Problems of legal support of the process of introducing a digital profile of a citizen

Ostroushko Alexander Vladimirovich PhD in Law Associate Professor, Department of International and Public Law, Financial University under the Government of the Russian Federation 109542, Russia, Moskva, g. Moscow, per. 4-I veshnyakovskii, 4, of. 511 ostroushko@mail.ru Other publications by this author

Information technologies in the modern period of development of our state are widely and actively used in both the daily lives of people, the activities of organizations and institutions, and in the process of public administration and the provision of mass socially significant services available in electronic form. The implementation of this is impossible without solving the problem of the effective use of innovative technologies for the identification of citizens. World experience shows that the key direction of improving the state identification policy is the creation of digital profiles of citizens and organizations.  The digital profile of a citizen, based on reliable information from state information systems, is a tool for involving citizens in the communication process, and simplifying access to resources and services in electronic form.

 In the Russian Federation, this task is being solved within the framework of the Federal Program "Digital Public Administration" of the national program "Digital Economy of the Russian Federation", which is implemented within the framework of the state program "Information Society". The implementation of the above strategic development documents is aimed at achieving the national goal "Digital Transformation", which is defined by Decree of the President of the Russian Federation No. 474 dated July 21, 2021 "On National Development Goals of the Russian Federation for the period up to 2030". The passport of this federal program states that by 2024, an identification platform should be created in Russia, which includes biometric identification, cloud qualified electronic signature, digital profiles of a citizen and a legal entity, as well as a single electronic signature trust space based on a unified identification and authentication system ^[1].

At the moment, the implementation of the concept of a digital profile of a citizen in the Russian Federation is accompanied by a large number of unresolved legal problems related to the construction of the architecture of the corresponding information technology complex, the composition and technologies of filling the profile with data, ensuring access and security of use and providing information from it to third parties. Therefore, the task of a multilateral analysis of the problems and risks of the formation and application of a digital profile is extremely relevant. The basis for building a digital profile should be the legal regulation of the processes of collection, use, storage, as well as ensuring the relevance and reliability of personal data of an individual by public authorities and local self-government in order to implement all the tasks indicated for this institution and to prevent discrediting of processed information that may endanger the personal information security of a citizen.

Given the great social significance and public interest of the institute of the digital profile of a citizen and an organization, it is necessary to improve the quality of the state's activities to create a mechanism for legal regulation of public relations related to this activity.

The answer to a number of questions about the basic rules in accordance with which the formation and use of a digital profile of a citizen should be carried out could give its legal definition. However, there is currently no normative consolidation of the definition of "digital profile" in the legislation ^[2]. At the same time, the legislator in the course of rule-making activities, authors in scientific publications and the context of a number of existing legal acts use the term "digital profile", which allows us to get a fairly close to reality idea of the mechanism of its formation and purpose.

In the draft law No. 747513-7 rejected on January 18, 2022 "On Amendments to Certain Legislative Acts (in terms of clarifying identification and authentication procedures)", prepared in July 2019 by the State Duma Committee on Information Policy, Information Technologies and Communications, the digital profile was defined as "a set of information about citizens and legal entities contained in in the information systems of state bodies, local self-government bodies and organizations exercising certain public powers in accordance with federal laws, as well as in the unified identification and authentication system."

This definition does not reflect the targeted nature of the formation of a set of such data, and there is also no qualitative characteristic of them. In fact, we can say that any information in such systems about individuals and legal entities is a digital profile. According to T.A. Polyakova, when determining a digital profile, it is necessary to take into account only a certain list of systems from which it can be formed, that collection and processing can only be carried out in accordance with a legitimate purpose and it is necessary to talk about the reliable and up-to-date nature of the data that make up the digital profile ^[3].

Thus, it can be concluded that the formation of a digital profile is carried out at the expense of information already available in state and municipal systems, information in the ESIA, which is also a federal state information system and information available to organizations performing public legal functions, unfortunately, the bill did not specify which ones, but let's make an assumption, that these organizations are not only public sector.

