org. Cover photo credits: World Bank. Table of Contents Executive summaryi Main findings��������������������������������������������������������������������������������������������������������������������������������������������������������������� i Prospects for reform�����������������������������������������������������������������������������������������������������������������������������������������������iii Introduction1 Key concepts���������������������������������������������������������������������������������������������������������������������������������������������������������������1 Digital ID systems: opportunities and risks�����������������������������������������������������������������������������������������������������2 Country context���������������������������������������������������������������������������������������������������������������������������������������������������������2 Geography, politics, and demographic profile���������������������������������������������������������������������������������������������3 Economy and poverty�����������������������������������������������������������������������������������������������������������������������������������������3 Administrative divisions and decentralization���������������������������������������������������������������������������������������������4 Access to electricity, internet, and mobile communication���������������������������������������������������������������������4 Digital government strategy and identification�������������������������������������������������������������������������������������������5 Civil registration and identification landscape in São Tomé e Príncipe�����������������������������������������������������7 General legal and institutional framework�������������������������������������������������������������������������������������������������������7 Legal and regulatory framework����������������������������������������������������������������������������������������������������������������������7 Institutional and administrative arrangements��������������������������������������������������������������������������������������������8 Institutional footprint and human resources������������������������������������������������������������������������������������������������9 Institutional strategy and synergies between CR and ID services�������������������������������������������������������10 Civil registration������������������������������������������������������������������������������������������������������������������������������������������������������� 11 Coverage����������������������������������������������������������������������������������������������������������������������������������������������������������������� 11 Registration processes�������������������������������������������������������������������������������������������������������������������������������������� 13 Infrastructure and IT������������������������������������������������������������������������������������������������������������������������������������������� 17 Collection, reporting, processing, and publication of vital statistics��������������������������������������������������� 18 Civil identification�������������������������������������������������������������������������������������������������������������������������������������������������� 19 Coverage���������������������������������������������������������������������������������������������������������������������������������������������������������������� 19 Registration processes������������������������������������������������������������������������������������������������������������������������������������� 20 National ID credentials�������������������������������������������������������������������������������������������������������������������������������������� 21 Infrastructure and IT������������������������������������������������������������������������������������������������������������������������������������������ 23 Data, interoperability, digital ID, and authentication�������������������������������������������������������������������������������� 23 Interoperability framework and platform��������������������������������������������������������������������������������������������������� 23 Digital identification������������������������������������������������������������������������������������������������������������������������������������������ 24 Online authentication platform���������������������������������������������������������������������������������������������������������������������� 24 Sectoral demand for identification and authentication services���������������������������������������������������������� 25 Summary: Sectoral use cases������������������������������������������������������������������������������������������������������������������������� 25 Social protection������������������������������������������������������������������������������������������������������������������������������������������������ 26 Education������������������������������������������������������������������������������������������������������������������������������������������������������������� 28 Financial inclusion and mobile money�������������������������������������������������������������������������������������������������������� 29 Public administration���������������������������������������������������������������������������������������������������������������������������������������� 30 Other functional systems���������������������������������������������������������������������������������������������������������������������������������� 31 Recommendations����������������������������������������������������������������������������������������������������������������������������������������������������� 32 Revise CR and ID legislation��������������������������������������������������������������������������������������������������������������������������� 32 Adopt a harmonized government strategy for civil registration, identification, and digital identity�������������������������������������������������������������������������������������������������������������������������������������������� 32 Improve quality of service and inclusion���������������������������������������������������������������������������������������������������� 33 Reinforce the DGRN’s institutional capacity���������������������������������������������������������������������������������������������� 33 Reinforce the link between CR and ID��������������������������������������������������������������������������������������������������������� 35 Integrate DGRN’s services into the national interoperability platform and deploy identification services and authentication mechanisms���������������������������������������������������������� 36 Upgrade and improve the ID credential and system��������������������������������������������������������������������������������37 Annexes�������������������������������������������������������������������������������������������������������������������������������������������������������������������������� 39 Annex 1: Birth declaration form�������������������������������������������������������������������������������������������������������������������������� 39 Tables Table 1: List of registration centers����������������������������������������������������������������������������������������������������������������������������9 Table 2: Summary of key information���������������������������������������������������������������������������������������������������������������������� 11 Table 3: Birth registration, 2019�������������������������������������������������������������������������������������������������������������������������������� 13 Table 4. Summary of key information�������������������������������������������������������������������������������������������������������������������� 19 Table 5. Overview of student enrollment and number of professors���������������������������������������������������������� 28 Table 6: Examples of privacy-enhancing technologies and operational controls������������������������������������ 35 Table 7: Potential benefits of a unique identity number for service delivery�������������������������������������������� 36 Figures Figure 1. 10 identification principles for sustainable development: toward the digital age���������������������2 Figure 2: Former DGRN center in the capital�������������������������������������������������������������������������������������������������������10 Figure 3: New DGRN center in the capital������������������������������������������������������������������������������������������������������������10 Figure 4: Main entrance of the center��������������������������������������������������������������������������������������������������������������������10 Figure 5: Side entrance for ID card issuance��������������������������������������������������������������������������������������������������������10 Figure 6: Evolution of birth registration for children under five between 1975 and 2019���������������������� 12 Figure 7: Discrepancies in birth registration for children under five, 2014 and 2019������������������������������� 12 Figure 8: DGRN post’s services in Neves��������������������������������������������������������������������������������������������������������������� 14 Figure 9: Entrance to birth registration services at the capital’s hospital��������������������������������������������������� 15 Figure 10: Birth registration post at the capital’s hospital������������������������������������������������������������������������������� 15 Figure 11: Cédula pessoal�������������������������������������������������������������������������������������������������������������������������������������������� 15 Figure 12: ID database entries, 2021, by gender������������������������������������������������������������������������������������������������� 20 Figure 13: ID database entries, 2021, by age������������������������������������������������������������������������������������������������������� 20 Figure 14: ID card issuance by type, 2022������������������������������������������������������������������������������������������������������������ 20 Figure 15: Paper-based ID card, recto������������������������������������������������������������������������������������������������������������������� 22 Figure 16: Paper-based ID card, verso������������������������������������������������������������������������������������������������������������������� 22 Figure 17: Polycarbonate ID card, recto���������������������������������������������������������������������������������������������������������������� 22 Figure 18: Polycarbonate ID card, verso��������������������������������������������������������������������������������������������������������������� 22 About ID4D The World Bank Group’s Identification for Development (ID4D) Initiative harnesses global and cross- sectoral knowledge, World Bank financing instruments, and partnerships to help countries realize the transformational potential of identification (ID) systems, including civil registration (CR). The aim is to enable all people to exercise their rights and access better services and economic opportunities in line with the Sustainable Development Goals. This is especially important as countries transition to digital economies, digital governments, and digital societies, where inclusive and trusted means of verifying identity are essential to ensure accessibility and data protection. ID4D operates across the World Bank Group with global practices and units working on digital development, social protection, health, financial inclusion, governance, gender, and data protection, among others. To ensure alignment with international good practices for maximizing development benefits and minimizing risks, ID4D is guided by the 10 Principles on Identification for Sustainable Development, which have been jointly developed and endorsed by the World Bank Group and over 30 global and regional organizations (see http://idprinciples.org). ID4D makes this happen through its three pillars of work: 1. Thought leadership, research, and analytics to generate evidence and fill knowledge gaps 2. Global public goods and convening to develop and amplify good practices, foster collaboration across regional and global stakeholders, and support knowledge exchange 3. Country and regional action through financial and technical assistance to realize inclusive and trusted ID and civil registration systems The work of ID4D is made possible through support from the Bill & Melinda Gates Foundation, the UK Government, The French Government, The Norwegian Agency for Development Cooperation (Norad), and the Omidyar Network. To find out more about ID4D and access our other publications, visit www.id4d.worldbank.org.   