Digital Identity, Legal Precarity, and the New Architecture of International Humanitarian Law and Conflict

The use of digital identity during displacement and in the context of conflict is a nexus of legal, administrative and public legitimacy. This is a specially significant topic in April 2026, as interoperable identity systems can be used to extend reach and capability to perform surveillance, exclusion, and perpetually data sharing. Goodwill is not sufficient to make a strong institution. This is particularly important when under pressure, when misunderstood and as in political change.

The framework of governance is based upon principles of humanitarian data protection, privacy law, refugee protection and the 2023 New Zealand Digital Identity Services Trust Framework Act. The first are sources of standards, the second are institutions that interpret, implement and review such standards. There are several stakeholders involved, such as Displaced persons, Identity Providers, Humanitarian organizations, States, and Border agencies, but also service providers and regulators. There needs to be coordination within that group and independence cannot be sacrificed or responsibility confused.

There are different legislation which govern and regulate conduct during armed conflict, as well as consequences of flight and protection: international humanitarian law and refugee and human-rights law. Administrative systems are inbetween the legal systems and everyday life. The process of registering, eligibility, referring and data sharing decisions mean the difference between protection reaching people in time or not. When institutional tracks are not clear or don't exist, law-based pledges have little concrete impact.

Everyday evidence typically is lost in conflict. Birth certificates, passports, property papers, school records and medical records may be obliterated or lost. An 'umbrella of protection' surrounding flawless documentation puts risk of conflict on displaced persons. The reasonable evidentiary flexibility, corroboration, interviews and review procedures are the way to maintain integrity while also forgoing the catastrophic consequences of missing paperwork.

Several things have to be coordinated between agencies in order to access a service. Separate rules and databases for the immigration status, health, schooling, housing, job assistance and welfare. Fragmentation is repeated disclosure of traumatized information and is inconsistent and makes decisions. Those burdens are minimised through shared standards, consent-based referral and accountable case coordinated through shared responsibility without compromising privacy.

While digital tools can be of great assistance for portability and speed, it is not about technical efficiency and being fast, it is about justice. In automated processes, like biometric matching, flags for risk or errors can be repeated over and over, while remote interviews and interoperable records can repeat the error. Human oversight, other ways to communicate, correction, and clear limitations of purpose are crucial. Social factors like surveillance, exposure of family members, and function creep must also be taken into account — hence security testing has to account for these.

Displaced communities are involved to raise quality of design. Because many former refugees and migrants understand the needs and offered barriers better than central government, do community sponsors, interpreters, disability advocates, etc. understand the barriers better. Enabling rules, communication, locations of services and evaluation should include participation. No record of response = No authority = visibility.

Tailor to a specific purpose, avoid excessive data collection, include privacy education, provide security testing, give patients the right to correct data, and put in place human review procedures. These elements cover each failure point: Authorization: before action, Documentation: while the action is taking place, Review: after the action is taken and Remedy: when there is harm. The order is important – if there is no record or rationale before a particular event, there is less accountability for the event.

Data should include data flows, access logs, breach reports, false matches, refusal of service, requests for corrections, contracts with vendors etc. It is these types of "material" that enable comparison between agencies, between regions, over time and also affected groups. Publication can be done without compromising confidentiality and can still highlight trends, gaps, timeliness and recurrent institutional breakdowns.

Top of agenda for equity is to focus on stateless people, persecuted families who remain undocumented, children, and people with low digital literacy. The formal neutrality cannot resolve the question of whether there is a predictable burden of taxation, or whether there are income, status, geographic, disability, ethnic, age, language or any other disparities in access to review. Design and resource allocation should be based upon distributional evidence!

Policies other than launch should be evaluated over the long term. However, as time goes by, and as new leaders or crises come and go or budgets are reduced, early compliance may lapse. Pressure for continuity as a result of scheduled review, public reporting and independent research. Where corrective action is needed, it should be achievable with the policy rather than an outright failure of policy.

Do ask formal rules to be related to incentives (institutional analysis). Workload and targets, budgets and professional norms and expected scrutiny are all factors in officials' response. Reform is effective when those forces are directed towards the law and fair conduct. This is because a safeguard that is just in a manual is easily lost when under operation.