Despite the fact that the bill did not receive support in the legislature, it was decided to create an infrastructure for a digital profile of citizens as part of an experiment to improve the quality and connectivity of data contained in state information resources. This process is regulated by the Decree of the Government of the Russian Federation No. 710 dated 03.06.2019 "On conducting an experiment to improve the quality and connectivity of data contained in state information resources" (together with the "Regulations on conducting an experiment to improve the quality and connectivity of data contained in state information resources") ^[4].

 Analyzing the adopted documents related to the process of creating a digital profile, it can be found that the "Digital Profile Infrastructure Use Scenario" and "Digital Profile Concept and Architecture – ESIA 2.0" contain a slightly different definition from the draft law and Government Decree, where a digital profile is a set of digital records about a citizen contained in the information systems of state bodies and organizations ^[5].  It is also indisputable, since it connects the digital profile exclusively with the information systems of state bodies and organizations. In addition, an additional category "digital record" is used, but what should be understood by it is not established by law ^[3].

The Subcommittee on the Use of Information Technologies in the provision of state and Municipal services of the Government Commission on the Use of Information Technologies to improve the quality of life and Working Conditions of Citizens determined that "a digital profile is a multilevel complex system, the formation of which is provided by the analysis of data contained in all information systems, as well as in information and telecommunication networks" ^[6].

All these documents are available on the official website of the Ministry of Digital Development, Communications and Mass Communications of the Russian Federation, which raises the question of the quality of the preparation of regulatory and regulatory-technical documentation, in terms of compliance with the fundamental postulates of legal technology, during the legal definition of basic concepts.

There is a paradoxical situation in our country, without having (as of May 2022) a definition of a digital profile de jure, de facto we have a section "Citizen Profile" on the website of the Unified Portal of State and Municipal Services. Several banks already have access to this resource as a digital profile of a citizen.

Its formation is carried out not only from the data of state or municipal information systems, but also from the Russian Union of Motor Insurers (RSA), when information is received about the compulsory civil liability insurance policy of the vehicle owner. The RSA is a non—profit corporate organization, which is a unified all–Russian professional association based on the principle of compulsory membership of insurers engaged in compulsory insurance of civil liability of vehicle owners (hereinafter referred to as compulsory insurance), and acting in order to ensure their interaction, formation and control of the implementation of the rules of professional activity in the implementation of compulsory insurance, as well as in order to ensuring the technical inspection of vehicles in accordance with the legislation of the Russian Federation. Despite the fact that the CTP AIS, the operator of which is the RSA, was created on the basis of federal law, there is no mention anywhere that it is a state information system. In accordance with the Annex to the Regulation on conducting an experiment to improve the quality and connectivity of data contained in state information resources of Government Decree No. 710 of 03.06.2019, the Russian Union of Motor Insurers does not apply to bodies and organizations that are the owners and (or) the source of information for the formation of a digital profile of a citizen. In our opinion, this is a disadvantage in the course of legal regulation of the experiment.

The analysis of the revealed list of information about citizens that is supposed to be included in the digital profile does not cover all the information available to public authorities, for example, currently there are no plans to include information about education, advanced training received by a citizen, confirmed by state-issued documents, or intellectual property registered in his name in digital profiles. and digital rights.

It is puzzling why, as a source of information used to form a digital profile of a citizen, the Unified Federal Information Register containing information about the population of the Russian Federation is not specified, the formation of which is in accordance with Federal Law No. 168-FZ of 08.06.2020 "On the Unified Federal Information Register containing information about the population of the Russian Federation", which according to in its essence, it is an information system that integrates the information necessary for a digital profile. In addition, from 1.01.2023, regulatory legal acts of the Russian Federation will be able to establish the requirement to use the federal register of population information as the only and (or) mandatory source of obtaining such information. There is an inconsistency in the actions of the Federal Tax Service - the federal executive authority that performs the functions of monitoring and supervising compliance with the legislation on taxes and fees and is responsible for the federal register and the Ministry of Digital Development, Communications and Mass Communications of the Russian Federation, coordinating actions to create a digital profile.

