APIproposal_IdentityAndConsentManagement_Cellcard

[prasadcj]

Problem description
The use case behind this is that the Cambodian government wants to securely query SIM profie from each mobile operator. To achieve this, they have requested all operators to provide APIs for secure data access.

Possible evolution
The current API query used to retrieve a subscriber's SIM profile exposes specific personal and technical information associated with a mobile subscriber's account. This includes sensitive data such as the subscriber's name, date of birth, ID card details, and SIM status. While this information is essential for identity verification, service eligibility checks, and account management, the exposure of such sensitive data raises significant concerns about data privacy and security, necessitating stringent controls and safeguards to mitigate potential risks.

Alternative solution
We are a Cambodian mobile service provider called Cellcard. We have developed this API and plan to publish it under the CMARA project. This initiative aims to establish a common API standard that all mobile communication providers can adopt for similar use cases, promoting consistency, interoperability, and operational efficiency across the industry.
Additionally, we had a meeting with GSMA, where they suggested we make a proposal to the CAMARA EKYC project, as this API aligns more closely with EKYC-related initiatives

Additional context
Please find the full API Documentation URL : https://drive.google.com/file/d/1zDhR9Ca13O_zyuHGnXNY3bmdwnU2R1L4/view?usp=sharing.

[hdamker]

Looking on the provided documentation, I have the impression that the name of the proposal is misleading. The functionality is actually very similar to kyc-fill-in, looking on the request (phoneNumer) and response parameter in the document on Google Drive. For sure, this are privacy sensitive information and the therefore the mechanisms defined in IdentityAndConsentManagement are relevant here to protect the API.

BTW: is my understanding correct that providing the access to this API is required by law?

[jgarciahospital]

Agree with Herbert's comment, API seems very similar to current CAMARA KYC Fill-in API and not so related to proposal title of Identity&Consent.