Acknowledgments This report was prepared by Emmanuel Vassor, Claudio Machado, and Daniel Nogueira-Budny as a joint effort of the World Bank’s Digital Development Global Practice and Identification for Development (ID4D) initiative. The team thanks the World Bank São Tomé e Príncipe Country Management Team: Juan Carlos Alvarez, Country Manager and the Country Offices in São Tomé and Luanda, Angola; World Bank Practice Managers: Vyjayanti Desai and Isabel Neto for guidance and valuable feedback; and the ID4D Team, notably Marie Eichholtzer and Matthias-Sönke Witt. The team also thanks Marga de Loayza for her administrative support with the diagnostic. The report would not have been possible without the contributions of many members of the São Tomé and Príncipe government who generously provided their expertise and time to facilitate this mission. This includes the Digital São Tomé and Príncipe focal point, Chicher Diogo; members of Ministry of Justice, Public Administration and Human Rights (MJAPDH); Silvestre Apresentação and the General Directorate of Registries and Notaries (DGRN); the Institute of Innovation and Knowledge (INIC); the Ministry of Infrastructure and Natural Resources (MIRN); and authorities in the Autonomous Region of Príncipe. The team is also grateful to the United Nations Children’s Fund (UNICEF) and to the Digital São Tomé and Príncipe Project Implementation Unit (PIU)—including, particularly, the project coordinator Daniel Vaz—for their support. Acronyms AFIS Automated Fingerprint Identification System BCSTP Central Bank of São Tomé e Príncipe BI Identification Card (Bilhete de identidade) CEN National Electoral Commission COVID-19 Coronavirus Disease 2019 CORE-MIS Core Management Information System CR Civil Registration DFS Digital Financial Services DGRN General Direction of Registries and Notaries (Direcção Geral dos Registos e do Notariado) DITEI Directorate of Technology and Innovation DPSSF Directorate of Providence, Solidarity, Social Assistance and Family ENRPN National Strategy for Permanent Birth Registration EPI e-Participation Index GDP Gross Domestic Product GDPR General Data Protection Regulation GoSTP Government of São Tomé e Príncipe ICT Information and Communication Technology ID Identification ID4D Identification for Development IDEEA ID Enabling Environment Analysis INE National Statistics Office INIC Institute of Innovation and Knowledge (Instituto de Inovação e Conhecimento) INSS National Social Security Institute ITU International Telecommunication Union KYC Know Your Customer MDM Ministry of Health and Women’s Rights MICS Multiple Indicator Cluster Survey MINR Ministry of Infrastructure and National Resources MJAPDH Ministry of Justice, Public Administration and Human Rights (Ministério da Justiça, Administração Pública e dos Direitos Humanos) MLSFPT Ministry of Labor, Solidarity, Family and Professional Training MoH Ministry of Health NFIS National Financial Inclusion Strategy NGO Nongovernmental Organization NIF Taxpayer Identification Number NIS Social Identification Number NISS Social Security Identification Number NSIPI Sequential Number of Identification for Undocumented Persons ODA Official Development Assistance PENPS Social Protection Policy and Strategy PIN Personal Identification Number (Número de Identificação Pessoal) PKI Public Key Infrastructure PPP Purchasing Power Parity QR Quick Response SIGA Integrated System for Registry Management SIGE Integrated System of School Management SIIPS Integrated Social Protection Information System (Sistema de Informação Integrado de Protecção Social) STP São Tomé e Príncipe UIN Unique Identification Number UNDP United Nations Development Programme UNICEF United Nations Children’s Fund UPS Uninterrupted Power Supply VFP Vulnerable Families Program VPN Virtual Private Network WBG World Bank Group Executive Summary The Government of São Tomé e Príncipe (GoSTP) acknowledges the vital role of a robust civil registration (CR) and identification (ID) ecosystem in advancing digital transformation and enhancing service delivery. Its National Digital Government Strategy was adopted in 2020, detailing transformative initiatives that enhance digital public services across multiple sectors. This strategy underscores the pivotal role of digital ID and online authentication in providing services in the digital age. The GoSTP has taken significant steps to improve its CR and ID systems over the past decades, but challenges remain to be overcome for the country to fully leverage the potential of an inclusive, trusted, and reliable ID ecosystem that boosts economic and social development. This is a sine qua non for the introduction of a digital ID in São Tomé e Príncipe (STP), a key goal of any country looking to build an inclusive and resilient digital economy. This Identification for Development (ID4D) Diagnostic provides an assessment of the ID ecosystem in STP and proposes reforms based on international good practice. It is intended to support the implementation of the World Bank Digital São Tomé and Príncipe Project (P177158), which aims to strengthen data governance, data systems, and statistical capacity, and boost STP’s capacity for secure digital public service delivery by reinforcing and modernizing the CR and ID ecosystem. Main findings In STP, significant progress has been achieved in establishing foundational ID systems over the past few decades. This progress has been made under the guidance of the General Direction of Registries and Notaries (Direcção Geral dos Registos e do Notariado, DGRN), which is responsible for both civil registration and identification. Births are systematically registered in health facilities—where over 95 percent of births occur—and 98.6 percent of the entire population have their births registered. Similarly, authorities assert that they have nearly achieved complete death registration. In 2017, the DGRN initiated the digitalization of civil registration and identification systems with assistance from the Institute of Innovation and Knowledge (Instituto de Inovação e Conhecimento, INIC) and the Institute for Cooperation and Language of Portugal. By 2018, the Integrated System for Registry Management (SIGA) was implemented, enabling digital registration of life events nationwide. Additionally, the DGRN has worked on establishing a centralized civil registration database. SIGA now enables the registration of all types of life events. The civil registration centralized database includes birth data from 1920 to 2010, but birth registration data from 2010 to 2023 and data for other life events still need to be digitized and indexed. Civil identification is prevalent, and according to the DGRN, nearly 80 percent of the population have ID cards. Efforts are underway to enhance the synergies between civil registration and ID services, especially by making their systems interoperable to simplify data access during registration. However, challenges persist. The legal and regulatory frameworks governing CR and ID, which have their origins in colonial times, are scattered across different documents and, in some cases, outdated. In addition, the decree issued in 2018 that aims to modernize and digitize CR and ID processes shows limitations. In terms of data and cybersecurity, there is a Personal Data Protection Law and a i National Agency for Personal Data Protection. However, the national data protection regime did not anticipate some rules that have become an international standard since the approval and application of the General Data Protection Regulation (GDPR) and, despite the existence of a law on cybercrime, there is no law on cybersecurity. Proposals exist for an Electronic Signature Decree-Law and for a comprehensive e-government framework, including one for an interoperability national framework. However, they are not in force yet. Despite strong willingness to make progress, the DGRN lacks resources and capacity to develop a robust and reliable digital ID ecosystem that fully supports the GoSTP’s digital transformation strategy and benefits the population. Table ES.1 provides an overview of the key strengths and weaknesses of the civil registration and identification landscape in STP. Table ES.1. Key strengths and weaknesses of the civil registration and identification landscape ii Despite sectoral demand for ID services, those deficiencies prevent fully leveraging the potential of digital ID for boosting socioeconomic development. Demand for identification encompasses various sectors. Social protection programs cover most of the population and need reliable identity data to verify eligibility for programs such as targeted cash transfers. The education sector needs to be able to identify students at an early age and verify the identity of exam-takers. Financial service and mobile operators have a legal obligation to determine and validate the identities of their clients before delivering services. The public administration requires accurate information to fulfill its responsibilities, which include overseeing the disbursement of civil servants’ salaries and pensions as well as identifying taxpayers. Prospects for reform This report aims to support the GoSTP in identifying the most effective ways to tackle remaining challenges and maximize the benefits of digital ID for improving service delivery and advancing digital transformation efforts. This analysis of the CR and ID system is guided by the Principles on Identification for Sustainable Development.1 To maximize their developmental impact and minimize risks to privacy and exclusion, ID systems should—at a minimum—meet these principles, which are informed by global good practices and organized around three pillars of inclusion, design, and governance. They have now been endorsed by over 30 international organizations, donors, 1  See https://www.idprinciples.org/. iii nongovernmental organizations (NGOs), and private sector associations across Africa and other regions. Based on these practices and the country-specific context, recommendations are proposed in the final section of the report and summarized in Table ES.2. Table ES.2. Recommendations iv Introduction This section introduces the concept of identification systems, highlighting their components, including databases, processes, technology, credentials, and legal frameworks. It emphasizes the roles these systems play in managing and using personal identity data for various purposes. Key concepts An identification or ID system consists of the databases, processes, technology, credentials, and legal frameworks involved in the capture, management, and use of personal identity data for a general or specific purpose. The main technical components of an ID system usually consist of databases containing identity information and credentials provided by the system. These credentials, such as cards, personal identification numbers (PINs), or mobile applications, are used by individuals to verify their identity or specific attributes thereof. In addition, ID systems include a variety of platforms through which third parties can use these databases or credentials to verify or authenticate identities, such as interoperability layers that facilitate data exchange, queries, and identity-related transactions. In general, ID systems can be categorized as ‘foundational’ and ‘functional’. Foundational ID systems are created with the goal of providing general identification and credentials for a variety of purposes and typically include civil registers, national ID cards, population registers, and more. In contrast, functional ID systems are designed primarily to provide identification for a specific purpose or sector, such as voter registers, tax ID numbers, social protection registers, and driver’s licenses, among others. Functional ID systems typically maintain databases with attributes specific to their purpose that are used for authorization—such as poverty scores and household assets for social protection or annual income for tax systems—and may or may not issue their own credentials. Together, the collection of foundational and functional ID systems within a country constitutes the identity ecosystem. As defined by the United Nations, civil registration is the “continuous, permanent, compulsory and universal recording of the occurrence and characteristics of vital events pertaining to the population, as provided through decree or regulation in accordance with the legal requirements of each country.” In practice, this implies that civil registration primarily covers vital events occurring within a specific territory or jurisdiction (and possibly for citizens living abroad). In a civil registration system, the critical focus is on recording events, while in an identification system, the central focus is on individuals. 1 Digital ID systems: opportunities and risks Inclusive and trusted ID systems can empower individuals to exercise their rights more effectively and facilitate their access to a wide range of services, both in offline and online contexts, while also promoting participation in the formal economy. In parallel, they can increase the government’s capacity for efficient design and delivery of services and benefits. They can also create benefits for the private sector by facilitating easier customer and employee onboarding and enabling new, digital channels for service provision. At the same time, despite the opportunities that come with improving identification, poorly implemented or inappropriately used identification systems can create several risks. Such risks include exclusion and discrimination, privacy and security violations, and unsuitable or unsustainable technology and design choices, which may lead to fragmented ecosystems and vendor and technology lock-in. To maximize the benefits of ID systems for development, these risks need to be adequately addressed. Alignment with international frameworks and good practices, such as the Principles on Identification for Sustainable Development can help mitigate risks and ensure that the transformational potential of digital ID systems is realized. 