Various types of digital profiles of citizens began to be formed also in the subjects of the Russian Federation, to ensure the performance of state functions on their territory. In this case, we cannot talk about creating a full–fledged digital profile of a citizen - a resident of a constituent entity of the Russian Federation, but very narrowly targeted systems are being created.  An example is the integrated information system "Taxi Work Analytics" - CIS "ART", launched in August 2021 by the Department of Transport and Development of Road Transport Infrastructure of the City of Moscow, designed to streamline and control the work of all entities in the passenger transportation services market, where the driver profile is formed.

An ambiguous assessment can be given to the formation of "special digital profiles". For example, the Action Plan ("roadmap") for the implementation of the main directions of development of the state civil service of the Russian Federation for 2019 - 2021, approved by the decree of the Government of the Russian Federation dated July 24, 2019 N 1646-r, provides for "the formation of a digital profile of a civil servant and a digital profile of a civil service position" in a unified information system. It is proposed that these profiles should be synchronized with the activity of forming a digital profile of a citizen ^[7]. The Ministry of Education of the Russian Federation has developed the concept of an experiment on the introduction of a digital profile of a student, which will be started when enrolling in kindergarten or school and will contain in electronic form a portfolio of the child with all his achievements, there are a number of proposals for digital profiling. In our opinion, the creation of any additional profiles of citizens is impractical, including due to the fact that such redundancy will require additional costs (will burden the budget), in the form of expenses for ensuring the functioning of these systems, ensuring the information security of personal data and preventing the use of data for questionable purposes, including the number of social engineering. If necessary, the data can be included in the form of an additional block (subsystem) of the unified digital profile of a citizen of the Russian Federation, while the requirement for the mandatory filling of these blocks should be evaluated during special studies.

The provision of the Decree of the Government of the Russian Federation No. 837-r dated April 11, 2022 "On the Concept of transition to the provision of 24 hours a day, 7 days a week, of the absolute majority of state and municipal services without the need for the personal presence of citizens", which states that the digital profile of a citizen should ensure the storage and availability of electronic documents, including duplicates of documents and personal storage information, in a digital profile in your personal account. Firstly, this does not fully correspond to the previously proposed approach to the digital profile and the process of filling it is, because a citizen gets the right to fill his profile with personal information. And if the information provided to the profile from GIS has certain qualitative properties and reliability, then it is not possible and expedient to evaluate personal information by this criterion. In our opinion, such formation of a digital profile distorts its essence - to ensure the most effective interaction with state and other competent structures, since the simplified scheme of collecting data on persons used takes place when the information stored on the digital profile services has full legal force, and does not need additional confirmation or assurance..

Secondly, in our opinion, such wording indicates the haste of the adoption of this document and the weak elaboration of legal techniques, so under the indication of the possibility of storing electronic documents, including duplicates. Most likely, it meant an electronic image of the document (an electronic copy of a document made on paper), as indicated in the Resolution of the Plenum of the Supreme Court of the Russian Federation dated December 26, 2017 N 57 "On some issues of the application of legislation regulating the use of documents in electronic form in the activities of courts of general jurisdiction and arbitration courts." However, an electronic copy itself is not an electronic document. It is incorrect to talk about a copy of electronic documents, because according to the physical principles of functioning and the meaning of the provisions of information legislation, an electronic document cannot have electronic copies. 

The study of the specifics of the implementation of the processes of collection, use, storage, as well as ensuring the relevance and reliability of personal data of an individual by local governments has shown that the current and newly created regulatory framework does not fully solve the problems of municipal information systems as sources of information for the formation of a digital profile of a citizen.  In addition, studying the existing definitions of the concept of a digital profile, we see that not all of them include municipal information systems as a source of digital profile formation. This approach will lead to a certain imbalance and may negatively affect the level of availability of municipal services in electronic form and satisfaction with their quality by citizens. The resolution of this problem is a mandatory regulatory indication that municipal authorities can be sources and recipients of information from a citizen's digital profile.

