There are a total of 17,733,723 registered voters in Nepal. The list is available on the Election Commission website. And there are all the details. Name. Age. Gender. Address. Voting station. Spouses’ names. Parents’ names. Voter ID number.

All these private details are just a click away, with no access control. One can simply visit the Election Commission’s website (https://election.gov.np/en/page/voter-list-db).

The availability of such publicly identifiable data, experts say, not only violates the privacy rights of citizens but can also have far-reaching consequences of fraud and misuse of such sensitive information.

“I don't know what the law says about it, but the website clearly exposes my personally identifiable information, which seems to be a clear violation of my right to privacy,” said Gaurav Khatri, customer success engineer at Logpoint, a cybersecurity analytics company. “If someone just casually downloads all the data from the site and uses proper filters, they can find personal data about anyone in this country.”

Election commissioners and open government advocates, however, stress the need for such data in political strategizing and campaigning. But data experts, data rights advocates and lawyers are alarmed by the easy accessibility of personally identifiable information of voters. They are also wary of the potential misuse of such easily accessible data both by political parties and third parties.

Data is becoming an increasingly important—and sometimes controversial —tool in designing and developing campaign strategy. Transparency and broad access help to ensure more people are scrutinising the data to avoid fraud, according to Beth Noveck, director of The Governance Lab, a research and innovation centre focused on data and technology driven governance based in New York.

“Maintaining accurate, up-to-date, and verifiable voter rolls is extremely important for ensuring the integrity and accountability of elections,” said Noveck, who is also a professor at Northeastern University where she directs the Burnes Center for Social Change. “It is important to be able to check one’s registration status and for third parties like election researchers to have access to data to be able to study elections.”

Under General Data Protection Regulation (GDPR), the toughest privacy and security law passed by the European Union, personal data is any information that relates to an individual who can be directly or indirectly identified, that includes, names, email addresses, location information, ethnicity, and gender.

The availability of such data is crucial for strategizing political campaigns and rolling out relevant policies depending on the demographics of their constituency, according to Taranath Dahal, founding chairperson of Freedom Forum Nepal, a non-governmental organisation advocating for open data and institutionalisation of democracy.

Data analysts see the potential of using such large datasets in designing targeted ads given the information on age, gender and location. As independent researchers, there’s a large scope in using such data, they say.

“For data analysts like me, I can now clearly find the voter distribution by gender and age in each region of Nepal. So, eligible candidates can now use this data to target specific ads to specific regions based on the majority demographic. For example, if Region X has 60 percent voters that are less than 30 years old, old age allowance as a policy would be a less attractive solution,” said Khatri.

However, with the increasing importance and awareness of personal data, experts are concerned that electoral data could be misused for various purposes. Not just can such data be misused by various businesses in implementing targeted advertisements, it also raises safety concerns for vulnerable populations, according to them.

“Anyone who would not want to be found, for whatever reason, is immediately put at risk. A good example of this might be victims of domestic abuse fleeing from their spouses. For them to stay off the record, they'd now have to sacrifice their vote,” said Bhasi Nair, director of data science at EquiTech Futures, a research lab and talent incubator focusing on problems at the intersections of technology and society in an email interview.

Additionally, experts are concerned that this may open avenues for further discrimination against voters in the longer run—in their employment, while accessing bank services or seeking any other services.

“Any decision-making private entity can now profile you in a way they perhaps couldn't before. Based on the name and location, other protected demographic attributes (ethnic group, caste, etc) can also be inferred,” said Nair in an email interview. “This can allow employers, banks, and other private institutions to discriminate.”

In light of the public access to the electoral roll data in Nepal, Body and Data, a digital rights organisation, has released a statement addressed to the Election Commission, National Human Rights Commission, Ministry of Communications and Information Technology and National Information Commission calling for privacy of voter data.

Incorporating voter information into a publicly centralised data system increases risks to voter privacy making them feel insecure and may lead to misuse of data, the statement reads.

However, election commissioners believe that such publicly available data poses no threat to voters as the voter roll doesn’t provide access to voters’ photos, thumbprints and phone numbers.

“To maintain privacy, we don’t reveal the photo, thumbprint or their mobile numbers. One’s name can match with many other people. There should be no concern of a breach of privacy,” said Election Commissioner Ishwari Prasad Paudyal.

Contrary to Paudyal’s claims, technologists and data scientists believe that voters’ mobile phone numbers can easily be accessed by merging and analysing datasets.

“Information on individuals’ name (person, spouse, parents), age and address (to some extent) can be enough to pair with other datasets typically available with corporations or service providers that require mobile/email to verify their identity,” said Yash Gorana, technology fellow at EquiTech Futures. “With this, the voters are open to electronic abuse and fraud.”

Additionally, scientists find the lack of security on the page concerning. The website does not control the amount of incoming and outgoing traffic to or from a network, allowing easy extraction of data.

“The security on the page is awful. There's no captcha to mitigate bots. No rate limiting request either (at least based on my attempts). The whole database can be scraped pretty easily,” said Gorana.

While experts agree that the voter should be able to verify their names in the voter rolls, they believe that mechanisms should be in place to ensure that only the voter can access their information.

“This seriously undermines the privacy of the voter. They should have instead arranged a mechanism where only I can see my details,” said advocate Baburam Aryal, who specialises in internet and cyber law.

Such transparency can be misused to disenfranchise and harass voters of the opposite political party, according to Noveck.

Experts emphasise the need for a public conversation, informed deliberation and public participation in the decision in determining the balance between what should be kept private and public. Achieving goals of accountability and integrity while reducing the risks of misuses should be considered, they say.

“It isn’t simply a choice between yes or no transparency. How we achieve transparency is important,” said Noveck in an email interview.

States in the United States vary in their confidentiality, accessibility and the usage of the electoral roll. However, states also allow voters to request their information to be kept confidential, particularly for victims of domestic violence, sexual assault, stalking and other crimes.

In the United Kingdom, voters can opt out from the open register and have the option of voting anonymously. They also regulate the usage of such data for electoral administration purposes, campaigning activities, preventing and detecting crime, checking applications for loans or credit and jury summons.

Under section 37 of Nepal’s Electoral Rolls Rules, 2012, the Election Commission shall establish its own website for public information of and access to the final Electoral Rolls collected, updated and prepared.

Nepal, however, has no laws regulating the accessibility and usage of such data.

Data analysts and open governance advocates believe that more and more data should be public given the possibilities of understanding the society and its demographics better. However, they feel an urgent need for data regulation policies to protect the privacy of voters and potential misuses.

“Such availability of data can drive really precise and impactful development policies. But the government needs to have some strong regulations in place to protect our privacy,” said Khatri. “The commission should have hashed at least my name and my parent's names from the website.”