2 Figure 1. 10 identification principles for sustainable development: toward the digital age Source: Principles on Identification for Sustainable Development. Country context This chapter provides an overview of São Tomé and Príncipe’s geographical, political, and demographic profile, highlighting its status as a small insular country in the Gulf of Guinea with a parliamentary republic government structure. It also addresses the country’s physical and digital infrastructure, noting limited access to electricity, internet, and mobile communication. The chapter emphasizes the commitment of the Government of São Tomé e Príncipe (GoSTP) to digital transformation as outlined in the National Digital Government Strategy, adopted in 2020. This strategy emphasizes the importance of digital ID and online authentication in enhancing digital public services and acknowledges existing challenges in fully leveraging the potential of a robust civil registration and identification ecosystem for socioeconomic development. 2  See https://www.idprinciples.org/. 2 Geography, politics, and demographic profile The Republic of STP is a small island country located in the Gulf of Guinea, 350 km off the coast of West Africa. The archipelago is composed of several islets and two main islands: São Tomé (divided into six districts) and Príncipe. STP is a parliamentary, unitary republic (though the island of Príncipe is recognized as an autonomous region). The country has a fast-growing population of approximately 219,000 inhabitants, 90 percent of whom live on the island of São Tomé. About 42 percent of the population is 14 years old or younger. 3 Considerations for CR and ID. Ensuring universal access to civil registration and identification services for the insular population can present a challenge. Discrepancies in access to identification between islands and among more privileged and less privileged segments of the population can further fuel inequalities in terms of access to services. Economy and poverty In 2022, the country’s per capita gross national income was estimated at US$4,770 in purchasing power parity,4 and its per capita gross domestic product (GDP) at market exchange rates was US$2,404.5 Two-thirds of the population live below a poverty line of US$3.20 per person per day; around one-third live on less than US$1.90 per person per day.6 STP’s development challenges are typical of small island nations, including low government capacity, an undiversified production base, and isolation and poor connectivity to global markets. STP’s economy has grown modestly over the past two decades and remains highly dependent on official development assistance (ODA). ODA and inflows of foreign direct investment following potential oil development in the first decade of the 2000s supported STP’s market reforms and played a pivotal role in the country’s modest economic growth over the past two decades. While inflows and growth started slowing after 2015, a large increase in external grant financing offset the negative impact of the Coronavirus disease 2019 (COVID-19) pandemic on the tourism sector, allowing the economy to grow in 2020. The COVID-19 outbreak in STP has been among the worst in Africa on a per capita basis (2,817 cases per 100,000 inhabitants as of March 30, 2022). STP’s economy was hit by a near-total halt in tourism, one of the main growth drivers of the economy before the pandemic, as well as mobility restrictions to contain the spread of the virus. According to government statistics, however, these pandemic-related shocks were more than offset by increased government spending and investment, financed by exceptionally large donor financing. Real GDP growth is estimated to have slowed from 3.1 in 2020 to 1.8 percent in 2021 as international financing was scaled back due to lower COVID-19 emergency support. Global travel restrictions continued and prolonged energy shortages in mid-2021 disrupted further economic activity. 3  United Nations Population Division (2020). World Population Prospects: World Bank estimates based on age/sex distributions of United Nations Population Division’s World Population Prospects. 4  See https://databankfiles.worldbank.org/public/ddpext_download/GNIPC.pdf. 5  See https://data.worldbank.org/country/sao-tome-and-principe. 6  See https://www.wfp.org/countries/sao-tome-and-principe. 3 Considerations for CR and ID: The poor economic performance can negatively affect the government’s fiscal capacity to deliver services in the most hard-to-reach areas. This can also increase barriers to civil registration and ID delivery for the most vulnerable populations, for instance, due to high opportunity cost of forgoing work to access CR and ID services. A potential positive impact is the incentive for the government to enhance resource management. This, in turn, drives efforts to bolster digital identity verification, authentication mechanisms, and promote interoperability among various registries and systems, particularly in the context of service delivery. Administrative divisions and decentralization STP’s territory is divided into six districts (dividing the island of São Tomé) and an autonomous region (the island of Príncipe) as described below: • Island of São Tomé: • Água Grande, capital São Tomé • Cantagalo, capital Santana • Caué, capital São João dos Angolares • Lembá, capital Neves • Lobata, capital Guadalupe • Mé-Zochi, capital Trindade • Island of Príncipe: • Autonomous Region of Príncipe, capital Santo António. Each district is represented by a District Chamber (Câmara Distrital) which is headed by a democratically elected president. The autonomous region of Príncipe, in turn, is governed by the regional government headed by a democratically elected president. Districts are further subdivided into agglomerations (cities and towns) and localities. Access to electricity, internet, and mobile communication Access to electricity is not universal. About 71 percent of the population have access to electricity, mainly through the national electric grid (69.4 percent of the population). The divide between urban and rural areas in terms of access to electricity is significant, with 38.5 percent of the rural population not having access to electricity in 2019, while the same indicator stands at 23 percent for the urban population.7 7  World Bank. São Tomé e Príncipe. Relatório de Diagnóstico do Acesso à Energia Baseado numa Categorização Multinível. https:// documents1.worldbank.org/curated/en/282281572439595060/pdf/São-Tomé-and-Pr%C3%ADncipe-Beyond-Connections-Energy-Ac- cess-Diagnostic-Report-Based-on-the-Multi-Tier-Framework.pdf. 4 Adoption of the internet remains limited. Mobile (3G) broadband services reach 95 percent of the population in major cities, and approximately 85 percent of the population use a mobile phone.8 However, only about 36 percent of the population currently use mobile broadband, and data consumption per capita is at relatively low levels as indicated by the small quantity of international bandwidth consumed relative to comparable nations.9 Fixed broadband penetration stands at about 13.5 percent. About half of the fixed broadband subscribers are businesses, indicating that only about 2–3 percent of households have fixed broadband. The primary use of the internet is to access social media. Affordability is an issue, with the Internet Price Basket of the International Telecommunication Union (ITU) showing that a mobile voice and data plan with 1.5 GB of data per month would cost about 6 percent of monthly income in 2020, while a fixed broadband package costs about 19 percent, both high percentages even within lower-income countries in Sub-Saharan Africa.10 Affordability of internet-enabled devices is also low; of total connections in 2019, 44 percent were from basic/feature phones.11 According to a 2016/2018 Afrobarometer survey, African women use and have less access to the internet than African men do. In STP, 36 percent of women use the internet as opposed to 47 percent of men.12 The high cost of access and limited income levels, as well as the limited number of local service providers and network unreliability all contribute to the country’s low levels of internet uptake. Considerations for CR and ID: Closing the fundamental infrastructure gap in areas such as electricity and addressing inequalities in connectivity access are crucial steps to widen the availability of digital services across the entire country. It is also critical to promote secure, digitized data processing in the context of civil registration and identification and facilitate the use of higher-assurance digital identity verification and authentication mechanisms. The internet access gender divide is another source of concern, as the internet can serve as a vital platform for women to start businesses, access education, find employment, receive health care, and access banking and other financial services. Digital government strategy and identification There is a concerted effort inside the GoSTP to advance STP’s technology transformation. This effort is led by the Institute of Innovation and Knowledge (Instituto de Inovação e Conhecimento, INIC). INIC was created in 2008 with the mission to formulate and execute national strategies for the integration of information and communication technology (ICT) in public management. The ICT agenda is also shared by the Ministry of Infrastructure and National Resources (MINR) and the Ministry of Finance’s Directorate of Technology and Innovation (DITEI), which is responsible for several digital public platforms. The GoSTP has taken a fragmented approach to digitization, and most of the foundations for digital government service delivery are still nascent. The country’s performance in various international ICT-related e-government surveys is subpar. Specifically, it stands at 154 out of 193 countries in the United Nations e-Government Index for 2022 and 187 out of 193 countries in the e-Participation Index 8  GSMA Intelligence Database (2020). https://www.gsmaintelligence.com/. 9  World Bank. 2021.São Tomé and Príncipe - Digital Economy Assessment. 10  https://www.itu.int/en/ITU-D/Statistics/Pages/ICTprices/ICTPricesVisualization.aspx. 11  GSMA (Groupe Speciale Mobile Association) and UNECA (United Nations Economic Commission for Africa). 2021. Enabling e-Commerce in Central Africa: The Role of Mobile Services and Policy Implications. 12  Afrobarometer. 2020. “African Women Have Less Access to the Internet than African Men Do: That’s A Problem.” Retrieved October 30, 2023, https://www.afrobarometer.org/articles/african-women-have-less-access-internet-african-men-do-thats-problem/ 5 (EPI) for 2022.13 Critically, STP has been losing ground compared to most of its peers since 2010, as its scores related to digital public platforms have been worsening. The GoSTP published its National Digital Government Strategy in 2020. The strategy frames and integrates a set of digital transformation initiatives to improve the provision of digital public services. Its strategy focuses on nine sectors, or themes, to provide government-to-citizen services.14 To facilitate these efforts, a set of foundational technological, legislative, and administrative pillars are proposed. Among the various initiatives, the strategy proposes a national datacenter, a GOV.ST eServices portal, and digital identity and authentication platforms. This provides a timely and significant opportunity for STP to adopt a holistic, platform-based digital government approach to achieve its e-government objectives and initiatives. Considerations for CR and ID: Adopting a holistic approach to (digital) identification and strengthening interoperability while promoting secure, privacy-conscious data sharing will be essential to build a financially sustainable ID ecosystem that benefits the population and facilitates public service delivery. 13  See https://publicadministration.un.org/egovkb/en-us/Data/Country-Information/id/148-Sao-Tome-and-Principe/dataYear/2016. 14  The sectors include health; education; work and employment; social protection; environment; tourism; agriculture, livestock, and fisheries; fiscal and taxation; and justice and citizenship. 