The Supreme Court has issued a directive order to the government to bring a separate law for the privacy and security of citizens' personal and biometric details collected for the National Identity Card (NID) system.
Hearing a writ petition filed by Advocate Sarita Adhikari, a bench of Justices Sapana Pradhan Malla and Meghraj Pokharel issued the directive order in a verdict delivered on October 9.
The same bench also annulled the directive and notice issued by Nepal Rastra Bank in June making the NID the sole basis for opening new bank accounts or renewing them. The Supreme Court has also stated that citizens should not be deprived of banking services merely on the grounds of not having obtained a National Identity Card.
After Nepal Rastra Bank amended the Integrated Directives, 2023, to issue a mandatory directive that obtaining a National Identity Card or its number is compulsory when opening new accounts or updating Know Your Customer (KYC) details in banks and financial institutions, and that accounts can be opened only after biometric details are verified through their electronic records, Advocate Adhikari approached the Supreme Court raising questions of privacy.
"Article 28 of the Constitution of Nepal guarantees the privacy of every person's body, residence, property, document, data, or character as a fundamental right, making it inviolable except by law," her petition stated. "Allowing third parties or financial institutions access to citizens’ biometric data in the name of verification, without a clear, transparent, and strict legal framework regarding who can use it, how, for what purpose, and for how long, and without the explicit consent of citizens, is a direct violation of the right to privacy."
The government defended itself in the Supreme Court, arguing that the petitioner's question lacked justification.
The government argued that, pursuant to an order previously given by the Supreme Court in another case, a committee had been formed to safeguard citizens' personal and biometric details.
In the case of Ram Bahadur Raut vs. Ministry of Home Affairs (081-WF-0009), the Supreme Court had directed the government to develop necessary policy, legal, structural, and administrative arrangements to guarantee the security and privacy of citizens' personal and biometric details.
Following that, a Data Security Committee was formed under the chairmanship of the home secretary pursuant to Section 35 of the National Identity Card and Registration Act, 2019, and the National Identity Management Information System Security Standards, 2025, had been approved by the committee and was currently in implementation, the government said in its response.
The Supreme Court stated that a single committee and standard alone cannot protect the personal privacy of citizens protected by the Constitution. Expressing dissatisfaction, the court noted that while the order was given to formulate policies and laws, the government only created a committee and standards.
"An individual's security is a matter of personal freedom connected with the right to live with self-respect and privacy. Article 28 of the Constitution of Nepal considers the right to privacy inviolable except by law. Here, 'law' means an act enacted by Parliament, not a directive, circular, or standard issued by an executive or administrative body. Since the 'Security Standards 2025' approved and issued by the committee in the Ministry of Home Affairs is merely a subordinate instrument of acts and rules, it cannot guarantee complete and adequate security and privacy of an independent regulator, remedy, or citizens' personal and biometric details," the Supreme Court's order states.
Therefore, the Supreme Court's order mentions that an independent, transparent, and strict "Data Protection Act" passed by Parliament is indispensable.
The court further states that in the absence of such a law, giving private-sector banks access to citizens' details is risky.
"In the context of the absence of specific and separate legal and institutional arrangements regarding data protection, giving private banks easy access to sensitive biometric and personal data of citizens contained in the national identity card under the pretext of data verification appears even more risky," the Supreme Court's order states. "There is a risk that commercial institutions such as banks might use citizens' data, collected for one purpose, for another purpose. For this, there should be a system where the data user provides only a 'yes/no' response."
The Supreme Court also pointed out the need for an authority as an independent regulatory body to monitor data protection, hear complaints, and take action.
Stating that once biometric details such as fingerprints and retinal scans collected under the National Identity Card system are compromised, it could have a serious impact on personal and national security sensitivity and the damage would be permanent, the Supreme Court asserted that strict arrangements must be made for its security.
"Therefore, the security and privacy of collected data is a much more sensitive and challenging issue," the order states. "In this regard, it is imperative that comprehensive legislative provisions be enacted in the form of an act."
The verdict mentions that the said act must clearly provide for the purpose of data collection, limits of use, citizens' data rights, establishment of an independent monitoring body, provisions for penalties, fines, compensation, and legal remedies for violations.
