Nepal’s Supreme Court has directed the government to enact a separate law protecting the personal and biometric details collected for the National Identity Card (NID) system, ruling that a security committee and technical standards set up by the executive cannot take the place of an act of Parliament.
The directive is part of the full verdict on a writ petition filed by Advocate Sarita Adhikari. A bench of Justices Sapana Pradhan Malla and Meghraj Pokharel delivered the verdict on October 9, and the same ruling struck down Nepal Rastra Bank’s requirement that the NID or its number be the sole basis for identifying customers who open bank accounts or update know-your-customer (KYC) details. The court directed that existing documents such as citizenship certificates be accepted until customers obtain an NID.
The central bank’s June directive also allowed accounts to be opened only after customers’ biometric details were verified against the NID’s electronic records. Adhikari argued that giving financial institutions access to that data without a clear legal framework or explicit consent violated Article 28 of Nepal’s Constitution, which makes privacy a fundamental right. Nepal’s Health Insurance Board is also making National ID mandatory for health insurance enrollment from December 16.
The government told the court it had formed a Data Security Committee, chaired by the home secretary, after an earlier Supreme Court order in a separate case required safeguards for the data. The committee approved the National Identity Management Information System Security Standards, 2025, which the government said were being implemented.
The bench said that was not enough. “Here, ‘law’ means an act enacted by Parliament, not a directive, circular, or standard issued by an executive or administrative body,” the order states. The court called an independent, transparent and strict Data Protection Act indispensable and said an independent regulator is needed to monitor data protection, hear complaints and take action.
The order also addresses how banks check identities. Without specific data protection arrangements, giving private banks easy access to NID biometric and personal data “under the pretext of data verification appears even more risky,” the court said, adding that banks could use data collected for one purpose for another. It said verification should be designed so the data user receives only a “yes/no” response.
The court noted that damage from compromised fingerprints and retinal scans would be permanent. In June, Nepal’s Cabinet approved buying 10 million biometric matching licenses from IN Groupe for the national ID system.
According to the verdict, the new act must define the purpose of data collection, limits on use, citizens’ data rights, an independent monitoring body, and penalties, fines, compensation and legal remedies for violations.
Sources: Setopati, The Annapurna Express, Republica
–
By the ID Tech Editorial Team