6 Civil registration and identification landscape in São Tomé e Príncipe The foundational ID ecosystem of STP is composed of a CR system responsible for registering all births, deaths, marriages, and adoptions, and an ID system open to all nationals and Santomean diaspora. Both systems are responsible for providing legal identity to citizens residing in the national territory from birth (if born in the country) to death and to foreigners born in the country. General legal and institutional framework This section focuses on the need to update and improve the legal and regulatory framework governing civil registration and identification. It suggests merging outdated legal instruments into a single modern document to address current challenges and operational realities, aligning with international standards for data protection and cybercrime. Legal and regulatory framework Article 24 of the Constitution of STP protects the right to identity and privacy. It states that “Personal identity and the confidentiality of the intimacy of private and family life are inviolable.”15 The legal and regulatory framework for CR has its origin in Decree/Law 47678, of May 5, 1967 (Civil Registration Code).16 Three other legal instruments complement the legal framework: Law No. 2/77 of 28 December 1977 (legally regulating family institutions), Law of Family/Decree No. 45 of 2009 (approving the National Strategy for Permanent Birth Registry or ENRPN),17 and Law No. 19/2018 which approves the Family Code and revokes Law No. 2/77. The legal and regulatory framework of civil identification has its origin in Decree 251/71, June 1971 (Civil Identification Law). The laws governing civil registration and civil identification are from colonial times. The recent Decree, 15  https://www.constituteproject.org/constitution/Sao_Tome_and_Principe_2003.pdf?lang=en. 16  The mentioned law was established in the colonial period. 17  https://data.unicef.org/crvs/sao-tome-principe/. 7 from 2018, on Computerization and Simplification of Civil Registration and Identification Acts and Procedures, provides for the digitalization of acts, processes, and procedures and approved new models for certain acts. However, it is not clear whether the digitalization of processes arising from the 2018 Decree (notably, for requests) apply to all acts of civil registration and to civil identification (as well as to nationality). In addition, certain civil registration documents do not seem to have been updated (notably the certificates - ‘assentos’ and report cards - ‘boletins’), with the identification card (bilhete de identidade, BI) being a physical document with no electronic elements. There are no details on a civil identification database, and it is not clear how the Integrated System for Registry Management (SIGA) (assentos) relates with the civil registration and civil identification databases. Despite a reference to the collection of biometric data, there are no details on the data collected. Institutional and administrative arrangements Key institutional stakeholders include the General Direction of Registries and Notaries (Direcção Geral dos Registos e do Notariado, DGRN), the Ministry of Health and Women’s Rights ((Ministério da Saúde e Direitos da Mulher, MSDM), and the National Statistics Office (Instituto Nacional de Estatística, INE). The DGRN is responsible for both CR and ID throughout the country, besides other registration tasks (that is, criminal register, vehicle register, land register, company register, and register of companies working in economic zones) and the notarial services role. It has administrative and financial autonomy and is part of the Ministry of Justice, Public Administration, and Human Rights (Ministério da Justiça, Administração Pública e dos Direitos Humanos, MJAPDH).18 The DGRN’s mission is to manage, direct, and coordinate services related to the civil, nationality, civil identification, notary, and property, business, and asset registries. The DGRN’s organic structure is defined by Decree Law no. 07/2017 of June 13. In addition to the General Director and the Technical Council, the DGRN is organized around four central services, one regional service, and decentralized services as follows: • Central services (located on São Tomé) • Civil and criminal identification center • Central civil registry office • Registration and notary service • Administration, legal, and IT support service • Regional service (located in Príncipe) • Regional delegation of registration and notary • Decentralized services • Conservatories 18  Article 51º, nº 4 - al. b) of Decree-Law nº 04/2016, of July 4. 8 • Notary offices • District delegations and posts. The MSDM has also played an important role in CR services since 2009, with the introduction of the National Strategy for Permanent Birth Registration, which fostered the cooperation between the DGRN and the MoH with the deployment of registration centers in five health facilities across the country.19 Over 95 percent of all births in 2019 occurred in health facilities at the national level,20 and health authorities have multiple interactions with mothers and children. The National Institute of Statistics (INE) is the executive organ of the National Statistics System in charge of the production and publication of national statistics, including civil registration statistics.21 Institutional footprint and human resources The DGRN’s presence is quite restricted. There are a total of 11 centers across the country for all CR services, along with seven registration posts in maternity facilities specifically for birth registration. On Príncipe, there is a single regional delegation with limited authority and no official notary or registrar. Additionally, there is a sole center serving the entire capital city. Civil registration can be conducted at one of the centers indicated in Table 1. In turn, identification services are provided only at the center in the capital city on São Tomé, and the unique center on Príncipe (data are collected there and digitally transferred).22 Table 1: List of registration centers The main civil registration center in the capital city has inadequate infrastructure to accommodate the public. Following a flood affecting its building, the registration center was relocated to another public building which does not meet the basic standards necessary to receive clients: the space is too small, with no appropriate waiting area. Accessibility is also inadequate: the entrance is obstructed by breezeblock to prevent flooding, which makes access impossible for people with disabilities and challenging even for those of good physical health. 19  The MoH has a footprint in the country which is superior to the DGRN’s current office network. The MoH covers two hospitals, six health centers, 28 health posts, and 17 community health units, for a total of 53 establishments. 20  INE and UNICEF. São Tomé e Príncipe. Multiple Indicator Cluster Survey 2019. 21  https://www.ine.st/index.php/ine/sobre-nos . 22  Registration services are still in implementation phase. 9 Figure 2: Former DGRN center in the capital Figure 3: New DGRN center in the capital Source: World Bank Source: World Bank Figure 4: Main entrance of the center Figure 5: Side entrance for ID card issuance Source: World Bank Source: World Bank In 2016, the DGRN had a total workforce of 81 people. However, according to the DGRN’s self- assessment, there is a need to enhance human resource management to align more effectively with the DGRN’s requirements and limitations. This includes ensuring appropriate staffing levels and fostering collaboration between CR and ID services. Furthermore, there is a significant deficiency in training to enable staff to fulfill their roles effectively. Institutional strategy and synergies between CR and ID services The DGRN developed its Strategic Plan for 2017–2019 and 2020–2022 subsequently. The plans, which applied to all services covered by the DGRN, included seven strategic objectives.23 There is no strategic plan specifically for CR and ID. CR and ID services are separate departments within the DGRN, each with its own technical infrastructure, equipment, and staff. Interoperability between services is nascent but substandard. 23  (1) Restructure the organization of the DGRN; (2) reward and train human resources; (3) reform and update the legal framework; (4) refit and modernize facilities; (5) extend the service to cover the whole territory; (6) organize, modernize, and improve the quality of the service provision; and (7) improve the public image of the DGRN. 10 Civil registration This chapter examines the CR system’s coverage, processes, infrastructure, and IT aspects. It delves into the strategies and synergies between CR and ID services and discusses the collection, reporting, processing, and publication of vital statistics. Table 2 provides a summary of key information. Table 2: Summary of key information Coverage Birth registration is almost universal. According to the latest Multiple Indicator Cluster Survey (MICS) survey conducted by the United Nations Children’s Fund (UNICEF) in 2019,24 over 95 percent of all births occur in health facilities and nearly 99 percent of all children ages 0 to 1 had their births registered. The survey suggests that birth registration has been completed for 98.6 percent of the entire population. This is the result of strong political will and institutional commitment on behalf of the DGRN to close the registration gap over the past 15 years. In 2009, registration centers were established within five health care facilities, owing to collaboration between the MoH and UNICEF. Subsequently, in 2010, the ENRPN was initiated, with support from the United Nations Development Programme (UNDP). The evolution of birth registration coverage is shown in Figure 6 and reflects the improvements of the past 15 years. The ENRPN facilitated collaboration between the DGRN and the MoH, resulting in an increase in birth registration rates from 75 percent in 2008/09 to 92 percent in 2012. Progress continued at a slower pace from 2012 to 2014, reaching 95 percent in 2014. As of 2019, nearly 90 percent of the population hold a birth certificate. 24  INE and UNICEF. São Tomé e Príncipe. Multiple Indicator Cluster Survey 2019. 11 Figure 6: Evolution of birth registration for children under 5 between 1975 and 2019 Source: INE e UNICEF. 2014. São Tomé e Príncipe. Multiple Indicator Cluster Survey 2014. INE and UNICEF. São Tomé and Príncipe. Multiple Indicator Cluster Survey 2019. The survey noted no discrepancy between urban and rural areas (both achieving 99 percent), a small discrepancy between the registration rate of boys and girls (99 percent for boys versus 98 percent for girls), and more significant differences between the richest populations (100 percent) and the poorest (96 percent). However, the discrepancies have reduced since the previous 2014 MICS, as shown in Figure 7. In addition, the survey shows that less than 1 percent of the registered children under age 5 do not have a birth certificate. Figure 7: Discrepancies in birth registration for children under five, 2014 and 2019 Source: INE e UNICEF. 2014. São Tomé e Príncipe. Inquérito a Agregados de Indicadores Múltiplos 2014. E INE e UNICEF. São Tomé e Príncipe. Inquérito a Agrupamentos de Indicadores Múltiplos 2019. 12 Table 3: Birth registration, 2019 Source: INE and UNICEF. São Tomé e Príncipe. Multiple Indicator Cluster Survey 2019. Official data regarding the extent of death registration coverage are not available, but the government has stated that nearly universal death registration has been accomplished. Registration processes Birth registration By law, the registration of a birth must take place within 30 days after the birth has occurred, at either the central civil registration office in the capital or at the civil registration post in the location where the birth happened. The registration can be declared by the father, the mother, a relative, the doctor, midwife, or any other person present at the moment of birth. Following a birth, health care personnel are tasked with reporting the newborn’s birth (as shown in Figure 8: DGRN post’s services in Neves). They provide necessary information to the DGRN for birth registration and to the INE for vital statistics purposes. This data is recorded in a standardized document made available by the DGRN (see Annex 1: Birth declaration form). 13 Figure 8: DGRN post’s services in Neves Source: World Bank The birth declaration form includes the following information: • Regarding the child: First name, last name, date of birth, time of birth, sex, type of birth (single, twins, triplets, and so forth), place of occurrence (of the birth), type of place of occurrence (hospital, home, and so on), and place of registration • Regarding the mother of the child: First name, last name, phone number, date of birth, PIN (optional), ID card number, place of birth, marital status, place of usual residence, full name of the mother’s father (maternal grandfather of the child), and full name of the mother’s mother (maternal grandmother of the child) • Regarding the father of the child: First name, last name, phone number, date of birth, PIN (optional), ID card number, place of birth, marital status, place of usual residence, full name of the father’s father (paternal grandfather of the child), and full name of the father’s mother (paternal grandmother of the child) • Regarding the marital status of the parents: Whether the parents are married and date of marriage (if applicable) • Regarding the declarant (only in case the declarant is not the mother or the father): First name, last name, phone number, date of birth, PIN (optional), ID card number, place of birth, and relationship to the child • Other information: Who is the declarant (mother, father, the parents, other), information about witnesses, and special mentions • Signatures of the declarant(s) • Information about the registration: Civil servant’s first name and last name and date of registration • Information specific for statistical purposes: Weight of the child, number of pregnancies of the mother, duration of the pregnancy, type of health staff supporting the birth, level of instruction of the parents, and type of occupation of the parents. 