The creation and integration of a citizen's digital profile into public life involves the use of expensive and sophisticated equipment, as well as the use of the most advanced technologies. In the current situation, not all of these technologies are Russian or our state is able to have a significant impact on their promotion and development. Some of them have come under sanctions related to the processes taking place in Ukraine. There is a potential risk of losing the ability to fully use even the already established state information systems associated with the geopolitical situation in the world.

This reality requires serious intellectual and material investments during the implementation of the idea of developing a digital profile of a citizen, and therefore it is necessary to consider the idea of creating a digital profile as a large-scale and long-term project that will require costs not only for technical implementation, but also increasing the amount of scientific knowledge for the processes of studying, separating and minimizing the risks associated with import substitution of certain technologies.

Currently, the dominant point of view is the ever-increasing importance of openness of information about the activities of the state, if it affects public interests, which emphasizes the positive impact of transparency to achieve social stability and its beneficial effect on the economic processes taking place in the state. The positive effect of activities based on inclusiveness and openness is manifested in facilitating the lives of citizens so that everyone can interact equally with the world ^{[8, 9]}. Thus, we achieve the goals set by the Strategy for the Development of the Information Society in the Russian Federation for 2017-2030 and the State Program "Information Society" in the field of ensuring national interests in the development of the information society and improving the welfare, quality of life and work of citizens.

However, innovations in the field of personal data management of citizens using a digital citizen profile create problems that cannot be overcome with the help of existing regulatory regulators, existing administrative structures, administrative mechanisms and other coordination tools.  There is a danger that these initiatives may become declarative due to the lack of effective mechanisms to ensure them ^[10].

Creating a digital profile of a citizen means that new risks arise simultaneously with new opportunities. It should be borne in mind that many of the risks associated with this activity, unfortunately, cannot be completely overcome at the stage of creating a digital profile, and are present throughout its entire life cycle and can potentially have a global character. Of course, it is impossible to completely exclude the entire set of risks when creating a digital profile of a citizen, therefore, the main activity should be the activity of minimizing both the risks themselves and the consequences caused by them. The issues of identifying and taking into account risks when creating a digital profile should occupy one of the central places in modern research ^[11].

  Most researchers of the digital profile, as well as the mass media, pay attention to the fact that its creation carries serious risks, however, they focus only on the problems of the security of data transmission from a citizen to any subject. It is noted that with the increasing number of cases of interaction and expansion of the sphere of information exchange between state information systems, where the level of information security is quite high, with systems of the non-state sector, the risks of unauthorized access and compromise of this information are increasing. Of course, this is quite a serious problem, so the risk study should be comprehensive.

The analysis of the domestic and foreign practice of implementing the digital profile of a citizen allowed us to identify several additional main risks that, in our opinion, could potentially damage public relations.

In an important place among the risks are the risks of violation of constitutional human rights and freedoms. The digital profile infrastructure will create not only new opportunities for data management and the development of the digital economy, but also increased risks for a person associated with interference in areas traditionally related to his private life and protected by Article 24 of the Constitution of the Russian Federation ^[11].

There is a danger of so-called "digital profiling" of citizens, i.e. the creation of new personal data that are not identical to those that were transferred by the specified subject to the controller." For this reason, the profiling method creates a "significant risk to human rights and freedoms": people can "fall into certain categories, and often without knowing about it," and "profiling an individual can lead to unjustified deprivation of his right to access certain goods and services, thereby violating the principle of non-discrimination."" ^[12]. Similar processes of digital profiling and social rating are actively developing in the People's Republic of China ^{[13, 14]}. This practice does not find support among Russian citizens, and according to the sociological survey conducted by us during the study, only 22% of respondents approve.

Studying the documents regulating the experiment of creating digital profiles of citizens, we can conclude that the Russian Federation has embarked on its own special way of building it. The Decree of the Government of the Russian Federation of 11.04.2022 N 837-r "On the concept of transition to the provision of 24 hours a day, 7 days a week, of the absolute majority of state and municipal services without the need for the personal presence of citizens" indicates that profiling is a tool for the implementation of personalized information of the applicant.