There are dangers with measuring. Indicators will help to reduce the complexity in the outcome and allow for strategic reporting. Thus quantitative information should be placed alongside any qualitative information, independent verification and clear definitions. Disaggregated reporting is of importance as it can mask particular local or group failures.

The other sphere of public communication, likewise, has an impact concerning legitimacy. The terminology may be so technical one finds it hard to keep track of the actual issues at stake in administrative decisions, and the rhetoric so dramatic that it masks the facts of uncertainty. Objectives, evidence, trade-offs, affected rights and available challenge should be evident in a clear explanation. Expressing limits is often a more powerful way of boosting self-confidence than defining bringing things under control.

Implementation requires resources. Review bodies must be staffed, expert, have job security, have access to records, and be able to demand responses. Funding, interpretation, accessible venues and enough time is needed to facilitate community participation, as well. Undocumented rights and participation duties can turn into to be merely symbolic commitments.

Drew on local deliveries to influence national policy decisions. There is variation in the housing market, school capacity, primary care, transport, interpretation and community networks in the different locations in which settlements occur. It is crucial that there are plans for national entitlements that will work at the local level, as well as clear escalation routes. Formal access can be checked to see if it is present or not, using geographic monitoring.

It is not a must that "trauma-informed administration" is without verification. It demands setting up the interviews, pacing, interpretation and communication for the minimumage of avoidable harm and enhancement of the evidence quality. There should be not too many "retells. A training is required for the staff to learn about the effects of memory, fear and cultural differences and not assume that each deviation is intentional deception.

Institutional coordination should be based on strengthening family unity. Households can be split between services and family members to inconsistent outcomes. Consent based family mapping could be helpful to find out what dependencies would be without making the assumption that all families have one dependency structure. Missing parts of review should include issues of indirect harm arising from the problems of split administration.

Providing language access is not a "just above and beyond" customer service initiative, it's a legal-quality concern. If an interpreter does a poor job they may give inaccurate information about credibility determinations, medical consent, and any appeal rights may be affected. These provide increased fairness and accuracy with the qualified interpreters and translated notices and verification of understanding. Deferr the decision to informal family interpretation or not on safety status.

Clear limits for the retention of data are needed. Data gathered in the midst of crisis can continue to be of use to agencies after the crisis is over. Later misuse will be less likely to occur with the help of retention schedules, deletion verification, access controls and independent audits. Where safe, people need to be notified on storage and correction in a comprehensible way.

Responsibility should be identified at each and every Governance step. Openness and transparency about authorization, delivery, monitoring and remedy are a necessary precondition to effective cooperation among identity providers, humanitarian organizations, states, border agencies, service providers, regulators and DP. For overlapping mandates, there must be clear procedures and escalating. Ambiguity otherwise does not give careful attention to the boundary of institutions, but not concerned individuals.

Risk assessment should be both and inaction. Too much intervention can be a violation of rights and the late or incomplete provision of intervention can mean that significant harm is not dealt with. Records of decisions should contain information to support the balance of alternatives driven by evidence and less-restrictive alternatives. Then reasoning can be critically assessed which may not have been stated and there is no need to reconstruct unstated assumptions.

Independent research can serve as a complement to official reporting and as insight into the community experience. Secure Data Management, ethical use and publication rights enable testing of institutional claims. Community authorities and confidentiality should be maintained in partnerships. Findings need to be responded to in a formal manner and not just acknowledged.

Success should be measured in terms of reduction of errors, reduction of denials, speed of correction, presence of control, availability of alternatives, and self-help avenue to address denials. These measures are a mix of outcomes, procedure, and institution capabilities. The goals should be visible, what is defined should remain stable and when something fails it should be explained, and a plan should be drafted of what is to be done.

Such limitations of purpose, minimal data collection, informed participation, security testing, correction rights, and human review allow for a path of working implementable reforms, particularly when the evaluation focus includes fewer denials to be made, lower error rates, fast correction, control over data sharing, easy alternatives, and independent recourse. Focusing on stateless people, families without documentation, people impacted by persecution, children, and people with low digital literacy helps not to let large-scale success disguise large-scale harms. Protection of dignity is only afforded to digital identity when legislation moves with the data – across all institutional lines.