14 Figure 9: Entrance to birth registration Figure 10: Birth registration post at the services at the capital’s hospital capital’s hospital Source: World Bank Source: World Bank The details from the birth declaration form (excluding those intended for statistical purposes) are entered into the SIGA system digitally. Figure 11: Cédula pessoal The birth registration results in the immediate issuance of a personal logbook (cédula pessoal). The personal logbook certificate comes with a quick response (QR) code to verify its validity and is mandatory to obtain a birth certificate (certidão de nascimento).25 The birth certificate is required for access to identification, education, inheritance, obtaining social assistance, nationality, parental powers, marriage, guardianship, curatorship, adoption, and so on.26 The timely birth registration and the issuance of the first certificate is free of charge.27 Penalty fees occur in case of late registration. If registration occurs within three months after the deadline (of one month), the fee is STN 100 (US$4.40). If registration occurs more than three months after the deadline, the fee is STN 150 (around US$6.60). Requesting a copy of the birth certificate for the ID card incurs a fee of Source: World Bank 25  The QR code was developed and implemented with the support of the University of Aveiro in Portugal. 26  https://data.unicef.org/crvs/sao-tome-principe/. 27  Decree n. º 12/2021 regulating emoluments of the DGRN. 15 STN 25, which is approximately equivalent to US$1.10 Death registration By law, a death must be registered within 48 hours28 at the central civil registration office in the capital or at the civil registration post or health unit where the death occurred. Registering a death promptly and obtaining a death certificate involves a fee of STN 100, which is approximately equal to US$4.40. There is no fee in case of fetal death and no penalty in case of late registration of death. The following documents are required for death registration: • Medical death certificate • Birth certificate of the deceased • Identification card of the deceased • Date of death • Age at death. The following data are collected during death registration:29 • Regarding the deceased: Name, sex, date of birth or age, place of usual residence of the deceased, and place of usual residence of the mother for deaths under 1 year of age • Regarding the death: Date of death, place of occurrence of the death, type of place of occurrence (hospital, home, and so on), date of registration, place of registration, cause of death, and certifier. In case of fetal death, the following information is collected: • Date of occurrence of fetal delivery, place of occurrence, type of place of occurrence (hospital, home, and so on), date of registration, place of registration, sex of the fetus, and place of usual residence of the mother. The death certificate is required for cremation, burial, and inheritance and for obtaining social assistance. Marriage registration By law, marriages must be registered at the time of the ceremony. The legal age for marriage is 18 years. However, with parental consent, girls as young as 14 and boys as young as 16 can marry. Registering a marriage and obtaining the marriage certificate requires a fee of STN 250, which is equivalent to US$11.00. There is no penalty in case of late registration. The following is required for marriage registration: • Presence of both spouses at registration 28  Despite this legal period, practice dictates a 24-hour period, except if the doctor states otherwise. However, this practice has no legal ground. 29  https://data.unicef.org/crvs/sao-tome-principe/. 16 • Residential proof of spouses • Proof of spouses’ age • Witness to the marriage • Power of attorney for representation of one of the spouses. The following data are collected during marriage registration:30 • Regarding the spouses: Date of birth or age of bride, place of usual residence of bride, religion of bride, date of birth or age of groom, and place of usual residence of groom • Regarding the marriage: Date of marriage, place of occurrence, date of registration, and place of registration. The marriage certificate is required for registering children and transferring or sharing land ownership. Infrastructure and IT The registration process is conducted digitally via SIGA. The SIGA system is operational in DGRN centers across the country, but it is not in use at embassies. It was created in 2017 and implemented in 2018 to facilitate the collection and storage of both biographic and biometric data31 and the issuance of certificates. The operation of the civil registry relies on a strategic partnership with the University of Aveiro in Portugal. In 2016, the GoSTP, in collaboration with INIC, entered into an agreement with Camões, the Institute for Cooperation and Language of Portugal, to develop the currently used digital CR system. This system was internally developed by the DGRN’s technicians with support from the University of Aveiro. The university still supports the maintenance and updating of the solution and hosts the infrastructure in Portugal. There is no redundancy in STP and SIGA connects to the servers in Portugal during registration and document issuance operations. Not hosting the civil registration data on the national territory and relying on a third party for the management of the CR system is a key shortcoming. The SIGA database is not comprehensive. As of 2022, it contains birth records from 1920 to 2010,32 but the following data need to be consolidated: •The stock of paper-based birth records established between 2010 and 2023 •Death records •Marriage records •Divorce records 30  https://data.unicef.org/crvs/sao-tome-principe/. 31  SIGA replaced the previous CivID system. SIGA was established by Art.º 8.º of Decree n. º 09/2018 which approves the digitization and simplification of civil registration and identification acts and procedures. 32  This digitalization work was supported by the European Union (EU). 17 •Other civil registration records. In addition to SIGA, the Leginon system allows data exchange and controlled access to SIGA for other institutions. Through a secure Virtual Private Network (VPN) provided by INIC, other organizations and agencies can access and verify data stored within the SIGA database. The Leginon system aims to • Provide other institutions and entities with controlled access to the information stored in the SIGA database; • Enable the verification and validation of certificates issued by the DGRN, via the authentication of a QR code that facilitates the authentication of information; • Facilitate the exchange of statistical information with INE; and • Interconnect the civil registration database with the civil identification database. The DGRN also maintains a database in STP dedicated to accountability and payments. This database specifically monitors transactions to simplify the management of invoicing, service payments, and for audit purposes. It is worth noting that the audit platform is not integrated into the SIGA system, but is, instead, a separate interface. This results in poor workflow, where information about a transaction must be added manually to the system after a certificate has been issued within the SIGA system. Overall, despite the existence of mechanisms to exchange civil registration data, interoperability remains incipient and the DGRN lacks a clear and comprehensive interoperability framework supported by a robust interoperability platform. Collection, reporting, processing, and publication of vital statistics The INE oversees the processing of vital statistics. According to UNICEF,33 paper-based birth and death data are remitted monthly to INE. Nonetheless, according to UNICEF sources, consistent communication with the entities responsible for generating statistical data has not been feasible, mostly due to technical challenges and a lack of computer network and server infrastructure at INE. There is no mandatory requirement to submit marriage data. 33  https://data.unicef.org/crvs/sao-tome-principe/. 18 Civil identification Similar to the Civil Registration chapter, this section addresses coverage, registration processes, and infrastructure related to civil identification. It explores the specifics of the national ID credentials and the key differences between civil registration focusing on events and identification focusing on individuals. Table 4 provides a summary of key information. Table 4. Summary of key information Coverage There are no official data on ID coverage. According to data shared by the DGRN,34 ID coverage reaches approximately 80 percent of the total population over the age of five. However, as of October 22, 2021, only around 90,000 individuals were registered in the ID system. As showed in Figure 12 and Figure 13, about 47 percent of all entries in the systems are males and 53 percent are females. About 67 percent are above 18 years of age. 34  Data shared by the DGRN during the preparation of the ID4D 2021 Dataset. 19 Figure 12: ID database Figure 13: ID database Figure 14: ID card issuance entries, 2021, by gender entries, 2021, by age by type, 2022 Source: Author’s depiction based on DGRN data. According to the DGRN, 30,539 ID cards were issued in 2022. Of these, 8,070 (approximately 26 percent) were for initial ID card requests, and 22,469 (approximately 74 percent) were for ID card renewals (see Figure 12, Figure 13, and Figure 14). Slightly more number of ID cards were issued to women (15,094) than to men (14,636).35 The most likely reason for the relatively low figure reflected in the ID system is the relatively recent computerization of the ID system—many current ID holders received their ID cards before this modernization, meaning they may possess physical IDs that are not yet registered within the national ID database. Registration processes Registration to obtain a national ID card is mandatory for all nationals. The birth certificate is a mandatory breeder document and São Tomé and Príncipe nationality is a requirement. The period from July to September experiences a surge in ID requests, primarily driven by school-related requirements. Integration of the BI system with the CR system is still ongoing. There are two different procedures for ID requests, depending on whether it is the initial issuance or a renewal. • In case of first issuance: • To request their ID card, individuals first must obtain a birth certificate at the CR service counter. Data are retrieved from the SIGA system and printed on a certificate with a QR code. The individual then goes to the identification services. • ID services compares the data contained in the QR code versus the data in SIGA (which is accessed by searching for a name or registration number only). If data match, the information from SIGA is then reused for the ID card request and additional biometric information, such as the person’s facial image and index fingerprint, is collected. 35  Note: The gender of the cardholder is recorded in the system only at the time of printing the ID card, hence the slight difference (809 cards) between the total number of ID cards issued and the total number of cards for women and for men. 20 • In the back office, staff members conduct a thorough review of the data, followed by a triple-check by the director to confirm and validate. Once the data are validated, the director accesses SIGA to obtain the assigned ID number and includes it in the registration file. • Finally, the director validates the ID card, which is then sent for printing (centralized printing in the capital). • Once printed, the ID card is sent to the registration post and the user must come to validate and retrieve it. • Case of renewal: • The user goes to an ID post and puts his/her finger on a fingerprint reader for 1:1 verification (in case of first issuance based on biometrics). • In case of a match, the request is validated, and the renewal is processed. • If there is no match, the identification request is processed by ID number. • If there is still no match, the user is referred to the capture desk for data collection and will follow the same process as for first issuance (outlined above). Data collection is completed either digitally or manually on paper. The following data are collected: • Unique identification number (UIN) (only at renewal) • Full name • Date of birth • Current address • Civil status • Signature • Fingerprint • Biometrics (previously 10 fingerprints, now reduced to index fingerprints, facial image, and signature). Upon completion of the process, individuals return to the registration center to collect their ID cards. Standard issuance typically takes up to 15 days, although it is often available within 8 days. Urgent issuance can be completed within 3 days. The DGRN has verified that current practice adheres to these time frames. National ID credentials The ID cards Two types of ID cards are currently issued for São Tomé and Príncipe nationals. The ID was initially issued on paper, but a polycarbonate ID card has been issued since 2021. IDs are valid for 5 years if applicants are under 40 and for 10 years for people ages 40–50 and does not expire for people over 50 years. 