It can be stated that at the mass level, the protection of privacy is weakening under the onslaught of digital technologies ^[14], and as a result, modern society has entered a new stage of personal data protection ^[15]. In our opinion, guarantees of the inviolability of a person's private life in connection with the introduction of digital profiles should be normatively fixed, the content of these guarantees should be based on the principle that the digital profile should not include information, the use of which can lead to unjustified state interference in the sphere of an individual's private life or create excessive risks of such interference, and also increase the risks of leakage of particularly "sensitive" information about a person. In particular, there should be a legislative ban on the inclusion in digital profiles of information such as information about the facts of an appointment with a doctor or seeking medical help.

Analysis of the chronology of the implementation of the creation of a digital profile allows us to conclude that its scale and level of complexity of implementation and the time required for creation were not fully taken into account.  As a result, a number of additional, previously unaccounted for measures were required, and the process was delayed. At the moment, it is planned to create the entire digital profile infrastructure by the end of 2022, but even the Head of the Ministry of Finance Maksut Shadaev, speaking at an expanded meeting of the State Duma Committee on Information Policy, expressed only hope that a number of measures of this program will be implemented by the end of 2022 ^[16].

Non-compliance with the established deadlines negatively affects the process of digital transformation of public relations. At the same time, digitalization is developing in an avalanche, and the state does not keep up with the needs of businesses and citizens, which forms "workarounds" for the implementation of the processes of identifying citizens and accumulating their personal data in resources, without an appropriate system of protection and control. There is a situation when conscientious market players are forced to carry out their activities in a legal vacuum.  Thus, we cannot talk about the formed environment of trust in the digital profile.

Another cause for concern is the period for which permission is given to access the digital profile of a citizen. At the moment, on the website of public services, this time period is set automatically and is equal to fifty years. In our opinion, such a long period (two-thirds of the average life expectancy of a person), combined with low awareness of citizens about the peculiarities of the functioning and use of the digital profile, can cause even greater distrust of citizens to this initiative. It is necessary to legally fix a reasonable and sufficient period when a citizen must repeatedly make a decision about the possibility of using his digital profile.

Conclusions

An analysis of the initiatives and the existing regulatory framework shows that they generally contribute to the achievement of the national goal of "Digital Transformation", in terms of creating a digital profile of a citizen. However, the complexity and novelty of the tasks set causes some shortcomings of the legal regulation of private digital issues:

• the necessary changes to federal laws related to the profiling of citizens are still under development, there is no legal definition of many definitions defining the basic concepts associated with the creation of a digital profile;

• a number of regulatory and technical documents are advisory (experimental) in nature, and their mandatory application is not fixed by the relevant regulations;

• the digital profile does not cover all the information available to public authorities, however, the de facto one created as part of the experiment already contains information from other information systems;

• in parallel with a single digital profile, it is allowed to create industry, regional and object profiles;

• there are cases of violations of legal technique in the available documents.

The key risks of creating and applying a digital profile of a citizen can be identified:

• violations of constitutional human rights and freedoms;

• security of data transmission from a citizen to any subject;

• haste of adoption and low quality of legal acts containing shortcomings of legal regulation and not covering all public relations in the field of profiling of citizens;

• the quality of event planning, incorrect assessment of the required time to complete the process;

• low awareness of citizens about the specifics of the functioning and use of the digital profile and, as a result, the lack of a formed environment of trust and non-acceptance of the results of implementation;

• inconsistencies with the international practice of digital identification of citizens;

• financial risks;

• sanctions, as a result of unavailability in Russia of a number of foreign programs, technical means and services.

Minimization of these risks, as well as their consequences, should occur within the framework of improving administration, through the adoption of regulations that would ensure the centralization of all issues of organizing a citizen's digital profile under the auspices of the state.

The specifics of the organization and regulatory regulation of activities for the implementation of the processes of collection, use, storage, as well as ensuring the relevance and reliability of personal data when creating a digital profile are that at the moment it is impossible to use existing regulatory regulators, existing administrative structures, administrative mechanisms and other coordination tools to ensure the implementation of a digital profile.for the danger that these initiatives may become declarative.

We consider it important to establish the mandatory nature of risk management during the entire life cycle of a citizen's digital profile.