Those involved in NID data breach can’t escape, says director general

The EC claims that despite repeated requests, the BCC did not provide a satisfactory explanation for its actions, prompting the cancellation of the contract

ASM Humayun Kabir, director general of Bangladesh’s National Identity Registration Division has issued a stark warning against those involved in the transfer of National Identity Card, or NID, data.

On Sunday, following the termination of a contract with the Bangladesh Computer Council, or BCC, for allegedly violating the terms of a data-sharing agreement, the director general spoke to journalists during a press conference at the Election Commission building.

"We allow various organisations to use the data centers that the Election Commission has, in light of certain rules and regulations. We provide this service to 183 organisations with whom we have contracts. We also had a similar contract with the BCC.”

He added: "Those who were involved in violating the terms of this agreement can’t escape. Action is definitely being taken from the Election Commission Secretariat."

The National Identity Registration Division announced the cancellation of the agreement with BCC in a media statement on Sunday.

According to the press statement, the total number of government and private organisations receiving NID's data verification services from the Election Commission is 183, including the BCC. The BCC signed a bilateral contract with the EC to receive this service back on Oct 4, 2022.

According to that agreement, the BCC cannot transfer, exchange, sell or otherwise provide the Commission's data to any other person, entity, party or organisation under any circumstances.

However, the notice claims that this organisation of the Information and Communication Technology Department did not adhere to these terms.

Kabir said: "The Election Commission Secretariat had agreements with many organisations. But, when they started a service of their own based on the BCC identity, there was no specific support from the EC or the EC Secretariat."

"We don't understand why some organisations that are contracted with the EC signed an agreement with the BCC instead of contracting with us to get services from us at a lower cost."

When asked what would happen to the data remaining with the BCC after the annulment of the contract, Kabir said: "The NID is a byproduct of our voter list. They don't need all the information in this voter list. Some people need four, some five, some three pieces of information. We would have given that amount of information to the contracted organisations as per the contract."

"I don't know whether they have been able to build a separate database. If that is the case, then the Election Commission and the Election Commission Secretariat will definitely take action."

When asked whether cases will be filed against third parties involved in the 'sale' of data, the director general said: "I think no one can be left out of it."

According to the statement, an explanation was sought from the BCC on Sept 3. However, the organisation failed to respond.

Later, on Oct 6, the BCC was asked to respond within three working days.

However, the EC deemed its response unsatisfactory.

Meanwhile, the agreement has been deemed voidable by the EC as the applicable fees or charges have not been paid within the stipulated time as per the agreement.

The EC has requested the BCC to pay the dues and submit a copy of the invoice within 15 days of the letter.

It was informed at the press conference that the BCC has dues worth Tk 21.33 million as of October 2024.