21 Figure 15: Paper-based ID card, recto Figure 16: Paper-based ID card, verso Source: World Bank Source: World Bank Figure 17: Polycarbonate ID card, recto Figure 18: Polycarbonate ID card, verso Source: World Bank Source: World Bank ID cards are centrally printed in São Tomé. The polycarbonate card is printed from a blank document, which requires a lot of ink and results in poor and inconsistent quality. The DGRN continues to issue paper-based ID cards as well when resources are limited. Obtaining an ID card involves a fee that varies based on the type of request. For a regular request, renewal, or replacement, the cost is STN 100 (approximately US$4.40). For an urgent request, it is STN 130 (about US$5.8), and for a very urgent request, it is STN 160 (approximately US$7.10). The following information is printed on the ID card: • UIN • Expiration date • Full name • Date of birth • Current address • Civil status • Signature • Fingerprint. 22 The ID card is mandatory to access the following services: • Open a bank account • Activate SIM card • Participate in government public assistance programs • Access basic health government services (works also with Cédula pessoal) • Register for Covid vaccine. The PIN The PIN is an attempt to deploy a UIN. It is an 11-digit sequential number that has been issued at birth and appears on the cédula pessoal but not on the birth certificate. The PIN differs from the ID card number, and it is not used for facilitating data exchange between systems. The government acknowledges the serious shortcomings of the existing PIN and showed interest in reinforcing the link between CR and ID by upgrading and strengthening the national UIN. Infrastructure and IT The ID system and infrastructure are distinct to the CR system and infrastructure. The ID system and the centralized ID database are hosted in São Tomé. Data are stored in a server in a locked room at the DGRN headquarters for accountability and payment purposes. A separate ‘backup’ server exists in the same building, which is not in line with good practices to guarantee business continuity. The ID system has been developed in-house. Also, an Automated Fingerprint Identification System (AFIS) has been in place since 2021. It has been developed in-house for the purpose of authenticating biometric data. There is no deduplication process. It is understood that the AFIS is used in practice to authenticate (1:1) biometric data for ID card renewals. The printing of ID cards takes place at the first floor of the main center in the capital.   Data, interoperability, digital ID, and authentication This part discusses the development of an interoperability framework for public service delivery. It highlights the roles of the civil registration and identification platforms in this framework, emphasizing the need for organizational, semantic, and technical interoperability to enhance public administration efficiency. Interoperability framework and platform The GoSTP is currently addressing the issue of sub-efficient public administration in the National Governance Strategy by designing an interoperability platform for the provision of public services 23 in an effective, efficient, and reliable way, both for the state and the citizens. A proposal for an interoperability framework has been developed, comprising organizational, semantic, and technical interoperability layers. In this framework, the CR and ID platforms serve as the cornerstone for electronic services, forming the foundation of the interoperability platform. UNDP has assisted the GoSTP in the preparation of this new interoperability framework by supporting its development as well as proposing a normative instrument for its governance. INIC is also backing the enhancement of interoperability for CR and ID in alignment with the interoperability framework, with funding provided by the World Bank’s Digital STP Project, which will also finance operationalization of the framework through development of an interoperability platform. Digital identification The Digital Strategy outlines the national goals related to the digital identity and authentication platform, emphasizing the crucial role of digital identity in facilitating online service delivery and recognizing its significance in establishing a public key infrastructure (PKI) for issuing trusted certificates and legally binding digital signatures. The GoSTP also seeks to overcome the limitations that stem from the multitude of different IDs. The strategy identifies, among others, the following challenges: • Ensuring that the systems align correctly with upcoming legal frameworks, including electronic signature legislation and data protection laws • Defining the essential components for this authoritative digital ID, including related attributes, to serve different sectors • Establishing a strategy for managing and maintaining up-to-date the personal data of the population, including both identification data and other data relevant for a given sector • Developing the necessary physical infrastructure to support digital ID and PKI • Securing the human resources required for system management. Online authentication platform The strategy also details the creation of an authentication platform to allow individuals to verify their identity online for accessing services. It aims for the deployment of a single entry point for online authentication. The strategy also mentions the adoption of a uniform set of security requirements for accessing services without considering the varying levels of importance associated with each service. While this can create more harmonization in terms of user experience, it can also constitute a barrier by setting high security requirements for services that in fact require only a low level of assurance. 24 Sectoral demand for identification and authentication services A robust foundational identity ecosystem is crucial for development and inclusion. Individuals need it to access both public and private sector services, including education, health, and financial services. For governments and businesses, these ID systems enhance service delivery, ensure unique identification, and curtail fraud and redundant systems. Individuals. Identity proofs, such as birth certificates, are essential for primary education and obtaining national ID cards. The ID card is vital for accessing numerous services, from banking to government benefits. Transactions involving digital payments often exclude those without a national ID, a growing concern as STP embraces digital transformation. Government and businesses. There is demand for a reliable identity system across government agencies and businesses. Such a system aids public entities, from the treasury to sectoral ministries like health and education, as they need to manage user databases efficiently and securely. In the private sector, banks, for instance, require national IDs to meet ‘know your customer’ (KYC) standards. However, the current identity system has deficiencies, hindering individuals from accessing services and limiting agency and business growth. The lack of integration between foundational and sector- specific ID systems hinders both efficiency and security improvements. The next sections will outline the identity needs across various sectors, current system constraints, and potential improvements. This overview represents key themes affecting all sectors. Summary: Sectoral use cases 25 Social protection Social protection framework The GoSTP is dedicated to alleviating poverty, and one of its primary strategies includes bolstering the social protection system. The social protection framework is based on the Social Protection Law approved in 2004 and the Social Protection Policy and Strategy (PENPS) approved in 2014.36 The Ministry of Labor, Solidarity, Family and Professional Training (MLSFPT) administers the social protection system. In 2023, the government approved its second National Social Protection Strategy, building upon the initial one developed in 2015. Since 2022, the Ministry of Health and Women’s Rights (MSDM) has been mandated for social protection policy, while the Directorate of Providence, Solidarity, Social Assistance and Family (DPSSF), operating under the MDM’s guidance, executes the social protection programs.37 The Social Protection Law is organized into three ‘regimes’ of social security:38 • Citizenship social protection covers resident population in high vulnerability situations and aims to prevent and respond to situations of deprivation and marginalization. • Compulsory social protection covers national or foreign workers (employees or self-employed workers) in situations of lack or reduction in work income. • Supplementary social protection covers people registered in compulsory social protection and aims to reinforce the coverage of compulsory social protection with an option insurance. A large portion of the population relies on social protection. Almost 25 percent live below the global poverty line of US$1.90 (2011 purchasing power parity [PPP]) per person per day, and more than 20,000 households are considered poor.39 However, while social safety nets have expanded, the overall coverage remains low, serving less than 27 percent of the total poor households in the country. Cash transfers The PENPS supports three main social protection programs related to Citizen Social Protection: (a) the Social pension program, (b) the Vulnerable Families Program (VFP), and (c) the Labor-Intensive Public Works Program (pending implementation). Additional programs have been established to complement the VFP. The VFP is a program offering conditional cash transfer primarily to impoverished households, especially those led by women which have at least one child under 18 attending school. As of 2023, the program supports 3,080 recipients, 99 percent of which are women-headed households. Plans are under way to extend the VFP to 5,000 households in 2024, representing 30 percent of households in the bottom 40 percent. Each recipient receives a payment of STN 650 (approximately U$32, 22 percent of the median consumption among the extremely poor) disbursed bimonthly. Additionally, every September, recipients get an extra STN 600 to help with school enrollment fees and other education-related expenses. Payments are facilitated by a designated payment service provider. 36  Lei n.° 7/04, Lei de Enquadramento da Protecção Social 37  World Bank. 2022. Social Protection COVID-19 Response and Recovery (P178018). 38  Government of São Tomé and Príncipe (Ministry of Planning, Finance and Blue Economy). 2022. “Voluntary National Review 2022: Implementation of the Sustainable Development Goals in São Tomé and Príncipe.” 39  World Bank. 2022. Social Protection COVID-19 Response and Recovery (P178018). 26 Social protection system and single social register The Integrated Social Protection Information System (Sistema de Informação Integrado de Protecção Social, SIIPS) initially aimed to monitor the VFP. Due to its limitations, it was replaced by the Core Management Information System (CORE-MIS) system in 2023.40 The CORE-MIS aims to act as the single window for the intake, registration, and enrollment of participants protection schemes more broadly. It is an instrument for the identification and socioeconomic characterization of people and families. A single social register module was added to the system to facilitate its monitoring and facilitate data exchange with external systems, notably the civil registry and commercial banks. As part of this initiative, extensive data collection is being conducted by the government to comprehensively update the social registry with socioeconomic information. Enrollment in the system is carried out by central, regional, and local agencies. Competent authorities oversee the identification and registration of beneficiaries or of people and families in poverty in their respective districts or regions. Local technical committees perform the registration of family members, register beneficiaries, and store the registers in the SIIPS. The database contains information about individuals and their families, including details related to birth, nutrition, housing, residence, household composition, marital status, household’s socioeconomic status, health, safety, isolation, education, employment, income, pregnancy, disability, elderly individuals, and death. Gathering this identification and characterization information may involve the use of photographs and other available technological methods. Data are updated every two years or whenever changes occur. The DPSSF is responsible for tasks such as (a) verifying the collected information by cross-referencing it with databases from other government institutions to identify potential inconsistencies and assess data quality and (b) collaborating with the Central Technical Committee to establish protocols for the interoperability of the single social register with other systems. The SIIPS electronic system and database also ensures seamless integration with commercial banks, facilitating automatic payments to beneficiaries. Each member of the household is required to provide proof of his/her identity by providing ‘civil identification document’ (not further specified in the law, it is unclear whether this refers only to the ID card or also to other documents), and upon registration, beneficiaries are assigned a distinct NIS. If an individual lacks civil identification documents, s/he can be temporarily registered using an NSIPI. This number is linked to his/her NIS until his/her civil identification status is verified. The law requires that if beneficiaries do not possess civil identification papers, the DPSSF will take the necessary actions to obtain them. Upon issuance of these documents, the registration will be updated accordingly. Social security The social protection program in STP includes both a pension and social security scheme for employees and employers. The National Social Security Institute (INSS), under the Ministry of Labour, Solidarity, Family and Social Training (Ministério do Trabalho, Solidariedade, Família e Formação Profissional, MTSFFP), manages the system. 