Only two out of the 10 countries conducted risk assessments before introducing digital ID systems and neither included safeguards, says a study.