40  Decree-Law 03/2023 approved the Regulation of the Single Social Register. The SIIPS was implemented with the financial support of the World Bank during the Social Protection and Skills Development Project (P163088) launched in 2019. 27 Registration is mandatory for all employees and employers. A national ID card and tax ID are required to register. The registration results in the issuance of the social security identification number (NISS). Challenges in practice Several key issues stand out within the social protection sector and the provision of social assistance programs: • The absence of a unique ID number • The inadequate integration among the CR, ID systems, and the social protection system • The limited systematization of ID cards/numbers within the ID system. These issues hinder interoperability, cross-referencing of information, and the identification of social protection beneficiaries and individuals registered in the unique social registry and social programs. As described earlier, documentation is required upon registration in the unique social registry. However, in many cases, individuals lack any form of identification, impeding their access to social assistance programs. The flagship program for poverty reduction, the VFP, mandates individuals to possess identification, which must be shared with the commercial bank responsible for payments. Consequently, the social protection sector may register IDs that cannot be automatically validated within the ID system due to the lack of systematization and integration with the social protection system. Having a unique identification system and interoperable systems can help with reducing duplicates and preventing leakage of benefits to individuals who are not entitled to social assistance benefits. Education The 2018 National Education System Law requires 11 years of mandatory education, which consists of two years of preschool and nine years of basic education, organized into three cycles.41 Table 5 provides an overview of student enrollment and the number of professors from basic through superior (higher) education in 2020/2021.42 Table 5. Overview of student enrollment and number of professors The Directorate for Higher Learning and Science, under the Ministry of Education and Tertiary Education, is tasked with establishing and regularly updating a database of students and graduates. Additionally, the Integrated System of School Management (SIGE) serves as a platform to assist in school management and the examination of educational data, aligning with the provisions of the Basic Law of the Educational System (Law 4/2018). 41  World Bank. 2020. Girls Empowerment and Quality Education for All (P169222). 42  Ministério da Educação e Ensino Superior. Boletim Estatístico. 2020–2021. 28 There is no legal provision regulating an identification card for students; however, a school pass is provided. It includes details such as the student’s name, address, contact information, class affiliation, and a photograph. The pass mentions ‘DAE/MEES,’ an acronym for the Directorate of School Administration of the Ministry of Education, Culture, and Sciences. There is no clear detail on what type of documentation is required to support the identity claim; however, it has been noted that there is a peak in ID card demand before entering school. Financial inclusion and mobile money Financial inclusion The GoSTP defines financial inclusion as “the access of all economic agents to quality financial services and products, at affordable prices, in a competitive market where consumer protection is assured and the empowerment of the most vulnerable is stimulated.”43 The National Financial Inclusion Strategy (NFIS) 2021–2025 reveals that 76 percent of the Saotomeans above 18 years are excluded from the financial system, and only 15 percent of women have a bank account. While the use of cash is dominant, 98 percent of the population consider it important to have a bank account. The primary goal of the NFIS is to ensure that, by 2025, 70 percent of the adult population in STP are included in the formal financial sector. KYC rules for bank services Financial institutions are obligated to determine and validate the identities of both their clients and the beneficial owners (those who control or are the beneficiaries of transactions).44 This identification is required in particular situations, such as when opening an account, establishing a business relationship, or conducting occasional transactions that surpass a specified threshold. The law also prescribes that these institutions adopt special risk management measures against money laundering and terrorist financing, especially when dealing with clients who are not physically present for identification. Depending on the associated risk, enhanced precautions might be necessary. All documentation used for verification must be retained for a minimum of five years following the end of the business relationship or transaction. The Central Bank of São Tomé e Príncipe (BCSTP) develops the rules on KYC before the establishment of a business relationship with a financial institution or the opening of a bank account.45 When opening a bank account on site, the following data are collected: complete name and signature as indicated in the ID card or other ID document; date of birth; place of birth; nationality (these elements shall be proven by showing the identity card or residence certificate or, in case of non-residents and emigrants, valid passport); parents (this element shall be proven by showing civil registration attestation or equivalent public document in case of non-nationals, when such information is not on the identification documents shown); complete address (this element shall be proven by any document considered appropriate and sufficient by the bank or through appropriate steps taken by the bank to ascertain the address); profession and employer if applicable (this element shall be proven by showing the professional card, payment receipt, or any other supporting document); tax number (this element is proven through the tax card or other document issued by the competent entity); public office if applicable (this element does not require documentary evidence); and type, number, and issuing entity of ID document. The bank shall make copies of all documents that are presented. 43  Democratic Republic of São Tomé and Príncipe. 2021. National Financial Inclusion Strategy 2021–2025. 44  Law to Prevent and Combat Money Laundering and Terrorist Financing (Law 8/2013 as amended by Law 3/2018). 45  Permanent Application Standard (NAP) 09/2018 and NAP 09/2018. 29 DFS and mobile money Digital financial services (DFS) are a key area of the NFIS.46 As traditional bank financial services have faced limitations in reaching certain segments of the population, the GoSTP aims to promote the growth of non-bank DFS providers to better serve those who still lack access to financial services. Around 90 percent of the adult population have cellular phones, and mobile network coverage reaches 90 percent of the national territory, which is an encouragement for the development of mobile money services. The BCSTP has shown interest in digital ID to support financial inclusion. The NFIS highlights the need for “a reliable identification and authentication system and the ability to collect and analyze disaggregated data […] on users” to perform e-KYC as banking institutions have difficulties in providing precise and reliable data of their clients. Deploying an inclusive and reliable method to identify new customers could greatly simplify financial inclusion. Collaboration between the BCSTP, INIC, and the DGRN can result in user-friendly, reliable, and efficient identification services that could boost the adoption of mobile money and financial inclusion more broadly. SIM-card registration By law,47 SIM cards must be registered by authorized operators and providers of telecommunication services. Subscribers must provide their identity information using one of the following documents: ID card, passport, birth certificate, driver’s license, foreign residence identification document, or voter card. If a subscriber lacks an ID document, they must bring along two witnesses with valid ID to sign on their behalf. To register the SIM card, telecommunication companies mandate a copy of the subscriber’s ID document. The pre-approved form must contain the following information on the identification of the subscriber: complete name; type of ID document used; ID number; date, place of issuance, and validity of the ID document; number of the SIM card; telephone number; address of the subscriber; and signature or fingerprint (in case the subscriber is unable to sign). Public administration Identification of taxpayers and tax collection The Taxes Directorate, operating under the Ministry of Planning, Finance, and Blue Economy, is responsible for identifying taxpayers. Every individual, whether a citizen or foreigner, who earns taxable income, is required to register in the national taxpayer registry. The Taxpayer Identification Number (NIF) is designed for identifying taxpayers, and it is mandated by law to maintain a central registry of taxpayers. The Taxes Directorate issues taxpayers a plastic card containing the NIF, which was introduced in 2010 to streamline tax administration and, consequently, lower administrative expenses. To obtain the tax ID, a valid national ID is necessary. 46  Defined by the BCSTP as “services developed, deployed, delivered and accessed through digital channels.” 47  Decree-Law 20/2012. 30 Civil servant management The Administration and Finance Directorate, under the MJAPDH, oversees the administrative management of civil servants. Payroll is the second largest public expenditure after public investment. In 2016, it amounted to 8.8 percent of GDP.48 The government employs approximately 11,000 people. Other functional systems Voter ID The National Electoral Commission (CEN) is the non-permanent body responsible for both voter registration and the issuance of voter ID cards. The legal requirements for citizens to be registered to vote include the presentation of an ID card or, as an alternative, any other officially signed document that includes a recent photograph or a fingerprint. A voter card exists, but the national ID card is also accepted as proof of identification on election day. Driving License The Land Transport Board is responsible for issuing driving licenses and vehicle papers. The number of issued ‘analog’ driving licenses amounts to approximately 33,000, which includes licenses registered under the names of individuals already deceased. Every year, between 200 and 330 new driving licenses are issued. A new type of driving license has been introduced since 2017, which incorporates the driver’s biometric data, ID card number, and NIF. A national ID card is required to obtain a driving license. 48  World Bank. 2021. Program Document for a Proposed Grant: Second Strengthening Growth and Fiscal Policy Development Policy Financing. 31 Recommendations While a comprehensive reform agenda necessitates more extensive consultations involving all relevant stakeholders to ensure widespread support and involvement, this diagnostic aims to assist in this process by offering an informed framework and a variety of policy options. These options are designed to strengthen the civil registration and identification system, enhance inclusive access to ID services for the population, and promote more sustainable and efficient service delivery, especially through the development of digital ID and authentication services. Revise CR and ID legislation The World Bank conducted a comprehensive ID Enabling Environment Analysis (IDEEA), which offers an in-depth analysis and recommendations for the legal and regulatory framework related to civil registration (CR) and identification (ID). Consequently, the following points represent initial, high- level recommendations that are harmonized with the findings of the IDEEA. The legal and regulatory framework governing civil registration and identification should be updated and improved. The legal framework should more accurately address the current challenges and operational realities that govern the ecosystem. This entails merging the separate and outdated legal instruments for both civil registration and identification into a single, modern legal document. This document should be designed to facilitate the modernization of the ecosystem and should incorporate provisions related to digital ID, authentication, and electronic transactions, among other aspects. The data protection and cybercrime legal framework should be reinforced to ensure it is enforced in practice and that its content is aligned with international standards and norms. The legislation should, for instance, guarantee that all databases and data processing operations adhere to applicable data protection regulations and promote the adoption of privacy-by-design approaches. Adopt a harmonized government strategy for civil registration, identification, and digital identity Although the DGRN had an institutional strategy in place, it did not possess a dedicated instrument specifically aimed at modernizing the ID ecosystem. The adoption of a holistic and unique ID strategic 32 framework is key to ensuring the efficiency of the ecosystem while avoiding the waste of public resources. The strategy should build on the mandate of the DGRN while responding to the needs of all the public and private actors that need to be able to identify their clients or beneficiaries in a reliable manner. This is key to avoid the parallel development of initiatives to address sectoral needs, for instance, the need of the BCSTP to perform e-KYC. Improve quality of service and inclusion First, the DGRN should evaluate ways to enhance its geographic presence and elevate the quality-of- service delivery at the community level. This entails • Upgrading local infrastructure to ensure that each CR and ID registration center meets the required service standards, including sufficient space and reception equipment for serving the public; • Promptly relocating the existing registration center in the capital, which is currently unsuitable for adequate service delivery; • Enabling collection of data for identification services in centers throughout the country; and • Developing and enforcing a service provision charter to ensure a consistent level of service quality across the entire territory. Second, the DGRN should enhance its understanding of the population’s perspective regarding civil registration and identification services to implement more user-centric services. This could be achieved through a dedicated qualitative study aiming at better reflecting the challenges and needs of the population (and of specific vulnerable groups) and developing mechanisms for continuous feedback from civil society, which would form the foundation for making operational and legal enhancements and for improving institutional communication. For instance, the DGRN currently encounters difficulties in effectively managing substantial fluctuations in demand year- round due, among others, to peaks in demands before schools start each year. This challenge could be addressed through more focused and personalized communication campaigns along with appropriate incentives. Gaining a deeper insight into the population’s needs, challenges, obstacles, and motivations regarding CR and ID services is essential for refining communication messages, identifying key legal and operational obstacles, improving inclusiveness including for minorities and vulnerable groups, streamlining processes providing more customized and user-centric services, and, in a broader sense, improving service quality. Third, depending on the conclusions of the study, the DGRN should identify key barriers to access services and implement changes to overcome those. This includes reviewing business process to facilitate access to vulnerable groups of people and assessing the possibility to decrease or cancel the fees to access CR and ID services for the most vulnerable populations. Reinforce the DGRN’s institutional capacity First, the DGRN should review and streamline operational processes to make them more efficient. The current systems in operation show shortcomings and sometimes intricated processes. Mapping as-is business processes could help identify nonessential requirements and steps and potential for simplification. This would help the DGRN deliver quicker services, thus making better use of scarce human resources. 33 Second, the DGRN should create and put into action a business continuity plan to guarantee the uninterrupted operation of all local centers. This plan should encompass a supervision and monitoring tool, as well as a reconsideration of appropriate equipment in accordance with the local conditions. For instance, the DGRN should employ laptops or desktops with uninterrupted power supply (UPS) to prevent service interruptions during power outages. Third, the DGRN should reinforce the technical and operational capacity of its staff. At the local level, this includes training on business processes, the legal framework, and good practices. At the central level, this includes technical training on a broad range of issues necessary for the management of a CR and ID system, such as cybersecurity, software development, database management, project management, risk management, and so on. The training programs should also strengthen awareness of privacy and security-by-design approaches, as well as privacy-enhancing technologies and practices (as shown in Table 6). Additionally, they should enhance the capacity of key institutions to formulate and implement best practices related to data protection and privacy during system development and operation. Finally, the DGRN should reinforce its technological infrastructure and enhance its systems. This includes • Completing the digitalization of its centralized CR database to ensure an updated and comprehensive database of all CR records; • Establishing the primary CR infrastructure, database, and system in a dependable datacenter within STP and utilizing the infrastructure in Portugal as a temporary backup system; and • Enhancing the CR and ID systems while guaranteeing sustainability over time considering very limited resources. This could entail assessing the adoption of open-source software for developing CR and ID systems and increasing the validity of ID cards (notably for adults under 40 years) 34 Table 6: Examples of privacy-enhancing technologies and operational controls Fonte: Quadro adaptado de Danezis et al. (2015) disponível em https://www.enisa.europa.eu/publications/privacy-and- data-protection-by-design para se adequar ao contexto do sistema de identificação. O presente quadro pretende ser ilustrativo das tecnologias comuns de reforço da privacidade e dos controlos operacionais, mas não é exaustivo. Reinforce the link between CR and ID The following requirements and key considerations should be incorporated into the design and implementation of a reinforced link between CR and ID systems: a) Streamlined business processes for smoother and more efficient operation b) Governance, legal, and institutional arrangements in line with a multisectoral approach and strategy c) Allocation and use of a robust unique ID number (further discussed below) d) Prompt data updates, exchanges, or notifications to safeguard the integrity of identity data e) Application of once-only principle between agencies to reduce document requirements f) Data protection and privacy g) Sustainable and operational viability of the system. 35 The DGRN must reinforce the unique ID scheme. The existing PIN has limitations, notably in terms of coverage and usage. These issues should be addressed to ensure that STP’s UIN is comprehensive (that is, encompasses the entire population from birth to death), trustworthy (that is, dependable, secure, transparent, and privacy-enhancing), and designed to provide value for both individuals and institutions. When leveraged across sectors, such a unique ID number can enhance administrative efficiency, contribute to reducing fraud, improve social programs targeting, and enhance the user experience of service delivery (see Table 7). The GoSTP could organize a workshop to showcase good practices and country examples and identify the best approaches reinforcing the UIN scheme in STP. Table 7: Potential benefits of a unique identity number for service delivery Fonte: Julia Clark, ID4D, Adaptado do ID4D Practitioner’s Guide Integrate DGRN’s services into the national interoperability platform and deploy identification services and authentication mechanisms Interoperability enables different systems to communicate, exchange data, and integrate processes, regardless of the technologies in which they are developed. An interoperability platform, therefore, is a strategic component of digital services, when coupled with an inclusive and reliable UIN and ID system. The DGRN should integrate its services into the national interoperability platform to harness the potential of a dependable ID system for the greater benefit of the national ecosystem. In parallel, the DGRN should collaborate closely with sectoral colleagues in one or two priority areas to better understand identity and authentication needs of the sector. This will ensure that the development of digital identification and authentication services are demand-driven and guided by the objective of improving the effectiveness and efficiency of service delivery; this will necessitate an iterative process of piloting and course corrections based on user feedback. To this end, the digital solutions should also be guided by inclusion and accessibility design principles. The DGRN should then operationalize identification services for external entities. By combining integration into the interoperability platform with the deployment of trustworthy and reliable identification services, various public and private institutions would gain access to a reliable method for identifying their clients or beneficiaries. Therefore, the DGRN should collaborate with INIC, as well as other entities like the BCSTP and public and private telecom companies, to establish the essential infrastructure for delivering identification services (including authentication and e-KYC) to 36 external organizations. Such identification services should be governed by a clear business model establishing specific fees based the category of clients (for example, public organization or private company) and on the type of services (for example, identity verification, KYC, data retrieval, and attribute verification). Identification services should also be done in a secure and reliable manner, with a strong emphasis on data protection, especially when formal agreements are in effect. In addition to providing added value to third parties, the identification services could contribute to the financial sustainability of the DGRN by generating revenue through identity verification. Finally, the GoSTP should develop a digital authentication layer for e-government services and the digital economy. Given increasing internet usage and the proliferation of easily accessible service platforms, it is important to create secure methods for users, both individuals and businesses, to access government services online. To achieve this goal, it is crucial to guarantee the availability of secure and user-friendly authentication mechanisms. Ideally, a secure e-government services mechanism entails the following: a) Utilization of multi-factor authentication b) Appropriate security mapping and authentication levels, aligned with the risk associated with unauthorized access to services c) Implementation of pertinent security technologies to support the highest levels of assurance, thereby granting access to all services, including those requiring the utmost security d) Adequate cybersecurity infrastructure. Therefore, we recommend facilitating the implementation and adoption of the system for both e-government and digital economy services. This will involve actively promoting and conducting communication campaigns. Upgrade and improve the ID credential and system The DGRN needs to define a unique standard and upgrade the ID card. The modernization of the credential should be guided by the following principles: • Issuance of a single credential for the entire population • Increased quality and security features of the printed credential • Implementation of a secure authentication mechanism, such as a QR code • Enhanced sustainability of the credential’s production process to minimize printing-related costs • Introduction of a digital credential based on the ID card. 37 Annexes Annex 1: Birth declaration form Source: World Bank 38 Source: World Bank 39